In early 2021, cybercriminals who steal funds from Russian accounts using the well-known compensation payment scheme began to use Google Photos albums instead of their usual channels (mail, instant messengers, SMS). Group-IB reported this to Izvestia.
The scheme became popular in the spring and fall of last year amid news about the coronavirus and the financial crisis. Russians are offered to receive, for example, a refund for paying VAT, but instead they steal bank card data.
In the new year, scammers started using mailing lists on Google Photos (a service for storing photos and videos). The standard functionality includes the ability to share the selected photo album with other users. This notification comes in the form of a push notification to the phone, which is impossible not to notice.
The new album appears in the “General” section with only one photo, that a payment has been approved to the user in his name on the “Gosuslugi” service, for example, in 278,500 rubles. The victim is asked to pay a transfer fee of RUB 398 through a fake payment service. If a user enters his data into a template to pay for a transfer, fraudsters steal his card details, and then the funds from the account.
Experts see the main danger of the new promotion channel in the wide coverage of potential victims of cybercriminals.
Read more in the exclusive material of Izvestia:
You are being removed: scammers have started using “Google Photos”