Ricardo data breach: fraudsters abuse WhatsApp with genuine user data
Following a data breach at Ricardo, criminals are attempting to gain trust via WhatsApp using correct user data. Around 890,000 accounts were affected.
Phishing after Ricardo data breach: WhatsApp messages with genuine address data in circulation
Following a massive data breach at the Swiss online marketplace Ricardo, criminals are exploiting the stolen data for targeted phishing attacks via WhatsApp – as reported by digitec.ch. The senders pose as "Ricardo Help Center" and use correct names, postal addresses and telephone numbers of victims.
On 7 October, Ricardo discovered a security vulnerability that allowed unauthorised persons to access data from around 890,000 user accounts. The vulnerability has since been closed and affected users have been informed by email. Whether the circulating WhatsApp messages actually use data from this incident has not yet been proven.
How the scam works
As reported by the "Bote der Urschweiz", several such messages have already appeared. The senders claim that Ricardo has detected suspicious activity on the account. Victims are asked to click on a link and confirm their details. However, the link does not lead to Ricardo, but to a counterfeit website that mimics the auction platform's appearance.
The cunning part: if someone can accurately provide personal information, they quickly appear authentic – without knowing the victim's password. Anyone who enters their data on the fake page unwittingly reveals all remaining access details. This method is called "phishing": criminals lure people to fake websites with credible-sounding messages in order to steal passwords, credit card details or other sensitive information.
Ricardo also warns on its official help page of other scams: allegedly blocked payments, counterfeit delivery services or requests to confirm a payment via QR code.
Booking.com, parcel services and banks as cover
Similar fraud attempts affect other platforms. According to the Federal Office of Cybersecurity (BACS), criminals regularly gain access to genuine hotel accounts on Booking.com and contact guests directly via the booking platform's official messaging system. The message requests re-confirmation of the credit card – otherwise the reservation will be cancelled. Since the messages are actually sent via Booking.com and booking details are stated correctly, they appear extremely credible.
Fake parcel notifications represent another common variant. Allegedly a parcel could not be delivered because an address was incomplete or a small fee was outstanding. BACS has already documented cases in which manipulated QR codes on fake collection invitations were sent directly to letterboxes.
Banks are also regularly abused as cover. Supposed bank employees contact people by telephone and claim to have discovered a suspicious transaction. Those contacted are asked to provide security codes, confirm payments or install remote access software. Sometimes even the real telephone number of the bank appears on the display.
The name of Digitec Galaxus is also exploited for fraud attempts. Criminals sent fake emails in the name of Galaxus promising free perfume for a customer satisfaction survey. Those who participated were directed to a deceptively authentic Galaxus website where they were asked to enter credit card details for an alleged shipping fee.
The principle behind the scams
The basic pattern remains the same in all variants: credible stories and artificially created time pressure are used to get people to reveal sensitive data. Phishing attempts are no longer limited to poorly translated emails – the methods today are far more sophisticated and difficult to see through.
The most important ground rule: a message is not trustworthy simply because the sender knows the correct name or address.
Recommended protective measures
In the current case, Ricardo recommends the following precautionary measures, which according to digitec.ch also apply to other platforms and online services:
- Anyone who has merely opened a suspicious website should close it immediately and not enter any data.
- Anyone who has already entered a password on a fake page should change it immediately via the official Ricardo website.
- Anyone who uses the same password for multiple accounts should replace it there as well – and use a different one than for Ricardo. Criminals systematically try stolen passwords on other services.
- If credit card, Twint or e-banking data has been entered, every minute counts: those affected should contact their bank or card provider immediately.
Source: Google News CH — Crime (de)