ADAC Credit Card Fraud: SMS TAN Abolition
Table of Contents
- Navigating Online Banking Security: Protecting Yourself from Fraud
- Navigating Online Banking Security: Protecting Yourself from Fraud
- What are the Common Types of Online Banking Fraud?
- How Can I Secure My Online Banking?
- Which Authentication Method is the Safest?
- What are the Risks of Using SMS-Based Authentication (SMSTE/MTAN)?
- What Protective Measures Can I Take?
- What Should I Do If I Suspect Fraud?
- How Do I Report Online Banking Fraud?
- Legal Precedents
- Summary of Authentication Methods
The ADAC credit card, known for benefits such as fuel discounts, has faced repeated instances of credit card fraud. Currently, Solaris SE issues the card, with Landesbank Berlin (LBB) having taken over as the payment service provider in September 2024. The transaction authentication number (TAN) required for online banking was previously sent to customers via SMS,a method known as MTAN or SMSTE.
Securing Customer Legitimation: A Multi-Faceted Approach
-
SMSTE Procedure (MTAN): This method involves the bank sending a transaction number via SMS to the customer’s smartphone to authorize a transfer. It’s designed as an extra layer of security to prevent online fraud if criminals obtain a customer’s password.
However, SMS messages can be intercepted with sufficient technical knowledge. Consequently, many banks have transitioned to option transaction processes.
-
PushTAN Procedure: This requires a smartphone or tablet and a dedicated PushTAN app. After registering the procedure with the bank, customers receive an access code for the app. Transfers are then authorized directly within the app, using methods like facial recognition, fingerprint scanning, a release click, or a password. For enhanced security, banking and TAN generation can be performed on separate devices.
-
ChipTAN Process: This method uses two self-reliant devices. Transaction data is read from a flickering code using a ChipTAN generator provided by the bank. Because the generator is not connected to the internet, it is protected from remote attacks.The TANs generated for each individual transfer are dynamically linked to that specific transaction, preventing unauthorized use.
-
PhotoTAN: This also uses two separate devices.A graphic displayed on the screen is scanned using a PhotoTAN app. The code within the graphic is converted into a TAN used to authorize the transaction. A potential security vulnerability exists if the app is not regularly updated.
-
ChipTAN USB Process: In this process, order data is confirmed using a ChipTAN USB reader.The potential weakness lies in the customer’s device being susceptible to malware.
Banks typically determine which authentication methods they offer, with the PushTAN procedure for smartphones being a common choice.
the Federal Office of Safety in Information Technology (BSI)
advises that using external TAN generators remains the safest option, as they are isolated from the internet and used exclusively for online banking.
Experts generally advise against conducting online banking via smartphone due to inherent security risks.
complaint Management Issues
Despite known vulnerabilities,some financial institutions have used SMSTAS.
Victims of credit card fraud and phishing scams report difficulties reaching customer service and experiencing inadequate complaint processing. Frequently enough,fraudulent activity is only noticed after a delay of several days,upon receiving bank statements,or when an overdraft occurs unexpectedly.
Such delays can complicate matters, possibly leading the bank to accuse the customer of negligent behavior regarding unauthorized transactions.
Legal claims have been successfully pursued against various banks.
Addressing Negligence in Fraud Cases
Legal precedents regarding negligence in phishing cases are determined on a case-by-case basis.
Such as, a court ruled in favor of a bank customer who trusted a fraudulent caller displaying the bank’s phone number due to call-ID spoofing.
Similarly, a higher regional court upheld a judgment where a fraudster changed a customer’s phone number after a phishing attack, raised the transfer limit, and transferred funds to a foreign account. The court found the customer not grossly negligent because they had not disclosed their PIN,netkey,or a TAN to authorize the transfer.
Another district court ruled against a bank due to insufficient system security.
In another case, a district court partially sided with a customer who entered data on a fraudulent website after being contacted by a scammer impersonating a bank employee. The court considered that the bank had been previously informed of security issues and failed to adequately protect the customer.
Protecting Yourself from Online Banking Fraud
If you suspect you have fallen victim to a scam or any sort of online banking or identity fraud, report the incident as soon as possible. For example, if you discover unrecognized charges on your credit card, report the suspicious charges to the card issuer right away.
