Three men plead guilty to running MFA bypass service OTP.Agency

Three men plead guilty to running MFA bypass service OTP.Agency

Three men have pleaded guilty to operating OTP.Agency, an online service that allowed crooks to bypass Multi-Factor authentication (MFA).

Three men, Callum Picari (22), Vijayasidhurshan Vijayanathan (21), and Aza Siddeeque (19), have pleaded guilty to operating OTP.Agency, an online platform that allowed crooks to bypass MFA used by customers of several banks and services.

These OTPs, used in multi-factor authentication, allowed criminals to bypass security and access victims’ bank accounts to steal funds.

Cybercriminals paid a monthly subscription fee to OTP.Agency, which provided tools for socially engineering victims and tricked them into revealing one-time passcodes or personal information.

“Launched in November 2019, OTP Agency was a service for intercepting one-time passcodes needed to log in to various websites.” reported the popular investigator Brian Krebs. “Scammers who had already stolen someone’s bank account credentials could enter the target’s phone number and name, and the service would initiate an automated phone call to the target that warned them about unauthorized activity on their account.”

A basic plan, costing £30 a week, allowed bypassing multi-factor authentication on platforms like HSBC, Monzo, and Lloyds, allowing crooks to conduct fraudulent transactions on behalf of the victims. An elite plan, costing £380 a week, granted access to Visa and Mastercard verification sites, allowing criminals to steal money from personal bank accounts.

“NCA cyber investigators began probing the website in June 2020 and believe over 12,500 members of the public were targeted between September 2019 and March 2021, when it was taken offline after the trio were arrested.” reads the press release published by the NCA. “It is not known how much money the group made from the venture but estimates show it would have been around £30,000 if users purchased the basic plan and up to £7.9 million if they had opted for the elite package.”

The NCA states that Picari was the platform’s owner and the main developer, while Siddeeque promoted it in the cybercrime ecosystem and provided technical support to criminal users.

Picari advertised the service in a Telegram group with over 2,200 members, claiming it was the first and last professional service for stealing one-time passcodes (OTPs). The Telegram group was deleted after Krebs on Security published an article in 2021.

“KrebsOnSecurity profiled OTP Agency in a February 2021 story about arrests tied to another phishing-related service based in the U.K. Someone claiming to represent OTP Agency then posted several comments on the piece, wherein they claimed the story was libelous and that they were a legitimate anti-fraud service” wrote KrebsOnSecurity.

The three men were charged with conspiracy to create and distribute tools for fraud, and Picari was also charged with money laundering. Although they initially denied any involvement in criminal activities, they have all since admitted to the charges. They are scheduled to be sentenced at Snaresbrook Crown Court on November 2, 2024.

“Picari, Vijayanathan and Siddeeque opened the door for fraudsters to access bank accounts and steal money from unsuspecting members of the public.”

“The trio profited from these serious crimes by running www.OTP.Agency and their convictions are a warning to anyone else offering similar services; the NCA has the ability to disrupt and dismantle websites which pose a threat to people’s livelihoods.” said Anna Smith, Operations Manager from the NCA’s National Cyber Crime Unit.

“We would also urge anyone using online banking services to be vigilant.” “Criminals may pretend to be a trusted person or company when they call, email or message you. If something seems suspicious or unexpected, such as requests for personal information, contact the organisation directly to check using details published on their official website.”

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, NCA)