Chapter 32: The Breached Citadel: Takeover of Bank Accounts and Credit Cards

In the old world, the path to a person's money led through steel doors, heavy safes, and armed guards. The bank robber of the past required a physical plan of action, weapons, and a healthy dose of adrenaline and risk. Today, that fortress has changed. Steel doors have been replaced by lines of code, and guards by encryption algorithms. However, the most fundamental change is not technological—it is psychological. The modern robber does not break into the bank; he convinces you to open the door, invite him inside, and hand him the keys to the vault on a silver platter.

Bank accounts and credit cards are the 'holy of holies' of our financial identity. They represent years of hard work, savings for an apartment, money for children's education, and the daily security to buy bread and milk. When this fortress is breached, the feeling is not just of financial loss. It is a fatal blow to one's sense of security, a brutal intrusion into privacy, and a destabilization of the basic trust in the systems meant to protect us. In this chapter, we will analyze the mechanisms that enable the takeover of financial accounts, understand the complex legal arena that arises in their wake, and examine the legal options available to the victims.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

Educational Scenario: The Telephone Trap

Rami (a pseudonym), a self-employed landscaper, never considered himself a 'technophobe,' but neither was he a computer expert. He knew how to operate his bank's app to check balances and pay suppliers. One afternoon, his phone rang. On the display appeared a number that looked like the familiar customer service number of his bank.

'Hello, am I speaking with Rami?' asked a professional, authoritative female voice from the other end. 'This is Dana from the bank's security department. We have detected unusual withdrawal attempts from your account from a foreign country over the past hour. Have you performed any such action recently?'

Rami panicked. The thought of money disappearing from his account affected his analytical ability. 'What? No! I'm at home, I just finished working,' he replied with a trembling voice.

'I thought so,' Dana answered calmly. 'Don't worry, we are here to stop it. In order for us to block the transaction and put the account in protection mode, I need to verify your identity. I have just sent you an SMS authentication code. Please read it to me so we can continue with the blocking.'

Rami saw the message arrive. The sender appeared to be the bank. Inside the message was a six-digit code. In the pressure of the moment, he did not notice the warning stating not to share the code. He read out the digits. Dana continued and instructed him to click on a link sent to him to perform a 'resynchronization.' The website looked exactly like the familiar bank site. He entered his username and password as requested and provided another authentication code sent to him.

At the end of the call, Rami felt relief. He did not know that at that very moment, hostile actors using phone spoofing technology were operating in his account. The codes he provided were not for security, but to authorize money transfers and add new payees in real-time.

About an hour later, when Rami tried to log into the app, he discovered that his access was blocked. Upon a formal inquiry with the bank, it turned out that significant sums had been transferred from the account. His fortress had not been breached by force; the keys had been handed over following a sophisticated manipulation.

The Anatomy of the Takeover: Analyzing the Mechanisms

The takeover of a bank account or credit card is often a multi-stage event. The attackers gather intelligence in advance, sometimes through previous data breaches, and build a cover story designed to bypass the two-factor authentication (2FA) mechanism.

1. Social Engineering

This is a tool designed to create a sense of urgency and panic. Under pressure, customers may skip verification steps. Using spoofing technology makes the call appear to come from a trusted source.

2. Spear Phishing

Sending a personal message that includes a link to a 'mirror site'—an exact copy of the bank's website. Once the customer enters access credentials, the information is passed directly to the attacker, who uses it on the real site.

3. Obtaining a One-Time Password (OTP)

Attackers attempt to obtain the code sent via SMS in various ways:

• Persuasion: Deceiving the customer so they provide the code voluntarily during the call.
• SIM Swapping: Impersonating the customer to the mobile carrier to transfer the number to a SIM card in the attacker's possession.
• Malware: Installing software that allows for remote message reading.

4. Credit Card Takeover

The process may begin with small charges to test the card's validity, followed by significant purchases. In some cases, contact information in the credit card company's systems is changed to prevent the receipt of alerts.

