I am currently working as a freelancer in a Freelancer platform (Freelancer.com).

I accepted a project that is requires cURL and PHP knowledge. He has the original script handed down to me, basically its a script that logins to a "banking" website, then allows its user to send money to other people. What he wants is to make the script first get "fixed" to allow login. Which I fixed.

The "banking website" will not allow users to readily transfer money to other users. There's physical verification required, which I am not familiar.

But I realized, this can be used for illegal. The application allows logging in to a "banking website", even though it cannot "confirm" or "bypass" the verification to successfully authorize the money transfer, just the fact that the application can login to this financial institution's records can be alarming.

I mean, if the employer decided to scrape the sensitive information, or get the username/password _POST request then record it, isn't that illegal? Isn't that phishing? Isn't that fraud?

I still have ongoing projects with him, and I'm already starting to think the other way.

I am actually scared, an employer has a script I helped coding, and he can use that for bad things. Even if I stop now, I helped him in fixing the "log-in" method.

Am I thinking too much? Can somebody give me some tips?

Thank you.

I am currently working as a freelancer in a Freelancer platform (Freelancer.com).

I accepted a project that is requires cURL and PHP knowledge. He has the original script handed down to me, basically its a script that logins to a "banking" website, then allows its user to send money to other people. What he wants is to make the script first get "fixed" to allow login. Which I fixed.

The "banking website" will not allow users to readily transfer money to other users. There's physical verification required, which I am not familiar as it is overseas.

But I realized, this can be used for illegal. The application allows logging in to a "banking website", even though it cannot "confirm" or "bypass" the verification to successfully authorize the money transfer, just the fact that the application can login to this financial institution's records can be alarming.

I mean, if the employer decided to scrape the sensitive information, or get the username/password _POST request then record it, isn't that illegal? Isn't that phishing? Isn't that fraud?

I still have ongoing projects with him, and I'm already starting to think the other way.

I am actually scared, an employer has a script I helped coding, and he can use that for bad things. Even if I stop now, I helped him in fixing the "log-in" method.

Am I thinking too much? Can somebody give me some tips?

Thank you.