Story image

Top tips to avoid downloading malicious online banking apps

20 Aug 18

Cybercriminals are targeting mobile phone users by tricking them into downloading fake online banking apps.

Mobile users who mistakenly download apps imitating online banking functions can lose money, have their personal details compromised by hackers and even become victims of identity theft.

It’s critical for people to stay safe by learning how to spot the signs of fake or suspicious apps, according to ESET. 

Fake and malicious mobile apps are becoming more advanced and harder to detect.

Fake apps imitating financial institutions are particularly dangerous.

In 2016, a series of Australian banks and financial institutions were imitated by a wave of phony apps, and in May and June this year, ANZ bank warned customers of suspicious apps available for download in the Google Play Store, which closely imitated its online-banking apps.

Banking malware usually copies a targeted institution’s image precisely, and closely mimics its content, to entice victims into believing the app is authentic.

These fake apps may require excessive permissions, demand administrator rights, or simply request you enter your banking details and related information when first run.

This leads hackers straight to mobile users’ bank accounts and finances. 

ESET senior research fellow Nick FitzGerald says, “If people have downloaded apps they know or suspect to be suspicious, they should uninstall them immediately.

“It’s critical that people take protective action over their finances. They should check their bank balances, change their credit card PIN numbers, change their internet banking passwords, and talk to their financial institutions about blocking suspicious account activity.” 

ESET has five recommendations to assist mobile users to avoid scam banking apps: 

1. Only download apps from the official app store.

This is not an issue for Apple’s iOS devices, but Android devices can be configured to allow installing apps from other sources than Google Play. Just because an app is on Google Play, or the App Store, does not guarantee it is harmless, or that it is from the organization it purports to represent, but these official app stores offer the most carefully vetted apps for their respective platforms. 

2. Make sure the app is official.

Never trust mobile banking apps unless they’re clearly linked from a financial institution’s official website. Alternately, from the relevant app store, the author link should lead to the bank’s (or financial institutions') official website. 

3. Don’t give out financial details unless it’s absolutely necessary.

Mobile users should protect their data and banking details at all times. Also, it is important to question whether an application really requires administrator privileges to do its job. If not, customers should contact their bank to confirm that they’re using the right application. 

4. Consult the reviews.

Usually, apps viewable in the App Store or through Google Play will include reviews from users who’ve already downloaded and used the app. Large organisations will gain plenty of reviews for their apps, due to their high download rate, so steer clear of apps with low numbers of user reviews and feedback, or none at all. Also, avoid those that received positive reviews immediately after release, but then mainly have negative reviews. Sometimes, hacked users will post complaints, or warnings, in-app review sections. Look for ratings, reviews, and the number of downloads before installing an app. 

5. Update and secure devices.

The best way to protect mobile devices from the effects of scam apps is to use a high-quality, reliable security solution.

Effective security services are specifically developed and updated to combat the latest and most advanced cybersecurity threats, and complement device owners’ attempts to carefully and cautiously install and download apps onto their mobile devices. 

FitzGerald says, “Mobile users can never be too careful when engaging in online banking activity.

“Ultimately, it’s best to be preventative rather than reactive, and know how to spot the signs of untrustworthy apps, rather than paying the financial and time-consuming consequences when it’s too late.” 

Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
Exclusive: Fileless malware driving uptake of behavioural analytics
Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).