Virus to hijack your account

[Percula]

[ QUOTE ]
I haven't been following this much.

How do they get the account passwords in the first place?
Once they have it, how do they successfully transfer it somewhere and cash it out quickly enough that the transaction isnt cancelled?

Both seem at first glance very difficult to do.

[/ QUOTE ]

OK...

The hacker compromises the computer. He then tracks the activity on the PC. He gathers ALL usernames and passwords, investigates the accounts accessed.

So "Ralph HS player" has a UB, FTP, Stars accounts for a total of $400K in them. Has a Neteller account with a balance of $10K tied to the bank account (since Ralph is from a location that Neteller still serves). Has a online savings account tied to their bank account with a balance of $600K. Has a online brokerage account tied to the bank account with a value of $1.5M. Has a bank account with a balance of $30K.

Joe hacker knows all of this and has access to all money accounts, email and IM accounts. He bides his time, watches the player waiting for the right opportunity to strike. Joe hacker knows Ralph HS player is going to a WPT event for a week and has lots of live play and partying scheduled and wont be watching his [censored] closely while at the WPT event.

Now its time for Joe to go to work. Ralph is on a plane to the US for the WTP event. Joe logs on to each poker site and withdraws most of the funds in them to Neteller. He leaves enough on each site for Ralph to log in and have a couple of buy-ins, after all Ralph doesn't check his account balance each time he accesses the site, since it is something that can make him tilt. He only checks the account balance once a week and draws it down to his X buy-in level.

Joe now waits for the emails from the poker sites and Neteller, deals with any questions from the poker sites, but most likely just deletes the confirmations of the transactions making note of the amounts.

Joe then waits for Neteller to make the funds available. Once they are available, Joe now transfers all the funds to the bank account and waits for the funds to be available again. Remember Ralph is partying and playing poker and not doing much if anything on the internet for the next 5-7 days...

The funds are now available in the bank account and Joe transfers the funds to the brokerage account and sells all assets in the brokerage account. Adds/changes the account transfer information on the brokerage account and wires all the funds to some offshore account, and pays someone at the offshore location to go withdraw the cash and ship it to Joe hacker, who is now a millionaire for a few weeks of "work". And Joe can sleep pretty well, because he knows that he covered his tracks, and the poker player really doesn't have any real way to go after him.

And all of this could be prevented by having to use secure tokens on each account. Since a secure token is hardware and only Ralph has the hardware, Joe hacker can not access any of the money accounts... It too bad that the only accounts in this little story that don't have the option of using secure tokens is the poker sites.