With personal data, there are no ‘nobodys’

A friend recently commented that hackers won’t benefit from getting access to his email account. “There’s nothing there,” he laughed, “it’s a waste of time for them. I’m a nobody.”

A few weeks after, I noticed a trend wherein the credentials of some Filipino doctors were used to create fake medical certificates for employees, complete with email contact details. The unscrupulous groups doing this would charge a fee and replied to inquiries that would arrive in the real doctor’s email inbox.

I thought it trivial for attackers to redirect incoming email from a compromised inbox to themselves. This is one of the first things any attacker would do when taking over an email account, and often the owner would be none the wiser that someone else was reading and sending mail on their behalf. There are much more devastating outcomes regarding compromised email accounts.

In one case I handled last year, a middle-aged specialist doctor was befriended online by a self-described savvy investor. “I just need P5,000 to deposit into this bank account, and I can return P8,000 to you in a week,” the investor said, which surprisingly was indeed fulfilled. The next request was to borrow P10,000 for a P15,000 return – which was fulfilled as well, thus gaining the trust of the ecstatic eye doctor.

Eventually, the investor offered to enrol the doctor in a special banking account, and even offered to do it in her stead because well, the process was “a little complicated for non-techy people.” Understandable. “Well then, I would need your email credentials, so I can make it easier for you,” read the viber message in Tagalog. At this point the doctor simply gave the information; what would be the harm after all? Only after the damage was done was it discovered why this lady doctor was specifically targeted and befriended.

Apparently, she was designated as one of the transaction approvers for a shared online banking account for a group of local specialized doctors in her field – and somehow, the attackers knew this. None of the doctors in this group were very technologically inclined, and all conducted their transactions in the physical bank.

Unbeknownst to them, they had a live online