sb-nz logo
Story image

Top tips to avoid downloading malicious online banking apps

20 Aug 2018

Cybercriminals are targeting mobile phone users by tricking them into downloading fake online banking apps.

Mobile users who mistakenly download apps imitating online banking functions can lose money, have their personal details compromised by hackers and even become victims of identity theft.

It’s critical for people to stay safe by learning how to spot the signs of fake or suspicious apps, according to ESET.  Fake and malicious mobile apps are becoming more advanced and harder to detect.

Fake apps imitating financial institutions are particularly dangerous.

In 2016, a series of Australian banks and financial institutions were imitated by a wave of phony apps, and in May and June this year, ANZ bank warned customers of suspicious apps available for download in the Google Play Store, which closely imitated its online-banking apps. Banking malware usually copies a targeted institution’s image precisely, and closely mimics its content, to entice victims into believing the app is authentic.

These fake apps may require excessive permissions, demand administrator rights, or simply request you enter your banking details and related information when first run.

This leads hackers straight to mobile users’ bank accounts and finances.  ESET senior research fellow Nick FitzGerald says, “If people have downloaded apps they know or suspect to be suspicious, they should uninstall them immediately.

“It’s critical that people take protective action over their finances. They should check their bank balances, change their credit card PIN numbers, change their internet banking passwords, and talk to their financial institutions about blocking suspicious account activity.”  ESET has five recommendations to assist mobile users to avoid scam banking apps: 

1. Only download apps from the official app store.

This is not an issue for Apple’s iOS devices, but Android devices can be configured to allow installing apps from other sources than Google Play. Just because an app is on Google Play, or the App Store, does not guarantee it is harmless, or that it is from the organization it purports to represent, but these official app stores offer the most carefully vetted apps for their respective platforms. 

2. Make sure the app is official.

Never trust mobile banking apps unless they’re clearly linked from a financial institution’s official website. Alternately, from the relevant app store, the author link should lead to the bank’s (or financial institutions') official website. 

3. Don’t give out financial details unless it’s absolutely necessary.

Mobile users should protect their data and banking details at all times. Also, it is important to question whether an application really requires administrator privileges to do its job. If not, customers should contact their bank to confirm that they’re using the right application. 

4. Consult the reviews.

Usually, apps viewable in the App Store or through Google Play will include reviews from users who’ve already downloaded and used the app. Large organisations will gain plenty of reviews for their apps, due to their high download rate, so steer clear of apps with low numbers of user reviews and feedback, or none at all. Also, avoid those that received positive reviews immediately after release, but then mainly have negative reviews. Sometimes, hacked users will post complaints, or warnings, in-app review sections. Look for ratings, reviews, and the number of downloads before installing an app. 

5. Update and secure devices.

The best way to protect mobile devices from the effects of scam apps is to use a high-quality, reliable security solution.

Effective security services are specifically developed and updated to combat the latest and most advanced cybersecurity threats, and complement device owners’ attempts to carefully and cautiously install and download apps onto their mobile devices.  FitzGerald says, “Mobile users can never be too careful when engaging in online banking activity.

“Ultimately, it’s best to be preventative rather than reactive, and know how to spot the signs of untrustworthy apps, rather than paying the financial and time-consuming consequences when it’s too late.” 

Story image
Dark net vendors wanting Bitcoin payments for unverified COVID-19 vaccines
As the medicines are being offered on the dark net, purchasers have no way of knowing whether they are genuine, according to Check Point.More
Story image
Sophos named a Numbering Authority in CVE programme
The programme, which runs an open data registry of vulnerabilities, enables programme stakeholders to correlate vulnerability information used to protect systems against attacks. More
Story image
Check Point exposes Android malware vendor using dark net to rebrand products
Check Point security researchers have exposed an Android malware vendor using a marketer on the dark net to rebrand its products, with the intention of supercharging business and throwing off security vendors. More
Story image
As digital transformation grows in A/NZ companies, misconceptions about their role in cloud security abound
While an 81% majority of A/NZ organisations are accelerating their digital transformation, a giant 99% of surveyed respondents say they believe their cloud security provider provides enough protection, according to a Trend Micro study. More
Story image
Hornetsecurity acquires Altaro, the latest in acquisition spree
The move is a culmination of a medley of acquisitions made by Hornetsecurity recently, following the January 2019 acquisition of Spamina, a Spanish cloud email security company, as well as EveryCloud, its British market partner, in early 2020.More
Story image
Fortinet promises free cybersecurity training until skills gap trend reverses
"We are committed to continue offering the entire catalogue of self-paced Network Security Expert training at no cost until we see the skills gap trend reverse."More