In recent years the global payment landscape has undergone a seachange. Gone are the days where financial transactions impacted only core and branch banking. In the last few years, fintechs have opened previously unimaginable avenues for individuals and businesses alike. Fueled by the mobile revolution, the financial vocabulary has grown to include tablet banking, mobile banking, e-wallets, micro-ATMs, virtual cards, value-added services and more.

Regulatory interventions and innovations by fintech startups have paved the way for a cashless ecosystem. Many nontraditional players have introduced cutting-edge, disruptive products into the market that aim to enhance the customer experience.

But where does this leave security?

Financial Transactions Under Threat

The financial system (especially banking) has traditionally been robust and military-grade. However, stakeholders still need to stay a step ahead of evolving cybercriminal tactics. Some of the most complex cyberattacks target customers through their computers, software, mobile devices, hardware, ATMs, banking institution databases, switches and more.

In short, attackers are after your hard-earned money. Incidents like the high-profile 2016 SWIFT banking network heist, as well as similar attacks in Vietnam, Brazil and other countries, highlight the increasing threat of spear phishing. Many of these phishing campaigns are difficult to detect because they lack files and (once injected) cannot be traced by antivirus tools.

There is also a growing trend whereby threat actors obfuscate their code so security researchers cannot reverse engineer it. In fact, the code is so smart it actively checks whether it is being run in a sandbox and refuses to operate in virtual environments.

Emerging Application Security Risks

Emerging mobile threats often exploit inherent functions of the target system. For instance, Android devices have a feature that allows users to bring any notification to the top while using other apps. Malware authors have devised a code that can intercept this action with an overlay — tricking users into sending their information to threat actors.

Similarly, many fake apps contain hidden banking Trojans. Although the Google Play Store took down hundreds of malicious apps last year, new threats will almost certainly emerge from this vector. Also, many online video services display messages prompting users to download and install malware-riddled software. When these malicious apps are downloaded onto devices that also contain banking apps, the user’s financial information is then exposed.

For these reasons, mobile users must be extremely careful to protect their devices and only conduct financial transactions over secure Wi-Fi connections. Since high volumes of users typically connect to public Wi-Fi, these networks are prime targets for cybercriminals.

No One Is Spared

The larger problem here? Data breaches are becoming commonplace. In fact, virtually no organization — including large corporations with numerous security and compliance certifications — has altogether avoided data compromise.

To make matters worse, many people use a single set of login credentials for multiple accounts and cybercriminals have tools that can check websites for reused passwords. This means that if fraudsters manage to expose one set of credentials, they can compromise many other accounts belonging to that user.

Many cybercriminals also run scripts that intercept SMS authentication codes and use Trojans to redirect calls from banking institutions. This enables threat actors to impersonate legitimate users and conduct fraudulent transactions on their behalf.

Are You Empowered to Protect Your Financial Data?

In today’s volatile mobile ecosystem, which features multiple versions and operating systems, each device its own set of vulnerabilities. Surprisingly, some of these vulnerabilities were disclosed years ago and have yet to be patched. As a result, something as simple as an SQL injection can give attackers unfettered access to sensitive databases.

When dealing with money — despite the robust cybersecurity capabilities of banks and payment services — it is incumbent upon individual users to protect their credentials and personal information. This means creating strong, unique passwords, implementing protections like multifactor authentication and keeping abreast of basic security best practices to stay one step ahead of the increasingly sophisticated mobile threat landscape.

Read the white paper: Worried about mobile security? You should be