The Legal Arena: Analyzing Liability and Duties

The central question in these cases is the issue of liability for the lost funds. The answer depends on the circumstances of the case, the customer's conduct, and the financial institution's adherence to its professional duties.

Payment Services Law, 2019

This law regulates the relationship between the customer and the payment service provider (bank, credit card company, or payment app). The crucial concept in the law is an 'unauthorized payment transaction'.

According to the law, as a general rule, in the event of an unauthorized transaction, the payment service provider must refund the amount of the transaction to the customer within a defined time, unless there is reasonable ground for suspicion of fraud on the part of the customer. The law distinguishes between different levels of liability:

1. Limited Liability of the Customer

In cases of theft or loss of a payment instrument, provided the customer notified the provider immediately upon discovery, their liability may be limited to the amounts specified by law. The remainder of the damage may fall on the financial institution.

2. Claim of Gross Negligence

Financial institutions may attempt to prove that the customer acted with 'gross negligence' (such as voluntarily providing a secret code) to exempt themselves from the duty of restitution. However, in professional legal analysis, the fact that scammers use sophisticated manipulations is taken into account; what appears in hindsight to be a mistake may be considered a reasonable reaction under pressure at the time. An examination of social engineering may influence the attribution of liability to the customer.

3. The Bank's Heightened Duty of Care

Banks and credit card companies have a heightened duty of care toward their customers. In the event of a hack or takeover, several issues are examined:

• Identifying Red Flags: Were the monitoring systems supposed to detect activity that deviated significantly from the customer's normal usage patterns?
• Real-Time Response: From the moment of reporting, did the financial institution act with the appropriate speed to block the account?
• Quality of Defense Mechanisms: Did the institution use reasonable and advanced security measures in accordance with accepted standards?

During the course of my professional work, I have encountered cases where, despite a mistake by the customer, failures were found in the bank's monitoring system. In such situations, a claim may arise for the financial institution's liability for the damage, or a portion thereof, as part of a 'contributory negligence' examination.

Dealing with Credit Card Companies

In cases of unauthorized charges on a credit card, there is a procedure for 'transaction dispute.' The Payment Services Law stipulates that the company must provisionally credit the customer until the matter is clarified. In situations of a full takeover, where contact details were changed, in-depth legal examination is required to prove that the actions were not performed by the customer.

Warning Signs and Prevention

Vigilance can prevent many fraud cases. The following are suspicious signs:

• Requests for codes during an unsolicited call: Official bank representatives do not ask customers to read out an authentication code sent to them via SMS.
• Links in messages: It is recommended to avoid entering bank websites via links in messages, and instead use official apps or by typing the website address directly.
• Changes in cellular reception: A sudden loss of reception may indicate a SIM swapping attempt.
• Requests for remote control: A demand to install software that allows computer access by an entity claiming to be a service representative is a red flag.

Immediate Actions in Case of Suspicion

Speed of response is a decisive factor in minimizing damage:

1. Disconnecting the call: In the event of the slightest suspicion, contact must be severed immediately.
2. Proactive contact with the financial institution: Calling the official hotline to freeze accounts and payment instruments.
3. Changing passwords: Updating access details for financial services and email.
4. Documentation: Saving screenshots of messages, recording phone numbers, and call times.
5. Reporting to authorities: Filing a police complaint to obtain the confirmation required for further investigation with the bank.

Legal Aspect and Courses of Action

In cases where a financial institution refuses to refund money, one can examine the legal tools available to the victim. Over the years, it appears that professional analysis detailing the security failure or the breached duties of care may, in certain circumstances, lead to an examination of settlement agreements or options for refunding money, depending on the circumstances of the case.

Within the framework of legal proceedings, the courts examine the totality of the circumstances, including the measures the financial institution had at its disposal to prevent the damage. The more sophisticated the fraud, the more likely the court is to consider imposing liability, full or partial, on the financial institution, taking into account that the customer is viewed as the party needing protection in the transaction. The Payment Services Law provides a central foundation for protecting users, and it is important to stand up for the rights derived from it.

In the next chapter, we will examine a scenario of impersonating an employee or business owner to suppliers—another type of fraud affecting the business sector.