Postbank hacked for R42m

Read time 3min 40sec

The SA Postbank, part of the SA Post Office, became the target of cyber crime this month, losing R42 million.

“We became aware of some fraudulent activity in the early part of January 2012,” says the Post Office.

Media reports say the heist took place from 1 January to 3 January, while Postbank was closed for business.

The Postbank system was hacked and transfers worth R42 million were made to specific accounts, after withdrawal limits were increased and the money was then pulled out of the accounts in large sums.

The Postbank is attempting to become a fully licensed bank so that, while remaining state-owned, it may compete with commercial banks.

Whose funds?

“We need to emphasise that our customers' funds were in no way compromised by this incident,” says the Post Office.

However, ITWeb enquiries as to whose money was lost and regarding other details of the heist were not answered by the time of publication.

The Post Office adds that Postbank is working with the SA Police Services and the National Intelligence Agency to investigate the matter.

“So as to ensure everything possible is done to prosecute those responsible to the fullest extent of the law.

“We are not at liberty to divulge further information due to the investigations, which are currently under way,” explained Lungile Lose, spokesperson for SA Post Office.

High security

The Post Office is in charge of government's Trust Centre, which means government entities conducting work online and via e-mail, make use of the post office system.

Responding to whether this raises security concerns for government, communications minister Dina Pule says “the centre has high security parameters to protect all the services delivered through it”.

Media reports also say the Postbank spent over R15 million about three years ago to upgrade its fraud detection system.

In 2009, the Postbank said its customers were hard hit by an upsurge in card fraud, via cloning, and in March 2010 it aimed to spend R250 million on the second phase of its IT upgrade plan.

Avoiding mules

“The majority of cyber crime, even the most sophisticated, is based on the simple exploitation of traditional IT access credentials - cards, PINs, passwords (CPPs) - it's just so easy,” says channel manager at SuperVision Biometric Systems Mark Eardley.

He adds that the Postbank cyber theft is no exception. “It appears that two employees' login credentials were used to effect transfers to 'mule' accounts opened by the cyber villains late last year.”

Even the most sophisticated cyber criminals will use this basic tactic to commit fraud. It doesn't matter how complex PINs and passwords are because cyber criminals know how to use or bypass them, according to the channel manager.

“People are often surprised that SA is a world leader when it comes to biometric access technology.

“Fingerprint technology can be very easily used to completely replace CPPs within IT - from initial sign-on through to transaction/activity authorisation - eliminating the four fundamental flaws shared by any form of CPPs which are all routinely lost, forgotten, shared and stolen.”

Eardley explains that two and a half million people in SA enter their places of work using their fingerprints or biometric access every day and this is more than the US and Europe combined.

“We are far ahead the rest of the world in our use of biometric access control.”

He says the move now needs to be to IT systems being protected by this technology in the case of funds and sensitive data.

Several government departments are already using this technology to protect its systems. These include home affairs and rural development and land reform, and Eardley believes this is the technology the Postbank should be implementing to avoid heists of this nature.

“We must now ask if IT generally is satisfied with protecting itself with nothing more than a password and a PIN.”

See also