Cybercriminals are targeting mobile phone users by tricking them into downloading fake online banking apps. Mobile users who mistakenly download apps imitating online banking functions can lose money, have their personal details compromised by hackers and even become victims of identity theft. It’s critical for people to stay safe by learning how to spot the signs of fake or suspicious apps, according to ESET.
Fake and malicious mobile apps are becoming more advanced and harder to detect. Fake apps imitating financial institutions are particularly dangerous. In 2016, a series of Australian banks and financial institutions were imitated by a wave of phony apps (1), and in May and June this year, ANZ warned customers of suspicious apps available for download in the Google Play Store, which closely imitated its online-banking apps. (2)
Banking malware usually copies a targeted institution’s image precisely, and closely mimics its content, to entice victims into believing the app is authentic. These fake apps may require excessive permissions, demand administrator rights, or simply request you enter your banking details and related information when first run. This leads hackers straight to mobile users’ bank accounts and finances.
Nick FitzGerald, senior research fellow, ESET, said, “If people have downloaded apps they know or suspect to be suspicious, they should uninstall them immediately. It’s critical that people take protective action over their finances. They should check their bank balances, change their credit card PIN numbers, change their internet banking passwords, and talk to their financial institutions about blocking suspicious account activity.”
ESET has five recommendations to assist mobile users avoid scam banking apps:
- Only download apps from the official app store. This is not an issue for Apple’s iOS devices, but Android devices can be configured to allow installing apps from other sources than Google Play. Just because an app is on Google Play, or the App Store, does not guarantee it is harmless, or that it is from the organization it purports to represent, but these official app stores offer the most carefully vetted apps for their respective platforms.
- Make sure the app is official. Never trust mobile banking apps unless they’re clearly linked to from a financial institution’s official website. Alternately, from the relevant app store, the author link should lead to the bank’s (or financial institutions’) official website.
- Don’t give out financial details unless it’s absolutely necessary. Mobile users should protect their data and banking details at all times. Also, it is important to question whether an application really requires administrator privileges to do its job. If not, customers should contact their bank to confirm that they’re using the right application.
- Consult the reviews. Usually, apps viewable in the App Store or through Google Play will include reviews from users who’ve already downloaded and used the app. Large organisations will gain plenty of reviews for their apps, due to their high download rate, so steer clear of apps with low numbers of user reviews and feedback, or none at all. Also avoid those that received positive reviews immediately after release, but then mainly have negative reviews. Sometimes, hacked users will post complaints, or warnings, in app review sections. Look for ratings, reviews, and the number of downloads before installing an app.
- Update and secure devices. The best way to protect mobile devices from the effects of scam apps is to use a high-quality, reliable security solution. Effective security services are specifically developed and updated to combat the latest and most advanced cybersecurity threats, and complement device owners’ attempts to carefully and cautiously install and download apps onto their mobile devices.
Nick FitzGerald said, “Mobile users can never be too careful when engaging in online banking activity. Ultimately, it’s best to be preventative rather than reactive, and know how to spot the signs of untrustworthy apps, rather than paying the financial and time-consuming consequences when it’s too late.”
(1) http://www.welivesecurity.com/2016/03/09/android-trojan-targets-online-banking-users/
(2) https://www.anz.com.au/security/fraud-detection/latest-security-alerts/
