Hacker News Reader

Comment by taberiand | Hacker News Reader

I suppose it depends if it's worse than reported currently, but it seems to me that with only 600 accounts losing an average of ~$800 each (and I'm going to go out on a limb and assume the users had poor password security), the fast detection and the immediate action to lock it down, there was a good and effective response by the companies attacked

View on HN

> it seems to me that with only 600 accounts losing an average of ~$800 each

From the article:

> AustralianSuper, the country's largest fund managing A$365 billion for 3.5 million members, said that up to 600 member passwords had been stolen to access accounts and attempt fraud.

> Four AustralianSuper members had a combined A$500,000 drained from their balances and transferred to other accounts that did not belong to them, according to the source, who was not authorised to speak publicly about the matter.

It's not completely clear if 600 passwords were "stolen" but only four accounts had any money transferred, or if there are more accounts at that fund that had money transferred.

And that's just one fund.

> Rest Super, the default industry pension fund for retail workers, with A$93 billion of assets under management, said it suffered an attack that impacted around 20,000 accounts, or around 1% of its 2 million members.

Oh you're right, I misread. That's much worse for those 4 people but still not too bad (so far)

How could they really use the money anyways even if they transfer it to another account? I don't know how one could get away with it. Follow the money!

Our company was scammed (invoice scam) and talking to police it’s actually easy. They transfer it to another local bank account (normally stolen), then immediately transfer it overseas. At that point it’s more or less gone.

Damn, and there is nothing to be done after the transfer to overseas? They would be able to figure out who the perpetrator is, right?

Depends on what country it goes to. Transfer to major first world countries and the money is still easy to trace. Transfer to Russia and you can't trace it

Interesting, thank you. I thought authorities or Governments would work together, but perhaps not.

Geopolitics are still in play. Why would a country that has been hammered with "Western" sanctions, and is effectively engaged in a proxy war against the "West" cooperate with the "West" when it comes to law enforcement?

* Australia is part of the "West" here - ironic from a strictly geographic perspective

Can't the Western government strongarm the receiving bank by threatening to kick them out of SEPA/ACH/Fediwire?

There is only so much you can do - you kick them out for everything and thus further cutoff the country and that in turn means you have less influence in the future.

Something so major (global finances), over an issue so minor (fraud on an individual basis)? Serious organizations don't play games like that.

That is true. I wonder though, if Russian citizens do this in the US, then there is not going to be anything done about it? What if it is an American citizen? I do not expect them to be able to spend it in the US (but I may be wrong). Would they just go to Russia or somewhere else and then use the money from those bank accounts overseas and start a new life, or what? I am just trying to imagine the scenario. I have watched The Wolf of Wall Street which was quite good. I wonder how it would usually go today, and how people get away with it, because one would think today it is not easy to get away with it. I imagine if I were to scam someone, I would get in legal troubles here, in Hungary, even if I were to send it to a bank account somewhere else in another country, is this an incorrect assumption?

I am going off-topic here, because Australia is in question here, so perhaps replace my use of "US" with Australia and "American" with "Australian".

It is called money laundering. Happens all the time. when it is an American (or Australian, German...) they just have multiple accounts in Russia and transfer the money around in Russia a bit before bring it back. You often lose a significant amount of money in this process.

>Damn, and there is nothing to be done after the transfer to overseas?

You can file an MLAT request

https://en.wikipedia.org/wiki/Mutual_legal_assistance_treaty

But it's a complex, time consuming process usually only done in cases of terrorism or espionage, not run of the mill fraud.

For most people (pre retirement age) the funds are locked in a trust they can barely access themselves. I presume (big if) that those that lost money were retired and payment details for their monthly income was changed to pay to the bad guys accounts.

This was exactly my thoughts, how exactly can the 'bad guys' access it, when people who may need it cant ?

It is still really bad - (again if it was the case) monitoring very simple things like "# of changed payment" instructions could detect this sort of fraud quickly, or at worst speedbumping the time to change payment instructions.

Pre self service on the internet call centers / mail in processors would have noticed if a large % of customers changed their payment details over a few days.

Reply on news.ycombinator.com