Several users of the State Bank of India (SBI) have been targeted with a phishing scam where hackers have flooded them with suspicious text messages, requesting them to redeem their SBI credit points worth Rs 9,870.
The link associated with the text messages redirects the user to a fake website and on the landing page, the user is asked to submit personal information along with sensitive financial details like card number, expiry date, CVV and Mpin in a 'State Bank of India Fill Your Details' form.
According to the investigation by New Delhi-based think tank CyberPeace Foundation along with Autobot Infosec Private Ltd, the website collects data directly without any verification and is registered by a third party instead of having the registrant organisation name of State Bank of India, making it all the more suspicious.
"Moreover, according to SBI, they never communicate with their customers via SMS or emails containing links with regard to the user's account. Any reputed banking entity also does not use Wordpress like CMS technologies on their official website for security reasons," the foundation said.
The personal information sought on the malicious website is name, registered mobile number, email, email password and date of birth.
After the form is submitted, the user is directed to a "thank you" page.
"The domain name of the website can be traced to India, and the registrant state was found to be Tamil Nadu," the report mentioned.
According to the report, it was observed that the form takes user inputs without performing basic validation of data type.
For example, the registered mobile number field, which should only accept numerical values also accepts text input. This can also be confirmed from the source code, where the input type for the field is mentioned as 'text' instead of 'number' or 'tel'.
"The email password field shows the entered password in clear text instead of keeping the characters hidden. A similar source code observation is noted," it added.
"The card number field accepts an infinite number of digits instead of only 16 digits, which SBI cards usually have. All these instances of negligence clearly indicate bad coding practice," the foundation said.
--IANS
na/in
(Only the headline and picture of this report may have been reworked by the Business Standard staff; the rest of the content is auto-generated from a syndicated feed.)
Dear Reader,
Business Standard has always strived hard to provide up-to-date information and commentary on developments that are of interest to you and have wider political and economic implications for the country and the world. Your encouragement and constant feedback on how to improve our offering have only made our resolve and commitment to these ideals stronger. Even during these difficult times arising out of Covid-19, we continue to remain committed to keeping you informed and updated with credible news, authoritative views and incisive commentary on topical issues of relevance.
We, however, have a request.
As we battle the economic impact of the pandemic, we need your support even more, so that we can continue to offer you more quality content. Our subscription model has seen an encouraging response from many of you, who have subscribed to our online content. More subscription to our online content can only help us achieve the goals of offering you even better and more relevant content. We believe in free, fair and credible journalism. Your support through more subscriptions can help us practise the journalism to which we are committed.
Support quality journalism and subscribe to Business Standard.
Digital Editor
RECOMMENDED FOR YOU