How was my bank account hacked if I did everything right?
Hi everyone. Leo Notenboom here for askleo.com.
Here's the question.
My bank account was just hacked.
The hacker opened a new account, transferred money from my line of credit
into the that account, then transferred the money out to his outside account.
So it appears he somehow got my client card number and my password.
My laptop is about five years old, running Windows, which I update every week.
I have Bitdefender for virus scan, which I do a full system scan every week.
My password was 15 characters long,
with a mix of numbers and upper and lower case letters.
When I'm not home, I use a VPN service
while on the Internet. I've changed my bank passwords to 22
characters long and installed Malwarebytes Premium for real time virus protection.
So I have two questions.
How could a hacker possibly do this
with the precautions I have, and how can I protect myself further from this point?
So my take is that you actually had good security in place. Above average.
I'll even say this actually does make
analyzing what may have happened more difficult.
I can't tell you exactly what happened.
There's simply no way.
There are too many as. We'll see in a minute.
There are too many different ways
that things can go sideways, and not all of them are in your control.
And that's the part that I think a lot of people don't quite understand.
I do have a couple of ideas on how
to protect further if this had happened to me.
So one of the things that I think is very
important to realize is that it might not be you.
A lot of different pieces of security are, to be honest, out of your control.
For example, you might rightfully be sharing things like account numbers
and even passwords, in some cases with other services that you use.
Like I said, rightfully so.
For example, one bank may need access to another,
or you may have a mobile app that requires access to your banking information.
These may very well be completely
legitimate and aboveboard apps, but they also have your security information.
They may also have information about your
account and in some cases, even your password.
It's not something I recommend you do often or do lightly,
but there are absolutely scenarios where it is in fact, the right thing to do.
There are other things that are important
to realize about your account ID, and that is many parts of it aren't private.
They just aren't.
Your username isn't necessarily private.
Your account number isn't necessarily private.
Your email address isn't necessarily private.
In reality, for most banking situations, it's your password that is private.
And then with two factor authentication,
something else, be it your phone or an app or whatever that proves it's you.
That too is something that's in only your control and therefore private.
But the point here is that a lot of the information we had out on a regular
basis without even thinking about it is by definition, not private.
The best example I have is if you're someone who's still writing checks.
Every time you write a check, you are handing someone a piece of paper
that has your name, possibly your address, sometimes even your email address
and phone number, your bank account number,
your bank's routing number, and a copy of your signature.
That's a lot of information,
and in some cases, that alone can be enough to cause issues.
It's not as common as it once was because we now understand just
how not secure things like that are. Checks as the example,
but we've relied on that for decades
for that to be the way we transfer money from person to person.
And it's still around. So a lot of the information? Just consider,
everything that's on the face of a paper check.
It's not private, it just isn't.
And sometimes that coupled with other things.
Maybe data discovered in a breach might be put together to build a slightly more
complete picture of you and your accounts, possibly even to the degree of your being
able to lose access to your account to a hacker.
Now, I also have to point out though, it might be your bank.
And again, I don't mean
that in a malicious way, but the fact is, not all banks are perfect.
They're staffed by people.
People make mistakes.
And indeed, most common breaches turn out to be
the bank or the credit card company, or the company that's holding your credit
card information, or somebody them getting breached.
In other words, again, it's something else that is completely out of your control.
All you can do is choose as best you can,
the services that you work with that you're willing to trust
with this information, and then trust that they're going to do a good job.
And then also trust that if and when
things happen, they react appropriately and keep you safe.
Keep your information safe.
Keep your money safe.
There's always the possibility of an inside job.
It's rare, but it does happen again.
Also out of your control.
It's something that is again,
you're placing trust in that institution's hiring practices to make sure that they're
actually only trusting people internally that they should be trusting.
But again, it's out of your control.
It could be something in the middle.
We often talk about your ISP being able to see everything you can do,
and in a lot of ways that's true, although it's typically not true when it
comes to secure things like accessing your bank over Https or your financial
institutions or other places where your information is kept secure.
They won't see your passwords going back and forth again as long as it's Https.
The problem is that there are other scenarios where somebody in the middle
could in fact be gathering information about your activity and your account
information for example, if you use a public computer and it has
a keylogger installed, you've just handed over your banking information.
My advice?
Don't use public computers for private information.
Don't use it for your banking.
Don't use it for anything you would consider to be sensitive.
Using a friend's computer with a keylogger installed falls into that same bucket.
And once again,
this is one of those scenarios where it doesn't even have to be malicious.
Your friend may be the most honest person in the world.
They just happen to have a keylogger
installed because they missed a piece of security or they overlooked something.
They're also at risk from the same keylogger.
But the fact that you used their equipment then exposed you to the same security
issues on their machine that they too are facing.
So that is another case of know who to trust.
Don't use the computers of people that you don't trust,
understand security completely, and keep their machine as safe as possible.
And finally, it's interesting.
The technical term for what I'm going to describe is using a computer that is
exposed to what's called a man in the middle attack.
