Landsbankinn wishes to draw customers’ attention to an investigation by the Reykjavík Metropolitan Police, which revealed that over 300 young people have used an iPhone VPN profile called “Island Surge VPN”.
Landsbankinn wishes to draw customers’ attention to an investigation by the Reykjavík Metropolitan Police, which revealed that over 300 young people have used an iPhone VPN profile called “Island Surge VPN”.
The VPN profile makes the user appear to be a different age by causing the phone to trust a security certificate issued by the service provider and routing the phone’s internet traffic through the provider’s servers. The service then alters the young person’s Id. No. as displayed in online banking and on island.is.
The VPN profile was available for purchase online from 8 July through 8 October but is no longer available.
The young people were required to enter their actual Id. No. and pay for the service online through Stripe. As a result, the service provider has their actual Id. No., full name and email, and in some cases, a photograph and age. In addition, because their phones now trust the fraudulent certificate when connecting to all websites, the service provider may also be able to view traffic related to email, social media and other messages without the young person’s knowledge.
Landsbankinn encourages parents and guardians to look into this matter carefully. If the VPN profile is found on a young person’s phone, it is important to take the following steps:
- Check whether the VPN profile is installed
Settings → General → VPN & Device Management. Look for a profile called “Island Surge VPN”. - Check whether the profile is active
Settings → General → About → Certificate Trust Settings. If a certificate named “Surge” appears and is enabled, the VPN profile is active. - Remove the profile
In VPN & Device Management, select the profile and then choose Remove Profile. This will also remove the certificate and VPN connection. - Monitor activity and contact us
If the VPN profile was found on a device and you notice anything unusual relating to transactions on accounts or payment cards, contact the Bank immediately by calling +354 410 4000. Please note that actions in online banking and payment card transactions require authentication using electronic ID or personal authentication methods. Do not approve an authentication request unless it relates to an action you are carrying out yourself.
We encourage you to contact the police by phone to +354 444 1000 if you have further information about the matter.
