You’ve had a busy morning of life admin, logging into various accounts to check balances and make payments. At the end of a productive few hours you close your laptop and move on to your next job. What you don’t know is that fraudsters have hijacked your session with the bank and are now able to access your account.
You are the victim of cookie theft, which belongs to a type of fraud known as “session hijacking”. In the year to June it identified 52bn cookies in stolen data circulating online. When you log into a website, such as your bank’s, you are given a unique cookie that sits on your device and stores your data temporarily.
This means you can move from page to page without repeatedly being asked for your login details. It’s called a “session cookie” – or key – and as soon as you log out, it stops being of use. But while the session is open – and that will last beyond your activity if you choose to be remembered on a website, or if you do not properly close it – you could be vulnerable to cookie theft.
Briedis says: “Think of a session cookie as a digital key that’s already turned in the lock. When you stay logged into a site, that cookie is what keeps the door open for you. If a hacker steals that active cookie, they essentially become you.
The theft is usually a result of you having inadvertently downloaded malware. At some point you will have logged in and given your password, and maybe used MFA to prove it’s you. You may not realise that you are a victim until you later find that someone has used the session cookie to hack your account.
If it’s a social media or email account you may discover it’s been used by scammers to trick other people. If it’s your bank they could access your account, or they could use details they find to perpetrate an impersonation scam. And if you were shopping online, the fraudsters could change and redirect your order and charge it to your saved payment details.
Extract — continue reading at the source.