In other words, rather than your data going directly from your computer to your
bank, there's somebody in the middle who's able to capture or sniff the information.
Normally, Https secures you from that.
However, (there's always a however,)
if, for example, you are using a company computer where they have set everything
else up, it is possible for them to intercept Https communication.
So if you don't trust where you work, then maybe don't do your banking at work
or on their equipment or using their network, because there are ways to make
that happen, to expose more information that you might
normally not be exposing, even if you're doing everything right now,
honestly, it could still be malware if I had to place a bet.
Aside from a large scale breach,
which sometimes you don't hear about for a while.
But if you haven't heard about a breach from the bank that you're dealing with or
whatever, then honestly, number one on the list.
Yeah, you've still got some malware.
Even if you're doing everything right, you could still have malware.
And I say that because not every anti
malware tool, not every security software package actually catches all malware.
They just don't.
There's a variety of reasons for that.
But it is the truth that there is no such
thing as a security package that will catch absolutely every bit of malware.
Something could have snuck through.
It's unfortunate, but it could happen. If
you suspect that, of course, what you did was exactly the right thing to do.
Get another security package and run additional scans.
Now, the last one, based on what you've described in your
question, I don't think applies to you, but I have to include it to be complete.
It could be you.
There is no malware. Besides security software not being perfect.
There is no security software that will
protect you from yourself if you are determined enough to bypass its safety.
The scenario that I always describe is
that somebody has promised you a picture of dancing bunnies,
and no matter what your security software tells you might be going on,
you want to see the dancing bunnies you've been promised.
You bypass all of the security.
There are no dancing bunnies.
There is only malware, and then it's too late.
And in fact, it could be disguised as
something that you don't even realize that it's malware until it's too late.
Right? Something could act off or act odd,
but not in such a way that you said, oh, I just downloaded malware.
Not at all. It may be so well disguised that even
the failure to get the dancing bunnies that you were promised
doesn't really look like you just got malware, when in fact you did.
So what I would do in a situation like yours,
and a lot of this is what you've already done.
Again, I want to re emphasize that the description you gave me is great.
The steps that you take are good.
But to revisit what I would do if I found
myself in that situation, number one, I would absolutely change the password
to something secure, even if it were already secure.
For example, I tend to use 20 characters random,
even if I already had a secure password on that account.
If there were a breach,
if my account was compromised, I would change it to a new one.
I wouldn't necessarily make it any
stronger, because that's a good, strong password, but I would absolutely
change it to a different password because clearly somebody knows the first one.
I would consider adding an additional security tool, as you did.
Your baseline of anti malware software was doing its job.
Having another one do an occasional scan is also not a bad thing at all.
I would also use this as an opportunity
to set or update any and all of the account recovery information
associated with that account for two reasons.
One, it's a great reminder of how important that is, because that's probably
what you needed to do to regain control of your account.
But also it is something that many people ignore and let become out of date,
and therefore it's not there when they need it.
And malicious actors,
the hackers who hacked into your account often will change that information
to prevent you from being able to get back in.
So once you're back in,
however you got back in, definitely set and or review all
of the account recovery information associated with that account your
alternate email addresses, your phone numbers, your security questions.
If those are still being used,
all of that make sure that it's correct and specifically for banking.
The other thing that I actually strongly
recommend, just in general, even if you haven't been breached or had
an account hacked like this add transaction alerts.
I have them on my credit card,
I have them on other things and it's great Because what that means is that whenever
my credit card is used, I get a notification and email.
In fact, with one provider,
if it's used and the amount is above a certain threshold, I get a text message.
If that's not me doing it.
If I don't understand why there's a charge being applied to my card,
I know then right then and there to get in touch with a credit card vendor or
the Bank To let them know that there is something fishy going on.
Now, I do want to close this
by emphasizing something a lot of people will hear all of these things that can
possibly go wrong and end up being completely afraid of online banking.
90% of what I just described applies Whether you bank online or not.
Don't let this scare you away from online banking.
In fact, there are some very strong
arguments for online banking Being more secure Than the traditional alternatives.
Remember what I was talking about?
You're using your paper checks.
When you're using a paper check,
you're exposing a bunch of information to random people to whom you are writing
checks online equivalent is significantly more secure Because you're not exposing
a bunch of information necessarily that you don't need to expose.
The same is true for credit cards.
Same is true for just accessing your information online.
Your inbox is much less likely to be
looked into or stolen than, say, your physical mailbox.
We hear about that kind of stuff happening
all the time, Especially if you're even a little bit rural.
Mailbox theft is not an uncommon thing.
That's not going to happen if you're
getting your statements, for example, online.
So I really want you to not be afraid of online banking.
What I want you to do is be secure.
Take all of the steps you need to take to make sure that your banking,
Whether it be online or off, Is as secure as you can make it.
But in your specific case, I'm very happy with the steps that you've taken.
I would tweak them just a little bit
myself as I described And I'd move on keeping vigilant, of course.
I hope that helps. For updates.
For comments for related links and more or
visit askleo.com/42906 I'm Leo Notenboom this is askleocom.
Thanks for watching.