sb-as logo
Story image

Top tips to avoid downloading malicious online banking apps

20 Aug 2018

Cybercriminals are targeting mobile phone users by tricking them into downloading fake online banking apps.

Mobile users who mistakenly download apps imitating online banking functions can lose money, have their personal details compromised by hackers and even become victims of identity theft.

It’s critical for people to stay safe by learning how to spot the signs of fake or suspicious apps, according to ESET.  Fake and malicious mobile apps are becoming more advanced and harder to detect.

Fake apps imitating financial institutions are particularly dangerous.

In 2016, a series of Australian banks and financial institutions were imitated by a wave of phony apps, and in May and June this year, ANZ bank warned customers of suspicious apps available for download in the Google Play Store, which closely imitated its online-banking apps. Banking malware usually copies a targeted institution’s image precisely, and closely mimics its content, to entice victims into believing the app is authentic.

These fake apps may require excessive permissions, demand administrator rights, or simply request you enter your banking details and related information when first run.

This leads hackers straight to mobile users’ bank accounts and finances.  ESET senior research fellow Nick FitzGerald says, “If people have downloaded apps they know or suspect to be suspicious, they should uninstall them immediately.

“It’s critical that people take protective action over their finances. They should check their bank balances, change their credit card PIN numbers, change their internet banking passwords, and talk to their financial institutions about blocking suspicious account activity.”  ESET has five recommendations to assist mobile users to avoid scam banking apps: 

1. Only download apps from the official app store.

This is not an issue for Apple’s iOS devices, but Android devices can be configured to allow installing apps from other sources than Google Play. Just because an app is on Google Play, or the App Store, does not guarantee it is harmless, or that it is from the organization it purports to represent, but these official app stores offer the most carefully vetted apps for their respective platforms. 

2. Make sure the app is official.

Never trust mobile banking apps unless they’re clearly linked from a financial institution’s official website. Alternately, from the relevant app store, the author link should lead to the bank’s (or financial institutions') official website. 

3. Don’t give out financial details unless it’s absolutely necessary.

Mobile users should protect their data and banking details at all times. Also, it is important to question whether an application really requires administrator privileges to do its job. If not, customers should contact their bank to confirm that they’re using the right application. 

4. Consult the reviews.

Usually, apps viewable in the App Store or through Google Play will include reviews from users who’ve already downloaded and used the app. Large organisations will gain plenty of reviews for their apps, due to their high download rate, so steer clear of apps with low numbers of user reviews and feedback, or none at all. Also, avoid those that received positive reviews immediately after release, but then mainly have negative reviews. Sometimes, hacked users will post complaints, or warnings, in-app review sections. Look for ratings, reviews, and the number of downloads before installing an app. 

5. Update and secure devices.

The best way to protect mobile devices from the effects of scam apps is to use a high-quality, reliable security solution.

Effective security services are specifically developed and updated to combat the latest and most advanced cybersecurity threats, and complement device owners’ attempts to carefully and cautiously install and download apps onto their mobile devices.  FitzGerald says, “Mobile users can never be too careful when engaging in online banking activity.

“Ultimately, it’s best to be preventative rather than reactive, and know how to spot the signs of untrustworthy apps, rather than paying the financial and time-consuming consequences when it’s too late.” 

Story image
APAC parents hide internet activity from children more than cyber attackers
A new report from Kaspersky has turned a modern trope - that teens have things to hide in their internet history - on its head, by proving the opposite is also true.More
Story image
BYOD security in remote work era still riddled with issues
Bitglass’ 2020 BYOD Report suggests that BYOD and personal device security in organisations still leave much to be desired, even as more organisations adopt flexible BYOD arrangements.More
Story image
Device authentication services to reach $8.4 billion by 2026 in response to IoT cybersecurity
"There are several key technologies revolving around authentication security that currently transform the IoT device value chain."More
Story image
Bitglass deepens integration with MFA vendor Duo Security
Bitglass has announced a deepened integration with Duo Security, now part of Cisco, as it looks to strengthen security for the modern workforce.More
Story image
Australians ignoring cybersecurity policies in favour of productivity
Trend Micro has found that 67% of remote workers have increased their cybersecurity awareness during COVID-19 related lockdowns. However, despite greater awareness people may still engage in risky behaviour, the survey finds.More
Link image
Enterprises require a new approach to data-driven transformation
Organisations need a new approach. An enterprise data cloud unlocks the power of your data to serve customers better, operate with greater efficiency, and strengthen security to protect your businessMore