In recent years the global payment landscape has undergone a seachange. Gone are the days where financial transactions impacted only core and branch banking. In the last few years, fintechs have opened previously unimaginable avenues for individuals and businesses alike. Fueled by the mobile revolution, the financial vocabulary has grown to include tablet banking, mobile banking, e-wallets, micro-ATMs, virtual cards, value-added services and more.

Regulatory interventions and innovations by fintech startups have paved the way for a cashless ecosystem. Many nontraditional players have introduced cutting-edge, disruptive products into the market that aim to enhance the customer experience.

But where does this leave security?

Financial Transactions Under Threat

The financial system (especially banking) has traditionally been robust and military-grade. However, stakeholders still need to stay a step ahead of evolving cybercriminal tactics. Some of the most complex cyberattacks target customers through their computers, software, mobile devices, hardware, ATMs, banking institution databases, switches and more.

In short, attackers are after your hard-earned money. Incidents like the high-profile 2016 SWIFT banking network heist, as well as similar attacks in Vietnam, Brazil and other countries, highlight the increasing threat of spear phishing. Many of these phishing campaigns are difficult to detect because they lack files and (once injected) cannot be traced by antivirus tools.

There is also a growing trend whereby threat actors obfuscate their code so security researchers cannot reverse engineer it. In fact, the code is so smart it actively checks whether it is being run in a sandbox and refuses to operate in virtual environments.

Emerging Application Security Risks

Emerging mobile threats often exploit inherent functions of the target system. For instance, Android devices have a feature that allows users to bring any notification to the top while using other apps. Malware authors have devised a code that can intercept this action with an overlay — tricking users into sending their information to threat actors.

Similarly, many fake apps contain hidden banking Trojans. Although the Google Play Store took down hundreds of malicious apps last year, new threats will almost certainly emerge from this vector. Also, many online video services display messages prompting users to download and install malware-riddled software. When these malicious apps are downloaded onto devices that also contain banking apps, the user’s financial information is then exposed.

For these reasons, mobile users must be extremely careful to protect their devices and only conduct financial transactions over secure Wi-Fi connections. Since high volumes of users typically connect to public Wi-Fi, these networks are prime targets for cybercriminals.

No One Is Spared

The larger problem here? Data breaches are becoming commonplace. In fact, virtually no organization — including large corporations with numerous security and compliance certifications — has altogether avoided data compromise.

To make matters worse, many people use a single set of login credentials for multiple accounts and cybercriminals have tools that can check websites for reused passwords. This means that if fraudsters manage to expose one set of credentials, they can compromise many other accounts belonging to that user.

Many cybercriminals also run scripts that intercept SMS authentication codes and use Trojans to redirect calls from banking institutions. This enables threat actors to impersonate legitimate users and conduct fraudulent transactions on their behalf.

Are You Empowered to Protect Your Financial Data?

In today’s volatile mobile ecosystem, which features multiple versions and operating systems, each device its own set of vulnerabilities. Surprisingly, some of these vulnerabilities were disclosed years ago and have yet to be patched. As a result, something as simple as an SQL injection can give attackers unfettered access to sensitive databases.

When dealing with money — despite the robust cybersecurity capabilities of banks and payment services — it is incumbent upon individual users to protect their credentials and personal information. This means creating strong, unique passwords, implementing protections like multifactor authentication and keeping abreast of basic security best practices to stay one step ahead of the increasingly sophisticated mobile threat landscape.

Read the white paper: Worried about mobile security? You should be

More from Application Security

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…

A View Into Web(View) Attacks in Android

James Kilner contributed to the technical editing of this blog. Nethanella Messer, Segev Fogel, Or Ben Nun and Liran Tiebloom contributed to the blog. Although in the PC realm it is common to see financial malware used in web attacks to commit fraud, in Android-based financial malware this is a new trend. Traditionally, financial malware in Android uses overlay techniques to steal victims’ credentials. In 2022, IBM Security Trusteer researchers discovered a new trend in financial mobile malware that targets…

Twitter is the New Poster Child for Failing at Compliance

All companies have to comply with privacy and security laws. They must also comply with any settlements or edicts imposed by regulatory agencies of the U.S. government. But Twitter now finds itself in a precarious position and appears to be failing to take its compliance obligations seriously. The case is a “teachable moment” for all organizations, public and private. The Musk Factor Technology visionary and Silicon Valley founder and CEO, Elon Musk, bought social network Twitter in October for $44…