Biometric Fraud Technology Threatens Banking Security Systems

With the rapid development of technology to fake faces, voices, and even eye movements, authentication measures seem to be invulnerable to cybercriminals.

AI technology is exploited

In the trillion-dollar gambling ring that was recently busted in Thai Binh, the subjects used artificial intelligence (AI) technology to create fake facial videos , thereby bypassing the biometric authentication layer on the banking application without the direct participation of the account owner. This sophisticated trick raises a worrying question: How can technology be abused to bypass seemingly impenetrable security barriers?

According to information from the Thai Binh Provincial Police Investigation Agency, this unit has just initiated a criminal case, prosecuting 21 defendants related to the crimes of gambling and money laundering. This is a shocking case as it is the first time in Vietnam that criminals have been recorded using AI to commit illegal acts.

Not only organizing gambling, the subjects also laundered money by hiring people to open bank accounts for players to deposit money. From Taiwan (China), they controlled computers to remotely connect to phones that had pre-installed banking applications in Vietnam. The money was then transferred through many accounts to conceal the illegal origin.

In particular, to carry out large transactions of 10 million VND or more, which require biometric authentication, this group used fake videos of the account owner's face created by AI, easily bypassing the security system without the cooperation of real people.

New scam appears, bypassing bank biometric authentication.

Regarding the trick of using AI technology to create fake facial videos to bypass biometric authentication on banking applications without the direct participation of the account owner, Mr. Vu Ngoc Son, Head of Technology Department, National Cyber ​​Security Association, said that the incident is being investigated by authorities and there will be official information soon.

From a technical perspective, Mr. Son said it was likely that the group of subjects used “rooted” Android phones, which means they had deeply intervened in the operating system to gain the highest level of access on the device. This is a right that manufacturers often lock to ensure data and system security. However, with some phone models, especially when in the hands of criminals, rooting is not too difficult.

After taking control of the device, the subjects can install a virtual camera, a software that simulates a real camera. Thanks to that, instead of recording images from a physical camera, the application will receive signals from an available video, which can be created using AI technology. With this form, banking apps can be fooled into thinking that the account owner is performing biometric authentication, when in fact the image is fake.

What should users do to protect themselves?

According to Mr. Son, this is a typical example showing that the current fight against fraud is not only a technology race but also a battle of wits between people. Therefore, in addition to enhancing technical solutions, it is important that users always stay vigilant and alert. He also emphasized that not all banking applications are easy to bypass, because many units have added advanced layers of protection to prevent biometric forgery. People should not be too panicked, but also should not be subjective.

Talking to reporters of Knowledge and Life Newspaper , lawyer Nguyen Ngoc Hung - Head of Ket Noi Law Office ( Hanoi Bar Association) said that currently, criminals use many technological tricks to fake biometrics such as collecting victims' facial images from photos, videos or personal data leaked online, then using deepfake technology to create a copy of the face. Use this copy to fool the bank's biometric authentication system on the victim's device or simulated device and then commit property appropriation.

Using biometric forgery technology to bypass the authentication system of a banking application and steal money is a high-tech fraud that can be prosecuted under Vietnamese law.

Accordingly, depending on the amount of money embezzled, mitigating and aggravating circumstances of criminal liability and other circumstances of each subject and each case, these subjects can be criminally prosecuted for up to 20 years in prison or life imprisonment for the crime of "Fraudulent appropriation of property" as prescribed in Article 174 of the Penal Code.

Banks have a clear obligation to establish and maintain a security system that is strong enough to ensure the safety of customer accounts, especially when using biometric authentication technology. In case the system is attacked, bypassed by counterfeit technology without timely risk detection or warning mechanisms, the bank may be considered for related responsibilities such as compensation for damages if it proves that there is a fault in the technical organization, internal control process, or inadequate warning to customers.

Banks must also comply with legal regulations on network information security, personal data protection and regulations of the State Bank on the provision of electronic banking services. Failure to ensure these requirements may result in administrative or even civil liability for the injured party.

To ensure their legitimate rights and interests, and avoid becoming victims of fraud, people also need to proactively protect their accounts, not enter personal information or biometrics into applications of unknown origin. Do not grant access to messages, screens or settings from unknown sources.

Do not share clear images of your fingerprints, faces or videos on social media. Avoid using your fingerprints/faces in public if you suspect someone is watching or recording you. Always verify carefully when someone asks you to open a banking app and scan your fingerprints or face. If you receive a request to update your banking app, verify directly on the bank's official website. Do not confirm transactions if you are not sure about the reason, you can call the bank directly to check these authentication requirements.

When detecting signs of fraud, people need to report to the authorities and local police to track down the subject and promptly prevent it.

Lawyer Nguyen Ngoc Hung - Head of Ket Noi Law Office (Hanoi Bar Association).

Source: https://khoahocdoisong.vn/cong-nghe-gia-mao-sinh-trac-hoc-de-doa-he-thong-bao-mat-ngan-hang-post1546502.html