Warning! Guarantee Trust Bank (GTBank) Naira Mastercard Systems May Be Compromised

I have strong reasons to believe that GTBank customer records may have been compromised (or about to be) and some fraud is either being perpetuated against customers or about to be.

Here is why:  I received the alert below by email on 2 March 2014 for a transaction I neither initiated nor authorised.  A friend of mine received a similar alert on 14 March 2014 for a transaction he neither initiated nor authorised.  And both looked genuine.  Both alerts concerned the Naira Mastercard accounts.

I complained to GTBank and they requested my permission to block my card as a precaution against further withdrawals.  I was grateful for that, but I also wondered why they couldn’t investigate to find out who did it in the first place.  Knowing what hassles I would go through to get another card or get it unblocked, I told GTBank to hold off any action.  I have confirmed that I did not initiate the transaction but I am stumped.  So as a precaution, I have moved cash away from the Naira Mastercard sub-account into other accounts.  I will only move money into it when I need it.In any case, although I received the alert, to date nothing has been deducted from my account yet.

So here’s my thinking.  Someone may have got access into GTBank systems and they are in the process of exploiting some vulnerabilities, prior to ripping off customers big time.

I stand to be corrected if I am wrong but this is my experience.  Hope it helps someone.  Did this happen to you too?

 

GTBank Logo

Dear Valued Customer,International Transaction Notificationon Your CardThank you for using your GTBank Naira MasterCard.

This is to inform you that the Naira equivalent of the transaction with the details below has been authorised on your account:

Card Number : XXXXX******XXXX
Account Number : XXXXXXXXXX
Transaction Location : GOOGLE *LTD ADWORDS CC@GOOGLE.COMCAUS
Amount : USD15.00
Date : Mar 2 2014 12:01PM
Document Number : XXXXXX

If you did not initiate this transaction, kindly call our fully interactive 24 hrs self service Contact Centre, GTCONNECT, on 0700-GTCONNECT (0700-482666328), 01-44840000802-9002900 or 0803-9003900 or visit any GTBank branch nearest to you.

Thank you for banking with us.

Yours faithfully,
GTBank Card Services Team.

Facebook Google+ Twitter Email GTBank Website
Facebook
facebook.com/gtbank
Google+
google.com/gtbank
Twitter
twitter.com/gtbank; @gtbank_help
@gtbank_careers; @gtbank_cards
Email
enquiries@gtbank.com
complaints@gtbank.com
Website
www.gtbank.com

 

9 thoughts on “Warning! Guarantee Trust Bank (GTBank) Naira Mastercard Systems May Be Compromised”

  1. I rest my case and this means you really need to take it up with GTB officially for all our sakes. If its an inside job or weak enforcement of controls then a change of card will not save any customer from a successful attack.

  2. Hi Okechukwu,

    Thanks a lot for your time.

    Trust me however when I say none of this is my problem. Permit me some anonymity, but suffice to say that “Internet security” is one of the jobs that pay my bills.

    GTB has a problem.

    Ginger

  3. Hello Ginger,

    There is a way of compromising your card details without being a staff of your bank. This way requires hacking your computer and installing a keystroke logger. The keystroke logger will capture everything you type on your computer (including your card number when you type it during an purchase transaction) and its saves all it captures and sends it (or makes available) to the hacker for use later.

    If this is the case then I recommend
    1. moving your vital files from your computer to an external usb hard drive.

    2. Format your computer and reinstall your OS, and internet Security software and update them.

    3. Connect your usb external hard drive and scan it with your updated Internet Security software to remove any virus etc before moving the files back to your computer.

    4. For physical keystroke logger you will need to check your keyboard connection to your desktop computer to remove any strange device connecting between your keyboard and your system unit. For a laptop you will need to open it up and remove any device/component that was not there when you bought it

    For further reading please visit the sites below:

    http://en.wikipedia.org/wiki/Keystroke_logging

    http://www.keyghost.com/

    http://www.keycarbon.com/

    Regards,

  4. Good Morning Ginger,

    I had to scrutinize the details on my E-Statement and the transaction email from GTBank again. My findings is that GTBank never uses your card number on any of the transaction emails. They only use your account number in full while in the E-statement even your account number is protected by only stating the first three and last three numbers(the four numbers in the middle is hidden with an XXXX).