Contact your bank instantly if you suspect fraud or see suspicious activity on your bank accounts, including credit card and checking or savings accounts.
You can also file a dispute for debit or credit card charges by contacting your bank.
As online banking becomes increasingly prevalent, understanding and mitigating the risks of fraud is more importent than ever. This article provides extensive information about various online banking security measures and how you can protect yourself from evolving threats.The ADAC credit card, known for benefits such as fuel discounts, has faced repeated instances of credit card fraud, highlighting the ongoing challenges. Currently, Solaris SE issues the card, with Landesbank Berlin (LBB) having taken over as the payment service provider in september 2024.
What are the Common Types of Online Banking Fraud?
Online banking fraud can take many forms, including:
- Phishing: Fraudsters impersonate legitimate entities (banks, businesses) to steal personal and financial information.
- Account Takeover: Criminals gain access to your accounts by acquiring login credentials through various means.
- Malware: Malicious software installed on your device steals credentials or intercepts transactions.
- Card skimming: Criminals use devices to steal card information when you use an ATM or card reader.
How Can I Secure My Online Banking?
Banks use several methods to secure customer transactions.
- SMSTE (MTAN): A security method where the bank sends a transaction number via SMS. However, these messages can be intercepted.
- PushTAN: This utilizes a smartphone app for transaction authorization, frequently enough employing security features like facial recognition or fingerprint scanning.
- ChipTAN: Uses a separate ChipTAN generator to produce unique codes for each transaction.
- PhotoTAN: Requires a dedicated app to scan a graphic with a code, which is then used to convert into a TAN (Transaction Authentication Number) when authorizing a transaction.
- ChipTAN USB: Uses a ChipTAN USB reader for confirming the transaction data.
Which Authentication Method is the Safest?
According to the Federal Office of Safety in Information Technology (BSI), using external TAN generators remains the safest option, as it is isolated from the internet. These generators are not connected to the internet, which means they are protected from threats.
What are the Risks of Using SMS-Based Authentication (SMSTE/MTAN)?
SMS-based authentication (SMSTE or MTAN) involves receiving a transaction authentication number (TAN) via SMS. While this method provided a layer of security compared to no authentication, it’s considered less secure due to the potential for interception. SMS messages can be vulnerable to various attacks. Consequently, many banks have moved towards more secure authentication procedures
What Protective Measures Can I Take?
- use Secure Websites: Ensure websites have HTTPS encryption (indicated by a padlock icon).
- Monitor Accounts Regularly: Check your bank statements and account activity frequently for suspicious transactions.
- Be Cautious of Phishing: Never click links or provide information in unsolicited emails or messages.
- Keep Software Updated: Regularly update your operating systems, antivirus software, and banking apps.
- Use Strong Passwords: Create complex, unique passwords for your online banking and other important accounts.
What Should I Do If I Suspect Fraud?
If you suspect you’ve been a victim of a scam or fraud:
- Report Promptly: Contact your bank immediately to report any suspicious activity or unrecognized charges.
- File a Dispute: File a dispute for any unauthorized debit or credit card charges.
- Contact the Card Issuer: Report suspicious charges to the card issuer immediately.
How Do I Report Online Banking Fraud?
Contact your bank instantly if you suspect fraud or see suspicious activity on your bank accounts, including credit card and checking or savings accounts. You can also file a dispute for debit or credit card charges by contacting your bank.
Legal Precedents
Legal precedents help determine negligence in fraud cases, on a case-by-case basis. Courts have considered whether banks provided adequate protection and the degree of customer negligence. For example, a court sided with a bank customer who had been the victim of call-ID spoofing.
Summary of Authentication Methods
| Method | Description | Advantages | Disadvantages |
|---|---|---|---|
| SMSTE (MTAN) | TANs received via SMS | Additional layer of security compared to no 2FA | Vulnerable to interception. |
| PushTAN | Authorization via smartphone app | Enhanced security features | Requires a smartphone and app |
| ChipTAN | Uses a generator device | Protected from remote attacks | Requires a separate device |
| PhotoTAN | Uses a smartphone request | Provides enhanced security | Vulnerable to updates if not current |
| ChipTAN USB | Uses a ChipTAN USB reader | Safe, the data is confirmed. | Potential weakness lies in the customer’s device, susceptibility to malware. |