Voice assistant Siri that can help you control your iPhone with voice commands, maybe become an assistant for scams. Feature allows you to send messages from the lock screen and to make transfers if the Bank user can conduct them by means of SMS messages by phone number. It is reported by RBC with reference to the employee of the savings Bank.
If the iPhone was in the hands of a fraudster, it is enough to enter a sequence of commands to transfer money from the account tied to the phone number. “Siri, send a message to the number nine, zero, zero,” starts a sequence of voice commands. 900 is the number of mobile Bank of the savings Bank. In the message it is necessary to dictate to the assistant, the word “transfer” and the recipient’s phone number is also one digit at a time.
The savings Bank requires confirmation of the transfer by SMS message. After the Bank sent the code, it is necessary to ask Siri to read the last message and send four digits of the code to the number 900 also use Siri. The whole operation takes about two minutes.
For the attacker, such operations must match several factors: it needs to access to another Apple device installed with the voice assistant Siri, which has the ability to transfer a phone number via SMS messages. Sberbank does not comment on information about possible cases of theft of money their clients using Siri, although the problem know.
“We are working with Apple to the operating system level was not possible the manipulation of Siri functionality of the device and functionality of the SMS-Bank”, — said the press service of Sberbank.
The Bank also added that track all client transactions, and suspicious — are automatically blocked. “The security system stops the transaction if they are abnormal, for example by time or amount, or if payment occurs to the number from the blacklist”, — said the official representative of the credit institution.
Sberbank is not the only credit institution, which provides customers the ability to transfer money or pay for other services via SMS. A similar service in your mobile Bank offers, in particular, Alfa-Bank, SMS-Bank “Alfa-Check”.
To reduce the risk of fraud in Alfa-Bank introduced a limit on the maximum transfer amount via SMS in the amount of 500 RUB per day. “To make the transfer via SMS to a large sum, the client must create a template in the Internet Bank, but still limit transfers — not more than 25 000 rubles”, — said representative of Alfa-Bank. He also added that if any non-standard transactions connected monitoring service that calls the customer.
In Tinkoff Bank is a function of customer service through SMS, but these services are only a notification and consultative in nature. For example, using SMS you can query the card balance or to block it, and get information about accounts and deposits of the client. However, to manage their accounts “Tinkoff” offers with the help of a Telegram bot.
Despite the security measures undertaken by banks, the most effective protection against scammers is a ban on transactions in mobile banking through voice assistants. “Now the ban on this kind of manipulation is exposed at the level of the operating system settings: in the settings for Siri can disallow access to Siri when the screen is locked,” advises the savings Bank. In case of loss of control over the phone bankers are advised to immediately contact the operator to block the phone numbers, and also to the Bank to block payment instruments.
