Fraudsters are constantly finding new ways to exploit vulnerabilities in the banking system, and one of the latest tactics involves stealing credit card information via mobile banking apps.

This type of attack has been seen in different variations in Spain and North America and was reported for the first time at the beginning of 2023. As fraudsters use stolen credentials to commit e-commerce fraud, here’s what banks and customers must keep in mind to stay safe.

The modus operandi

Step 1: Stealing credentials

Fraudsters start by stealing the login credentials and the phone number of banking customers. They typically accomplish this through phishing or smishing.

Step 2: Enrolling a phone

Equipped with the stolen credentials and the victim’s phone number, fraudsters enroll their own phone to receive future one-time passwords (OTPs) and push notifications. This is done by logging into the mobile banking app and following the enrollment process. To authenticate this action, they impersonate a banking employee and call the victim under a pretext to receive the OTP.

Step 3: Opening a neobank account

Next, fraudsters open an account with a neobank, where they automatically receive a prepaid card. This can be done quickly and easily because of lax controls in identity verification and background checks.

Step 4: Charging the prepaid card

Fraudsters then charge the prepaid card with a simple credit card transaction. They can access the victim’s credit card details via the banking app and generate a dynamic CVV. To approve this transaction, they receive a push notification to the phone that they enrolled in earlier.

Case study: Spanish retail bank

In February 2023, a Spanish retail bank reported that approximately 20 of their accounts had been compromised using this type of attack.

The bank turned to IBM Security Trusteer for help. IBM Security Trusteer’s Pinpoint Detect can monitor for risky actions, such as changing passwords and phone numbers or enrolling a new device by analyzing the user journey (URL data). It can integrate this information as part of its transactional risk assessment on the online channel.

However, the fraudsters gained access to the accounts via the mobile banking application, where Pinpoint Detect (PPD) does not collect URL data. As such, PPD does not have visibility into the actions performed in the account, such as generating a dynamic CVV or other high-risk activities.

For this type of attack, IBM Security Trusteer requires visibility into the user journey and risk assessment at the right time to effectively and efficiently block the fraud.

To address this challenge, IBM presented two potential solutions to the customer.

The first solution involves the customer calling the Pinpoint Detect application programming interface for standard transactional assessment whenever the fraudster generates the dynamic CVV and sending extra information about the action to IBM as a custom data field. Custom data can be shared by any customer and integrated into the risk assessment.

The second solution implements a new policy assessment point that could be called whenever a user generates the dynamic CVV. This solution provides visibility into high-risk actions and granularity for risk assessment. It also allows high-risk actions to be flagged outside of transactional monitoring.

After evaluating the options, the customer and IBM Security Trusteer agreed to implement the second solution, which provided faster and more accurate fraud coverage.

In the following month, the IBM deployment team created the new invocation point, or “activity,” and integrated it with the risk assessment infrastructure. The customer then tested the activity, and the IBM Security Trusteer Fraud Analytics team tuned and monitored the relevant rules and deployed the policy to production.

Within a month of deployment, the customer confirmed over 45 accounts had been compromised. This demonstrates the effectiveness of the IBM Security Trusteer solution in detecting and preventing account takeover fraud through the mobile SDK.

Taking steps to combat fraud

As banks have developed effective transactional monitoring strategies, fraudsters have evolved their tactics to perform e-commerce fraud instead of traditional transactional fraud. More and more banks allow their customers to fully manage credit cards via a mobile banking app, putting them at risk of e-commerce fraud. By working with IBM Security Trusteer and implementing additional technologies, banks can stay ahead of the curve and better protect themselves and their customers from fraud.