Story image

Top tips to avoid downloading malicious online banking apps

20 Aug 18

Cybercriminals are targeting mobile phone users by tricking them into downloading fake online banking apps.

Mobile users who mistakenly download apps imitating online banking functions can lose money, have their personal details compromised by hackers and even become victims of identity theft.

It’s critical for people to stay safe by learning how to spot the signs of fake or suspicious apps, according to ESET. 

Fake and malicious mobile apps are becoming more advanced and harder to detect.

Fake apps imitating financial institutions are particularly dangerous.

In 2016, a series of Australian banks and financial institutions were imitated by a wave of phony apps, and in May and June this year, ANZ bank warned customers of suspicious apps available for download in the Google Play Store, which closely imitated its online-banking apps.

Banking malware usually copies a targeted institution’s image precisely, and closely mimics its content, to entice victims into believing the app is authentic.

These fake apps may require excessive permissions, demand administrator rights, or simply request you enter your banking details and related information when first run.

This leads hackers straight to mobile users’ bank accounts and finances. 

ESET senior research fellow Nick FitzGerald says, “If people have downloaded apps they know or suspect to be suspicious, they should uninstall them immediately.

“It’s critical that people take protective action over their finances. They should check their bank balances, change their credit card PIN numbers, change their internet banking passwords, and talk to their financial institutions about blocking suspicious account activity.” 

ESET has five recommendations to assist mobile users to avoid scam banking apps: 

1. Only download apps from the official app store.

This is not an issue for Apple’s iOS devices, but Android devices can be configured to allow installing apps from other sources than Google Play. Just because an app is on Google Play, or the App Store, does not guarantee it is harmless, or that it is from the organization it purports to represent, but these official app stores offer the most carefully vetted apps for their respective platforms. 

2. Make sure the app is official.

Never trust mobile banking apps unless they’re clearly linked from a financial institution’s official website. Alternately, from the relevant app store, the author link should lead to the bank’s (or financial institutions') official website. 

3. Don’t give out financial details unless it’s absolutely necessary.

Mobile users should protect their data and banking details at all times. Also, it is important to question whether an application really requires administrator privileges to do its job. If not, customers should contact their bank to confirm that they’re using the right application. 

4. Consult the reviews.

Usually, apps viewable in the App Store or through Google Play will include reviews from users who’ve already downloaded and used the app. Large organisations will gain plenty of reviews for their apps, due to their high download rate, so steer clear of apps with low numbers of user reviews and feedback, or none at all. Also, avoid those that received positive reviews immediately after release, but then mainly have negative reviews. Sometimes, hacked users will post complaints, or warnings, in-app review sections. Look for ratings, reviews, and the number of downloads before installing an app. 

5. Update and secure devices.

The best way to protect mobile devices from the effects of scam apps is to use a high-quality, reliable security solution.

Effective security services are specifically developed and updated to combat the latest and most advanced cybersecurity threats, and complement device owners’ attempts to carefully and cautiously install and download apps onto their mobile devices. 

FitzGerald says, “Mobile users can never be too careful when engaging in online banking activity.

“Ultimately, it’s best to be preventative rather than reactive, and know how to spot the signs of untrustworthy apps, rather than paying the financial and time-consuming consequences when it’s too late.” 

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Verifi takes spot in Deloitte Asia Pacific Fast 500
"An increasing amount of companies captured by New Zealand’s Anti-Money laundering legislation are realising that an electronic identity verification solution can streamline their customer onboarding."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
What disaster recovery will look like in 2019
“With nearly half of all businesses experiencing an unrecoverable data event in the last three years, current backup solutions are no longer fit for purpose."
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.