    To the best of my knowledge only the staffs working at the Card Services division/department of any bank has access to your card details. I must also say that they are the most monitored and scrutinized set of staffs because of the sensitivity of their task. My personal verdict is that the leakage was not from the bank or its staffs because there was not deduction from your accounts.

    I strongly recommend that you hand in the card back to the bank and request for another one given the card number has been compromised. I think it still cost =N=1,700 to get a new ATM card and takes a maximum of 2week to have ready.

    The next step is to find out who sent this email. Look at the sender email address and verify that its exactly that of GTBank letter for letter. If its correct then the attacker simply implemented email spoofing. The next step to read the detail header of the email to locate the source IP address (this is the IP address on the computer the the person used to send the email. Lets hope he did not send it from a cybercafe because we will not be able to trace him/her beyond that point).

    Take the IP and go to http://www.afrinic.net and feed it into their WHOIS database search. It will give you the Service Provider that owns the IP. Then you can do them an email complaining that one of their subscriber with this IP address sent a SPAM and a Phishiing attack. They will act on it after they get a copy of the said email which includes the details mail headers they need to confirm the claims.

    And you can take it further by getting the Police to arrest the owner of the Internet Modem that was used to send that email etc. Then they can be interrogated to find out how they were able to get your card number.

    I hope I did not bore you and that this was of some help.

    regards.

    1. Hi Okey,

      Thanks a million!

      You did not bore me at all as this is educative, for me, and I imagine for many others as well.

      I see your point, but precisely because only GTB staff members (and I) can know the details of my card, that strengthens my point that the leakage is from GTB. Why? There is no one more neurotic than me in the way I protect my card. I use it alone and it’s always close to my chest. I have used GTB services for at least seven (7) years and this is a first.

      So, I will follow your advice and get the card changed. I will however still like to make my point that GTB security is culpable and so I need to warn others. The staff in the card services unit may be the most scrutinized but you will agree that oversight does fail sometimes, that is why fraud happens. Only through GTB systems can anyone have access to my complete card details.

      The sender email is GTB. I have checked the url sources and it all seems legit.

      We should also consider the mathematical probability of this happening to another friend of mine within the same month. Note: this other person is as much a GTB veteran as myself.

      I’m sorry If I’m repeating myself in a tiresome way. It’s also possible that my anger makes me blind to any other reason right now. Pardon me.

      Ginger

  5. Greetings Mr Ginger
    Quite a long time
    Believe you are fine
    Mr Okechukwu is correct
    The none existent transaction was deliberate
    They want to take the customer to a page where they will ask him to enter his account information which they can then use to defraud the person
    My bank UBA has been warning us of this
    I will send the UBA messages to your inbox
    As to the topic, I think it is appropriate since the word MAY is used
    They could have gotten his name and account information from the bank’s data
    Moreover it makes GT Bank customers to be interested
    Thanks

    1. Uncle Sam!

      How far now? Long time.
      I too have received messages in the past (that I immediately dismissed as phishing mails) but this one stumped me…

      Ginger

  6. Hello Ginger,

    I have compared the email you posted to recent Naira MasterCard transactional email sent to me from GTBank and conclude this one is fake. This email looks like Phishing attack on you and your friend. The problem is that in Phishing attacks there is always a link to a website that looks like the legitimate company but in reality is a link to a website setup as a conduit to harvest customer account details to be later used to wipe out their account balance.

    One clue is Naira Mastercard NEVER gives amount in dollars. And there are other clues you will see if you compare with your previous authentic transaction emails.

    If this USD156 amount was not debited by GTBank then your account and GTBank’s network has not been compromised. If they got your account number correct only means they were able to have access to your deposit teller, ATM withdrawal receipt etc. This may also mean someone is monitoring you physically.

    Finally, please change the Title of this blog because it create a wrong impression about GTBank.

    Full disclosure: I do not work for GTBank and my only relationship with them is my bank account.

    1. Hi Okechukwu,

      Many thanks for the clarification. If correct, that’s consoling at least. Yes I worry because they got my card number correct and only someone WITHIN GTB can do that. If it were my account number displayed in the notification, I can conclude that knowledge came from the teller… however, teller or Mastercard number… only from within GTB can you have such an access.f

      You’re right though about the reported denomination. Previous (genuine) notifications I received give the amount in Naira.

      I also checked the URLs embedded within the message and they all point to the legitimate accounts of GTB.

      Now, who am I to blame?

      Ginger

Hey, I'll like to hear from you - drop a line :)