Fool Us Once, Fool Us Twice: Hacking Norwegian Banks
Explains how postal mail paper forms were exploited in 2021 and 2024 to gain unauthorized access to Norwegian bank accounts.
Summary
Exploiting Paper Banking Workflows
In 2021, security researchers discovered that submitting a single-page paper form via postal mail could compromise personal bank accounts at the largest financial institution in Norway.
Unauthorized Access and Full Account Takeover
The vulnerability enabled unauthorized actors to transfer funds, view ten years of transaction histories, and modify customer account details without digital authentication.
Recurring Vulnerabilities in 2024
Despite previous public disclosures, the identical paper-based authentication flaw was successfully demonstrated against another major bank three years later.
Reassessing Physical Identity Verification
Financial institutions must eliminate insecure paper fallback mechanisms and enforce strong, multi-channel identity verification across all customer onboarding channels.
Related talks
Creator Stage·56 min
Nick Percoco · Kitboga
Breaks down operational workflows and financial mechanics of cryptocurrency fraud, tracking stolen funds and detailing defensive countermeasures.
Creator Stage·25 min
Daniel Isler
Presents a comic-style narrative of a complex red team engagement achieving physical datacenter access entirely through social engineering.
Daniel Isler
Applying photojournalism principles and invisible theater to seize decisive moments in physical social engineering.