Our lorries and vans fill up on fuel cards, about four hundred of them, managed through the card company's online portal. Three people in our transport office use it. The portal can block a card, change a limit, order replacements and set the address they are posted to.
It has a second step at sign in. You choose whether the code is sent by text or read out in a phone call, and the number registered for our account was the transport office landline, because that was the number on the original application in 2017.
In February one of the three entered her password into a convincing copy of the portal's sign in page, linked from an email about a price change. At about eight that evening somebody signed in with it and chose the phone call. The office was empty, so after six rings the call went to the landline's voicemail, and the code was recorded there.
Our phone system lets anyone retrieve voicemail remotely, by calling the number, pressing star and entering a PIN. The PIN for that mailbox had never been changed from its default, which was the last four digits of the extension. The extension was printed at the bottom of every email the transport office sent.
The intruder listened to the message, entered the code, changed the delivery address for replacement cards and ordered thirty one of them. Over the next four days they were used at forecourts across the Midlands for about twenty three thousand pounds of diesel, until the card company's fraud team noticed the pattern and rang us.
Nobody had thought of the voicemail as part of our sign in. The portal treated the phone line as something only we could hear. The phone system treated voicemail as a convenience, with a PIN nobody was ever asked to set. Each was reasonable on its own.
Every voicemail box now has a PIN chosen by its owner at first use, and remote retrieval is switched off for shared office lines. Supplier portals that can move money, cards or goods are on our list of critical accounts and use an authenticator app, never a call to a landline. The card company now rings our transport manager before it accepts any change of delivery address.
A second factor is only as private as the place where the code ends up.
– Serguey Shinder
Top comments (0)