As of the beginning of July, SK ID Solutions, the provider of the Smart-ID authentication service, made the creation of new Smart-ID accounts more difficult, making it impossible for criminals to register false accounts for their victims using phising pages, the RIA said. The authority was aware, however, of phishing campaigns in which victims were asked to enter their PIN1 and PIN2 using the Smart-ID or Mobile-ID service on their smart device.

When this happened, criminals would immediately attempt to access the victim's bank account with the user ID number entered by the user on the phishing page while the victim was was waiting and then entering their PIN1. The perpetrators would then initiate a transfer from the victim's bank account, the completion for which required the entry of their PIN2. The RIA has learned that several people have suffered financial damages this way.

In connection with these incidents, the RIA is reminding Estonian residents that when it comes to one's Smart-ID, ID card  or Mobile-ID, their PIN2 is equivalent to their personal signature and is not required to log into one's bank account.

At the end of July, SK ID Solutions informed the RIA about another fraud scheme in which the victim is promised several thousands of euros in earnings via phone call. In the course of the process, a remote connection is established with the victim's computer, and money transfers are conducted in the victim's name using various authentication tools.

Three data leaks reported

In the first half of July, the RIA was informed of three separate incidents in which the data of customers of Estonian companies was publicly accessible.

Office supplies retailer Charlot's online store displayed the first and middle names, email addresses, website login passwords, addresses and personal ID numbers of thousands of its clients.

In Tartu, city authorities were informed that the data of 20,000 users of the citywide bikeshare launched this summer was publicly accessible online, including the starting and end points of trips made by users of the bikeshare ervice.

Fuel retailer Olerex, meanwhile, announced that the data of some of its corporate clients had remained publicly accessible via a buffer file after relocation.

To the RIA's knowledge, no one aside from the individuals who detected the aforementioned leaks ever saved or misused the data, and access to said data was restricted immediately after the leaks were reported. Supervision proceedings were launched in all three cases.

-

Download the ERR News ap for Android and iOS now and never miss an update!