Mobile Banking Security Threats: Understanding the Risks and Solutions

Given the number of touchpoints on the mobile channel, it’s not surprising that McKinsey recommends banks prioritize apps for their consumer interactions. Especially when you consider that the banks who are leaders in mobile are also the leaders in retail banking overall.

And it’s security that we’ll be focusing on in this article. We’ll take a look at some of the most sophisticated mobile banking security threats out there, we’ll explore the impact of successful attacks both on end users and on the banks themselves, and we’ll explain the level of security required for banks if they want to repel modern threats and maintain their hard-earned reputation in the sector.        

This article isn’t about fearmongering, however. We’re not portraying mobile banking as the Wild West, rife with bandits running riot, compromizing mobile banking apps at will and making off with your funds.

Mobile banking is relatively safe for most of us, because most banks acknowledge the threats that exist and equip their applications with the robust protection mechanisms required to defend themselves.

The problem is that this isn’t true of all banks, and attacks are getting ever more sophisticated and menacing – partly as a result of AI. Some analysts would argue, justifiably, that even one customer losing their credentials or funds is one too many.

The truth is that, despite many of us using mobile banking apps for a decade or more, it still sometimes feels like security on the device is assumed more than it is prioritized or even demanded. But things are changing. In a world full of hyper-realistic forgeries powered by increasingly influential AI models, assuming anything is no longer sufficient. What is more, new regulations are setting strict penalties for banks that fail to adequately protect their customers.

Mobile banking trojans often arrive on a user’s device via a seemingly innocuous – and often quite boring-looking – apps such as file managers. Once installed, these apps can then request the permission to install other packages that are vital for the trojan to operate.

Some trojans – as the name hints at – can lie in wait, dormant, after being invited inside the city walls (i.e., when the payload has been delivered and downloaded) until the time is just right for them to strike. This often means when a mobile banking app is opened by the victim.

Then there’s spyware, which haunts the end user constantly, delivering a live feed of their private activity on the device to attackers. This includes what they’re doing on their mobile banking application, of course.

Trojans are often designed to exploit Accessibility Services – on Android devices at least. This tool, designed to help people with disabilities to be able to use their mobile devices, can enable trojans to overlay fake screens made to look exactly like those in the legitimate application. It can also help them to log keystrokes – and thus discover their victims’ login credentials and card details.

Some particularly sophisticated varieties of trojan can even use Accessibility Services to override or disable security mechanisms such as antivirus applications.

Some banking customers are less cautious than others and, as a result, they might be in a position that makes a payload arriving on their device more likely. This includes rooting their device and downloading apps away from recognized platforms such as the App Store or Play Store, for example. 

But others customers can just be unlucky. They might fall for a social engineering scam and click on a link they shouldn’t, for example. This is something that can unfortunately happen to any of us – even those of us who think we’re tech savvy and unlikely to fall for the mental traps that scammers set for us.

In the end, we probably need to accept that malware will continue to land on end users’ devices, and then spread quickly to others. So, what can be done about it?

Another incredibly effective countermeasure is called device binding. Linking a user’s account to a specific device helps to prevent trojans from stealing or modifying user data via remote access attacks (where a malware variant tries to gain remote access to a device to steal sensitive information).

The objective of an account takeover is to take control of a user’s bank account to steal funds, make unauthorized or illegal transactions, and to open new accounts or access additional banking services such as credit cards and loans.  

Malware isn’t the only attack vector open to fraudsters to achieve this aim, of course. They can also physically steal a victim’s phone and access their account that way. Or, more typically, they can carry out credential abuse by tricking their victim into voluntarily giving up their login details. This might be via a social engineering campaign, or as a result of the victim mistakenly downloading a bogus, cloned version of the app after being convinced that it is an updated version of the genuine one. Attackers can then harvest login credentials and other sensitive information from this fake application.

The anti-malware mechanisms that we covered in the previous section ring true here, too, given that malware is a key attack vector for account takeovers. As for credential abuse, there are several protection mechanisms to keep in mind:

Another threat to be protected against is man-in-the-middle attacks. This is where attackers hijack a network - often an unprotected one without a password - with a view to intercepting authentication data. Imagine you’re in the airport and you want to send a payment to the hotel before your arrival. So, you log onto the free airport wifi and open your mobile banking application. At this point an attacker on the network could hijack your connection and steal your credentials. It really isn’t worth the risk.

