PayIDs exposed at the hands of Aussie Cuscal-sponsored financial institution
The PayID lookup function of Australia's New Payments Platform (NPP) has once again been the target of unsavoury activity, this time seeing a number of records and associated data in the Addressing Service exposed.
A statement from NPP Australia -- the company charged with the oversight of all of the transactions moving through the system -- on Tuesday confirmed the data was exposed by a vulnerability in one of the financial institutions sponsored into the NPP by Cuscal Limited.
See also: Boards of Australian financial firms face tougher infosec rules from 1 July
NPP Australia said it was advised late Friday evening. Cuscal told NPP Australia that the client-side technical issues underlying the exposure were identified and resolved immediately. Cuscal's client has advised that the appropriate regulatory notifications have been made, NPP Australia said.
The affected data included PayID name and account numbers.
"None of the details involved can, on their own, enable the withdrawal of funds from a customer's account without the customer's specific further involvement," NPP Australia said.
A PayID allows for payments to be made via the NPP without any of the previously required banking information -- BSB and account number. A PayID is a unique, user-specific number registered with the customer's bank and linked to a nominated bank account and can be a phone number, email address, or an Australian Business Number (ABN).
It can only be used to put money into an account, not to take money out.
A PayID is a unique, user-specific number and when making a payment, the name registered to that PayID appears as part of the confirmation process.
However, this means that a person can be found by entering their mobile number -- something already possible through the search bar on Facebook, as one example.
Read more: Is PayID look-up no more a breach of privacy than a phonebook?
No other personal information is stored with the PayID.
The latest breach follows Westpac in June confirming its PayID lookup function was misused.
Westpac witnessed 600,000 PayID lookups stemming from seven compromised Westpac Live accounts. Around 98,000 of the lookups were successfully resolved to a short name and displayed to the "fraudster".
No customer bank account numbers were compromised as a result, however.
The NPP went live in February last year. Its infrastructure was built by the Reserve Bank of Australia (RBA), in consultation with the Commonwealth Bank of Australia (CBA), the National Australia Bank (NAB), the Australia and New Zealand Banking Group (ANZ), and Westpac, which hold around 95% market share of the entire Australian finance industry between them.
At launch, there were 13 participants in the NPP, including three entities that are service providers for smaller institutions. In addition to the RBA and the Big Four, they are: Australian Settlements Limited (ASL), Bendigo and Adelaide Bank, Citigroup, Cuscal, HSBC Bank Australia, Indue, ING Australia, and Macquarie Bank.
NPP Australia on Tuesday explained that it has regulations in place that prohibit disclosure of account data and that require participating financial institutions to have controls to monitor, detect, and shut down any attempts to misuse the PayID service.
"These regulations incorporate a suspension of access to the PayID service by organisations not meeting these requirements, and were recently strengthened by the introduction of non-compliance charges which are expected to be also applied where these controls are not implemented," the organisation added.
NPP Australia has a single source of revenue, the RBA explained previously, which is a small fee for a transaction performed on the platform.
Adrian Lovney, who was with Cuscal from 2002 through 2016, is the CEO of NPP Australia.