April 24, 2012 By Amit Klein 2 min read

We recently uncovered a scam in an underground forum that shows how data obtained through phishing and malware attacks can be used to make one of the oldest forms of fraud — check forging — even harder to prevent. The scam involves a criminal selling preprinted checks linked to corporate bank accounts in the United States, United Kingdom and China.

Check Fraud Meets the Digital Age

To pull off this scam, the criminal sells falsified bank checks made with specialized printing equipment, ink and paper. For $5 each, he or she will supply checks that use stolen bank account credentials provided by the buyer. However, to purchase checks that use stolen credentials supplied by the counterfeiter, the cost is $50 — a tenfold increase. This is a clear indicator that stolen credentials are a key enabler of check fraud.

Check data fields include personal information (name, address and phone) and financial information (bank account, routing code and check number). To obtain all the required data, fraudsters typically need to get their hands on a physical or scanned version of a real check in circulation. Many banking websites provide access to scanned versions of paid and received checks. Online banking login credentials obtained through malware and phishing attacks can be used by fraudsters to access a victim’s account and collect all the required information to commit check fraud. In addition, before using the checks, fraudsters could potentially ensure the account balance is sufficient to approve the transaction.

The criminal recommends using the checks to buy products in retail stores rather than trying to redeem them for cash. Buyers are also encouraged to carry fake identification cards that match the stolen credentials on the check; the check counterfeiter offers to provide these, as well.

The Evolving World of Fraud

This is the latest example of how criminals can use malware and phishing techniques to make traditional physical fraud schemes more effective. This cross-channel approach is helping fraudsters stay one step ahead of even the most sophisticated fraud detection systems deployed online and in the brick-and-mortar world. It is also creating a new generation of Frank Abagnales who are not even required to invent their own fraud scams.

More from Fraud Protection

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today