With the advent of AI, it is becoming easier for bad actors to generate fake ID documents and even photos and videos to help them pass these checks and convince the bank that they are indeed dealing with a real person.

One common approach is for attackers to use a virtual camera and faked faces in order to pass the eKYC check. Deepfakes use AI models to effectively trick the eKYC system into thinking that it’s the real person. Some people pay for a more sophisticated fake, but it’s also possible to trick some eKYC systems with a fairly rudimentary, low-resolution video based off of a passport photo. Right now, it feels like some automatic eKYC models aren’t up to the task of differentiating between real homo sapiens and bogus, AI powered versions.

Banks also run the risk of regulatory fines if it comes to light that they have failed to comply with KYC (and security) specifications. Banks without robust fraud prevention measures in place could find themselves facing legal action, too, given that some eKYC fraud might be linked to money laundering.

eKYC fraud can, like other attacks covered in this article, also impact end user trust and the bank’s reputation. Particularly if it emerges that an attacker has used a customer’s credentials.

Because the eKYC process can be interfered with and tricked, as we explained above, ideally the checks should be carried out in an isolated and secure execution environment that cannot be tampered with. And eKYC data must also be encrypted if it is stored on the device to stop unauthorized access or modification – including by malware.

Mobile banking trojan payloads often arrive on a victim’s phone via a link in a phishing email, or via a bogus application that they have been tricked into downloading. Account takeovers are sometimes facilitated by a user sharing their credentials (perhaps after the attacker claims to be a banking employee in order to overcome initial resistance). And eKYC fraud, too, can be made easier if banking customers share their personal information.

So, social engineering is a constant threat that can enable and expand the reach of other attacks and needs to be tackled at the same time. The difficulty, of course, is that social engineering isn’t a technical attack that can be stopped with robust, technical solutions. Social engineering targets human emotions and so it is much less predictable.

Sometimes our instincts lead us to behave in a way that might not be the safest from a security perspective. We’ve been hard-wired to react to situations almost without thinking – holding the door open for someone, for example, the desire to help people, or the instinct to rely on authoritative voices. All of these can be exploited by bad actors to trick us and steal from us.

And that’s before you add the impact of AI into the mix. At the very least, AI models have made phishing messages much more convincing and effective. Do you remember the days when it was quite easy to spot a scam message because of the quantity of grammar and spelling mistakes? Those days are over. Now you can train your AI assistant to write personalized imitations of official bank communications in the style of the world’s finest copywriter.

More complex scams that might previously have required bad actors to invest significant funds into employing and training scammers in a call center can now be done via AI-powered voice assistants, designed to trick banking users into transferring funds, sharing their account details, or revealing authentication codes.

And if the attackers think that their target banking customers might be more likely to comply if they were asked by someone with a specific accent – say a well-educated, softly-spoken English lady from the Home Counties – then that too can be arranged thanks to AI.

A secure, verified, communication channel within the app itself can go a long way in stopping end users being tricked by fake customer support scams. And repeated warnings about ignoring messages – however convincing they are – that appear to be from the bank but are actually from unverified sources, can hammer home the message.

Banks can also set some rules within the app that require additional authentication for high-risk transactions that involve large sums or a new payee. Some forward-thinking banks have even set up a sort of cooling off period of several hours before a transaction can be approved and finalized. They should also consider enforcing the ability to detect active voice calls while the mobile banking application is in use as an additional layer of protection for the user and to prevent them being manipulated.

The thing is, social engineers rely on you acting impulsively, without thinking. They’re desperate for you to embrace the instinctive, almost-tick-like behaviors that we learn from a very young age. Take the advantage of time away from the attacker, and things tend to become clearer. We’re much more likely to think logically about a given situation.

This is another important reason why banks should use a reliable threat and device intelligence solution. Their security analysts can dig into the data to understand the trends around different types of attacks, which in turn can help them to create a more solid security strategy in the long run.

Here at Licel, we’re firm believers in the concept of continuous security. That’s why we have our products evaluated by external laboratories and approved by respected industry bodies like EMVCo. We want to be completely sure that our solutions are ready to deal with the latest threats – including those that have been enhanced by AI.

If they’re not alert, then they’ll end up wasting significant amounts of time and resources dealing with the fallout of fraud, potentially fall foul of industry regulations, and suffer a loss of trust among their customers that will hit their business reputation hard.

The choice between all of that and making an investment in reliable mobile channel protection really should be an easy one to make.