Recently customers of the luxurious Ritz Hotel in London were the subject of a security incident in which a group of fraudsters posed as hotel staff members, calling the affected users to steal their credit card numbers.
Apparently, the scammers called people using exact details and even details of their reservations, asking for confirmations of their personal details, so the state was extremely convincing to the victims.
According to Ritz, the scammers tried to use the compromised credit cards to spend thousands of pounds in a catalog store. The incident has already been notified to the UK Information Commissioner’s Office (ICO). Neither the authorities nor the hotel know how they got the confidential details about the reservations.
A woman who had made a reservation received a call a day before the agreed date. The scammers asked you to confirm your reservation using your credit card. The woman did not hesitate for a second of this call, as the scammers knew when and where the reservation had been scheduled.
In an interview with the BBC, a cybersecurity specialist claims that this variant of fraud, known as vishing, is relatively easy once criminals gain access to user information. In this case, the scammers told the victim that their card had been declined, so they requested a new payment method. After getting the data from the new card, the scammers tried to charge you for up to 1000 pounds at the Argos store.
This attempt at fraud did not stop there, as threat actors noticed that the victim’s bank detected this unusual activity, so they decided to call the woman a second time, this time pretending to be employees of the bank. When calling, the victim was asked to provide a code sent to his mobile phone to cancel the transaction; actually the victim was tricked again into authorizing the 1000-pound transaction.
A hotel representative revealed a possible data breach on August 12; some data on their reservation systems would have been compromised during this incident. The firm continues to investigate this incident in collaboration with the authorities, as well as notifying its clients that “staff will never request financial details by phone”.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.