5

Recently I logged on to my bank account via the Chase app on my iPhone. I received a message that another device was currently logged on to my account and "would I like to end the session"? Of course, I ended it. I went directly to Chase Bank and spoke with their security department. There was another user logged on from another iPhone. All they could give me was their IP address. Is there any way to track who this was? And do iPhones use random IP addresses depending on the location and whether WiFi is available or not?

  • Thanks Mr. Flagrum for your explanation. But there need to be some improvement in answer. - If its a status IP address then also you can trace the person by its MAC address which never changes and is unique for each device. You can challenge anybody from this. - You can trace the IMEI from if its a mobile device and can easily catch the person. - As you mentioned above, that if IPV6 is assigned so you might catch a wrong person if translation doesn't happen in IPv4. That's impossible since both have different formats like mentioned below:- IPv4 --> 128.122.11.36 IPv6 --> 347F:485A:AD2B:124C:EF – user82868 Aug 7 '15 at 12:26
17

There is a possibility that the other iPhone was... yours.

Your IP address is awarded to you by whatever technology provides your Internet access. When you connect over 3G, the IP address comes from your phone company. When you connect over WiFi, you get an IP address from the WiFi access points. The IP addresses can be "dynamic", i.e. it may change over time. Also, each WiFi access point can only give you an IP address that it owns, and most such access points use NAT.

This means that when you connect to WiFi access point A, you get a "private IP" and all your traffic is seen, from the outside (and in particular from the bank server), as coming from A's own unique IP address. If you then use this nifty feature of mobile phones, namely their mobility (you can walk in the street with a phone, there is no wire to deal with), then you may walk away from the range of WiFi access point A, and enter a zone covered by WiFi access point B. Your iPhone, being a smart phone, will automatically connect to B. But then, your requests will come out with B's IP address, not A. Nothing will warn the bank server that your phone has disconnected from WiFi access point A; all that the bank sees is a request bearing B's IP address, whereas a few minutes before they got a request bearing A's IP address. From their point of view, this means that there are two "connected" clients, and they warn about that.

(The technical point here is that Web requests are that: requests. You do not have a direct, permanent connection between your phone and the bank; this is not a phone call. This is more akin to mailing: your phone sends a request, the server sends back a response, but there is no way for the bank to know if you relocated elsewhere since the last request you sent.)

  • 1
    Question Mr. Leek.....if I had not logged on to my account that day....and then logged on for the 1st time around 3pm and the "other device" had been logged on at 2:48 pm.....could it have still been mine? I have two separate IP addresses....the one at 2:48 and the one at 3:00. Please forgive me not technically inclined. – Paige Aug 23 '13 at 15:17
  • It really depends on whether "around 3pm" could be 2:48 pm or not. From the server, they only see individual requests, but requests are sent only when you do something (click on a button, follow a link), not when you just look at the page. It is hard to tell more with the available information. In any case, changing your authentication password would not harm here (in case that password was stolen, it would "evict" the thief). – Tom Leek Aug 23 '13 at 17:32
  • @Paige Now what was your IP and the other IP you were told? Is it possible you didn't log off the day before? – ott-- Aug 23 '13 at 19:20
6

Essentially you just need to contact the police. They are the only people who are likely to be able to help you. That said, some police respond well if you can provide a little more information about your attacker.

The IP address you have will be either the address given to the GSM transceiver in the phone (if they were using 3G for example), or the address of the gateway of a WiFi network that the attacker's phone was connected to.

Which it is is quite easy to find out; you can use an online whois service to discover which ISP the address is registered to. If it is a mobile telecomms provider, then they were using GSM on a SIM card issued by that provider, otherwise they were on WiFi.

Either way, you can proceed by contacting the ISP in question to let them know that their network is being used for fraudulent purposes. They will be able to lookup which ISP account the address was assigned to at the time in question, however this is not information they would give to you, only the police, and typically only once a judge orders them to.

  • +1 for mentioning the police up front. In The Netherlands, that would be 1 CIOT lookup and they'd know the name and address of the person owning it. That doesn't mean this person did it, but that's already more than you could do yourself. – Luc Aug 23 '13 at 16:21
2

The best you can do (without the assistance of the ISP that is) is track the general location of where that iPhone was, and who the ISP is.

You can do this with any IP Whois tool, however I will caution that it may lead you to a dead end. If the iPhone was connected to a WiFi network the IP address will be different than if it was connected to the carriers 3G / LTE Network. Alternatively the iPhone could have been connected to a VPN or used a proxy, in which case you're left with another dead end as far as tracking the user is concerned.

Track the IP address and see where that lands you - you won't be able to do much without the police as ISPs don't hand over personal details without police warrants. Be prepared that this might be an uphill battle for you.

Good luck.

1

Here is how this really works.

  1. Where ever you are your IP address on a Smart phone may, or may not change. This purely depends on the carrier and or provider of said access. Some will give you a static Ip, others will give you a Dynamic IP. Static does not change, Dynamic does. (If I am remembering right I am very tired.)

So, lets say you retrieved the IP address from your bank of the other phone that was logged in. Now we move onto 2.

2A. If its Dynamic, you might be out of luck, because as the person with the other phone or device moves around, their ip address will change based upon whatever cell tower's IP address they are connected to at the time they are logged into your account.

2B. If its static, now you are in luck, because wherever that smart phone or device is located, the towers it connects to will then relay the data to the carrier's servers which will allocate the same IP address no matter where the phone or device is.

REMEMBER: If the phone carrier is using IPV6 allocations then you will have to translate it back to IP4, which might be on a "as per need" use allocation. So you might hit someone elses phone who was not the individual logged into your account.

  1. If the scenario is 2B, now we have something to work with. You can "trace route" that IP address, and see what its distance from you actually is, it will be in miliseconds. Remember you will be traveling over lines, that are either on poles or in the ground, so you need to know the general position of travel of your packets down those lines.

Now, if they are connected to, lets say, star bucks, wireless instead of directly to the carrier, you will be able to determine that using a simple Who Is Search. But then you have to find the person, go where they are, catch them doing it, and convince the cops you are right. There, are, other things you could do, but I am not going to discuss that with you or anyone else.

  1. Here is your last option, on scenario 2B. You can get ahold of that phones carrier or provider, compile you evidence before hand of course, then call them, and file a complaint, both over email, in voice, and in writing. It is likely that if you can prove your case, that they will permanently Ban that user, and that phone from their service to avoid future problems.

Good Luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.