Belagavi, India – A team at Shreshta IT Technologies Private Limited has uncovered a large-scale phishing campaign targeting State Bank of India (SBI) users. This scam aims to steal sensitive personal information, including internet banking credentials, Aadhaar numbers, PAN details, and dates of birth.
Sophisticated Deception:
- Phishing URLs are disguised as legitimate SBI links and sent through various channels like email, SMS, and WhatsApp.
- The phishing websites cleverly mirror the official SBI login page’s layout, particularly on mobile devices, to induce trust.
- Images from the real SBI website are used extensively, including security instructions and login buttons.
Hidden Traps:
- Crucial features like image and audio CAPTCHAs are merely static images, offering no real security.
- “New User” and “Forgot Username/Password” links are non-functional, further solidifying the fake website’s appearance.
- After entering login credentials, the user is redirected to an OTP request page, seeking even more personal information:
- Account holder name and date of birth
- Full name as per PAN and PAN itself
- Aadhaar number and full name as per Aadhaar card
- OTP received on the user’s phone
Time-Out Deception:
- Upon entering the OTP, the website pretends to verify details but ultimately times out, suggesting a technical issue. This often prompts users to re-enter their information, potentially exposing it multiple times.
Stay Vigilant:
- Be wary of urgent messages, especially those claiming to be from your bank.
- Always double-check the sender’s email address and website URL for legitimacy.
- Never enter personal information on unverified websites or links.
- Contact your bank directly to verify any suspicious messages or requests.
Help and Resources:
- Report cybercrime, particularly financial fraud, to the national cybercrime helpline at 1930 or file a complaint at https://cybercrime.gov.in/.
Related Articles
-
-
-
-
-
-
