Cybercriminals are exploiting a technique that allows them to access bank accounts without needing passwords or triggering login alerts, creating a significant security risk for UK customers. The method involves stealing session cookies, which are digital tokens that websites use to keep users logged in after they have authenticated themselves.
According to security experts cited in reporting on the issue, attackers using this approach do not require a user's password, do not trigger login alerts, and can often bypass multifactor authentication. Once a session cookie is compromised, fraudsters can access bank accounts directly. They could also use personal details found in those accounts to carry out impersonation scams. For customers using online shopping accounts, attackers could intercept sessions to redirect orders and charge purchases to saved payment methods.
The threat typically comes from infostealer malware, which is commonly hidden within browser extensions and software downloads. Warning signs that a device has been infected include sudden performance problems, rapid battery drain, frequent crashes, and unusual browser behaviour such as unexpected redirects, pop-ups, or a changed homepage.
Security experts recommend several protective steps. Users should move passwords from browsers into dedicated password managers and use multifactor authentication on accounts, as it still provides more protection than passwords alone. Those who suspect compromise should run antivirus scans, log out of accounts on all devices, and change passwords. Customers may also receive security alerts from websites asking whether they have attempted to change account details, which could indicate unauthorised access.
For UK bank customers and online shoppers, session cookie theft means fraudsters can access accounts and make transactions without triggering the security measures they believe are protecting them.