Alarm: New ATM Scam Using Phones to Steal Money

Online Scams: A Growing Threat from the Czech Republic

Unfortunately, online scams are ever-present, with criminals continuously devising new techniques to target unsuspecting victims for financial gain.
The latest scheme originates from the Czech Republic, allowing fraudsters to siphon off money through their mobile phones.
Here, we will explore how this alarming new method operates and how to safeguard oneself from falling victim to such scams.

The New ATM Scam: How It Works

Every day, countless individuals become victims of scammers who steal personal data to drain their bank accounts.
While the objective remains consistent—transferring money from victims to the fraudsters—methods of execution evolve.
Recent reports from cybersecurity firm ESET reveal a new technique that poses a risk to customers of various global banks, aimed at facilitating unauthorized ATM withdrawals.

At the heart of this scam lies a malicious software known as NGate, which has the capability to send payment card details stored on a mobile phone to the criminals via an infected Android smartphone application.

According to ESET, attackers have combined harmful strategies such as social engineering, phishing, and Android malware into a fresh attack scenario.
The first instance of this scam was recorded in the Czech Republic in 2023.
Using NGate, fraudsters successfully cloned NFC data from physical payment cards belonging to unsuspecting victims, forwarding this information to their own devices.
This enabled them to emulate the original card for cash withdrawals at ATMs.

To execute this fraud, the NGate malware must first be installed on the victim’s phone.
Scammers employ various tactics, such as deceptive SMS messages containing clickable links.
Once the link is clicked, the malware is surreptitiously installed, allowing the theft of payment card information.

Armed with the stolen data, fraudsters clone the cards to withdraw cash from ATMs.
If this method fails, they have additional ways to transfer funds from victims’ accounts to other bank accounts.

How to Defend Yourself

There are several strategies to protect against such attacks.
Here are some essential tips:

• Always check the URLs of websites you visit, especially those of banks and institutions, ensuring they are legitimate.
• Download applications only from official app stores.
• Keep PIN codes secret; do not store them on your phone.
• Disable NFC when it is not necessary.
• Use protective cases or virtual cards secured with authentication.
• Install security apps on your smartphone that can detect potential viruses.

By following these guidelines, you can defend against scamming attempts.
It is crucial not to trust SMS messages from banks or institutions that direct you to external links.
In most cases, these are attempts at fraud.
Remember, no legitimate banking institution requests personal information.