Exploitation of Kuwaiti Online Shopping Sites: A Rising Threat to Bank Security

Kuwaiti banks are experiencing increased reports of a new hacking method exploiting local shopping websites for fraudulent bank card transactions. Customers who attempt legitimate purchases find later that funds have been withdrawn from their accounts, often traced to foreign countries. The situation has created a blame game between banks and victims regarding responsibility for security breaches.

Kuwaiti banks have recently reported an alarming increase in fraudulent activities, with customers falling prey to a sophisticated bank card hacking scheme. This method takes advantage of legitimate local shopping websites, allowing criminals to illegally withdraw funds from victims’ bank accounts through unauthorized transactions, often traced back to foreign locations.

The new fraudulent technique primarily targets users of well-known online shopping platforms within Kuwait. Victims often make legitimate purchases but later find that their accounts have been depleted by a series of withdrawals, typically originating from Italy, despite the cardholder residing in Kuwait. The sequence of the scam includes the following steps:
1. Customers attempt contactless smart payments on compromised websites.
2. They receive prompts to enter a one-time password (OTP), only to be told that the transaction has failed.
3. Subsequently, they are urged to re-enter their card details to finalize the transaction.
4. In the following days, notifications of unauthorized withdrawals emerge, often linked to purchases made abroad.

This innovative hacking method exploits weaknesses within local e-commerce platforms, enabling fraudsters to replicate card data saved on customer devices. With the stolen information, they initiate repeated withdrawals, usually reaching the card’s limit before victims recognize the fraud. Once customers report the fraud to their banks, a significant amount of their funds may already have been siphoned away.

There appears to be a shift in blame between victims and banking institutions. Banking representatives assert that customers must take responsibility for security breaches, suggesting that sharing their OTPs constituted negligence. As a result, banks, and the Central Bank of Kuwait, as regulatory authorities, argue they are not required to reimburse victims or recover lost funds, particularly when authorized transactions confirmed by legitimate OTPs are involved.

Conversely, victims contend that they adhered to all security measures for contactless payments and had no prior knowledge of the infections on the websites used for their transactions. Additionally, many victims highlight that some platforms incorrectly claimed support for widely-used payment systems like Apple Pay, Google Pay, or Samsung Pay, which were not functional. They argue this points to a failure on the websites’ part, which should take responsibility for the breaches.

The surge in hacking incidents targeting Kuwaiti shopping sites underscores the vulnerabilities present in online payment systems. It is crucial for consumers to be vigilant about their transactions and for banks to improve security measures to protect customers from such threats. Furthermore, there lies an important distinction in accountability between customers and banking institutions regarding unauthorized transactions, which adds complexity to the issue. Enhancements in e-commerce security and transparent communication from both platforms and banks will be vital in addressing this ongoing problem.

Original Source: www.arabtimesonline.com