Police Investigate AITM Scam That Can Trigger Money Laundering Suspicions

Around 30 serious fraud cases are under investigation by Tampere-based national police cybercrime unit TVA involving an AITM phishing attack method, Tamperelainen reports. In the scheme, criminals intercept strong authentication details and session identifiers in real time after luring victims to convincing fake login pages.

The police say criminals position themselves between the victim and a real online banking or service, directing the victim via email, text messages, or search results to a lookalike site. When the victim enters bank credentials and confirms the login through a mobile app or a key list, the attackers steal the login details and the session identifier during the authentication process. After that, they can log into the victim’s online bank and carry out transfers, apply for short-term loans, change contact details, or use the credentials in other services that require strong authentication.

A particularly dangerous aspect, police add, is that even two-factor authentication can be bypassed if the victim approves the login. The article also notes cases where a victim’s bank account is allegedly used to move criminal proceeds without the victim’s knowledge, including as an intermediary in money laundering where the final destination may be abroad. TVA investigation leader criminal commissioner Tommi Juvonen warns that victims may end up looking like suspects of money laundering in a preliminary investigation, and he stresses that the authentication tools themselves remain safe when used correctly. Police advise acting quickly, contacting the bank proactively, and filing a police report, while encouraging people to improve their cybersecurity skills using materials from the Cyber Security Centre.