Fraudsters are constantly finding new ways to exploit vulnerabilities in the banking system, and one of the latest tactics involves stealing credit card information via mobile banking apps.

This type of attack has been seen in different variations in Spain and North America and was reported for the first time at the beginning of 2023. As fraudsters use stolen credentials to commit e-commerce fraud, here’s what banks and customers must keep in mind to stay safe.

The modus operandi

Step 1: Stealing credentials

Fraudsters start by stealing the login credentials and the phone number of banking customers. They typically accomplish this through phishing or smishing.

Step 2: Enrolling a phone

Equipped with the stolen credentials and the victim’s phone number, fraudsters enroll their own phone to receive future one-time passwords (OTPs) and push notifications. This is done by logging into the mobile banking app and following the enrollment process. To authenticate this action, they impersonate a banking employee and call the victim under a pretext to receive the OTP.

Step 3: Opening a neobank account

Next, fraudsters open an account with a neobank, where they automatically receive a prepaid card. This can be done quickly and easily because of lax controls in identity verification and background checks.

Step 4: Charging the prepaid card

Fraudsters then charge the prepaid card with a simple credit card transaction. They can access the victim’s credit card details via the banking app and generate a dynamic CVV. To approve this transaction, they receive a push notification to the phone that they enrolled in earlier.

Case study: Spanish retail bank

In February 2023, a Spanish retail bank reported that approximately 20 of their accounts had been compromised using this type of attack.

The bank turned to IBM Security Trusteer for help. IBM Security Trusteer’s Pinpoint Detect can monitor for risky actions, such as changing passwords and phone numbers or enrolling a new device by analyzing the user journey (URL data). It can integrate this information as part of its transactional risk assessment on the online channel.

However, the fraudsters gained access to the accounts via the mobile banking application, where Pinpoint Detect (PPD) does not collect URL data. As such, PPD does not have visibility into the actions performed in the account, such as generating a dynamic CVV or other high-risk activities.

For this type of attack, IBM Security Trusteer requires visibility into the user journey and risk assessment at the right time to effectively and efficiently block the fraud.

To address this challenge, IBM presented two potential solutions to the customer.

The first solution involves the customer calling the Pinpoint Detect application programming interface for standard transactional assessment whenever the fraudster generates the dynamic CVV and sending extra information about the action to IBM as a custom data field. Custom data can be shared by any customer and integrated into the risk assessment.

The second solution implements a new policy assessment point that could be called whenever a user generates the dynamic CVV. This solution provides visibility into high-risk actions and granularity for risk assessment. It also allows high-risk actions to be flagged outside of transactional monitoring.

After evaluating the options, the customer and IBM Security Trusteer agreed to implement the second solution, which provided faster and more accurate fraud coverage.

In the following month, the IBM deployment team created the new invocation point, or “activity,” and integrated it with the risk assessment infrastructure. The customer then tested the activity, and the IBM Security Trusteer Fraud Analytics team tuned and monitored the relevant rules and deployed the policy to production.

Within a month of deployment, the customer confirmed over 45 accounts had been compromised. This demonstrates the effectiveness of the IBM Security Trusteer solution in detecting and preventing account takeover fraud through the mobile SDK.

Taking steps to combat fraud

As banks have developed effective transactional monitoring strategies, fraudsters have evolved their tactics to perform e-commerce fraud instead of traditional transactional fraud. More and more banks allow their customers to fully manage credit cards via a mobile banking app, putting them at risk of e-commerce fraud. By working with IBM Security Trusteer and implementing additional technologies, banks can stay ahead of the curve and better protect themselves and their customers from fraud.

More from Banking & Finance

Cost of a data breach 2023: Financial industry impacts

3 min read - According to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was $4.45 million, 15% more than in 2020. In response, 51% of organizations plan to increase cybersecurity spending this year. For the financial industry, however, global statistics don’t tell the whole story. Finance firms lose approximately $5.9 million per data breach, 28% higher than the global average. In addition, evolving regulatory concerns play a role in how financial companies…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

BlotchyQuasar: X-Force Hive0129 targeting financial institutions in LATAM with a custom banking trojan

16 min read - In late April through May 2023, IBM Security X-Force found several phishing emails leading to packed executable files delivering malware we have named BlotchyQuasar, likely developed by a group X-Force tracks as Hive0129. BlotchyQuasar is hardcoded to collect credentials from multiple Latin American-based banking applications and websites used within public and private environments. Similar operations conducted in late 2022 have also been noted delivering an earlier variant of this modified QuasarRAT by likely Spanish-speaking actors. BlotchyQuasar, which X-Force describes as…