A survey released in mid-May by bank technology provider FIS found that 31% of banked US respondents intend to do more online and mobile banking in the future. — Dreamstime/TNS
More bank customers discovered they like the convenience of mobile banking as branches temporarily closed during the pandemic, and evidence suggests the behaviour stands to stick.
A survey released in mid-May by bank technology provider FIS found that 31% of banked respondents intend to do more online and mobile banking in the future.
But is this a safe way to conduct bank business? The FBI recently warned that hackers could exploit new mobile banking customers by using several techniques, including app-based banking Trojans and fake banking apps. Here are some of the risks and the steps you can take to reduce them.
Is mobile banking safe?
Mobile banking is both convenient and safe, say cybersecurity experts, but consumers need to take certain precautions.
“If you download the mobile app from a secure store, that is just as safe as visiting a bank branch,” says Paul Benda, senior vice president of risk and cybersecurity policy at American Bankers Association.
As he sees it, the best place to download an app is from your bank’s website, which provides the right link to the institution’s app.
“Banks use extremely secure, high-end encryption technologies,” Benda says. “We like saying that mobile apps are like having a bank branch in your pocket.”
Watch out for these cyberattack types
There are myriad ways that fraudsters directly target consumers but the FBI’s public service announcement describes two forms of cyberattacks in particular:
1. App-based banking Trojans are hidden in unrelated apps such as games or tools that are downloaded by unsuspecting consumers. These “sideload” apps, which are downloaded from unofficial sources, could conceal malicious programs that lie dormant until a user launches a legitimate banking app. Then the Trojan springs to life, creating a pop-up overlay that mimics the bank’s login page. Once consumers enter their username and password, they are seamlessly passed on to the legitimate banking app login page and don’t even know they’ve been scammed.
“The malware can be downloaded in a variety of ways, such as SMS (short message service, or text) with a malicious hyperlink,” says Teresa Walsh, global intelligence officer at Financial Services Information Sharing and Analysis Center, or FS-ISAC, an industry consortium focused on reducing cyber-risk in the global financial system. “This type of malware is actually on sale on the criminal underground marketplace.”
2. Fake banking apps are another major threat. They look like the real apps of major banks, and they’re designed to trick users into entering their login credentials. According to the FBI, this hacking technique represents “one of the fastest growing sectors of smartphone-based fraud”.
Should you use a mobile banking app?
If you’re worried about using a mobile banking app, be aware that security threats exist everywhere, including inside the bank lobby.
“There is the risk that the bank employee will do something that is illegal, like stealing your banking information – this is known as an insider threat,” says Donald Korinchak of CyberExperts.com.
With a mobile app, Korinchak says “there are potential vulnerabilities related to the security posture of the app itself – vulnerabilities in code, encryption methods, etcetera – and also potential vulnerabilities related to the transmission of information”.
Here’s the good news: “In both scenarios, the bank invests heavily to ‘bake in’ security,” Korinchak says. Financial institutions monitor their employees’ behaviour and also look for vulnerabilities in their app that can be patched before they are exploited by criminals.
There are also precautions you can take to reduce the risk.
Tips on how to make mobile banking more secure
1. Download a verified banking app via your bank’s website.
Many banks feature links to the app stores from their websites to help you download the right app. “Your bank should have available information on what type of mobile app they use, what features are on it and what you need for access to it,” FS-ISAC’s Walsh says. “Then, use a reliable app store, paying attention to the owner/developer of the app and whether there are other apps with the same name.”
Confused? Talk to your bank to make sure but never download an app found on an open forum.
2. Make sure your bank uses two-factor or multi-factor authentication.
Two-factor authentication requires customers to use not only a password or PIN to login to their account, but also a second way to confirm their identity, such as duplicating a code that had been sent via text message to their cellphone.
As Korinchak sees it, two-factor authentication vastly increases security, but isn’t 100% secure.
“Someone could gain access to your phone or someone could intercept the SMS traffic to gain access to the code,” Korinchak says.
3. Use a strong password.
One of the best ways to protect yourself is to use a password that contains random upper and lower case letters, numbers and symbols. Don’t ask your browser to remember it for you either; use a reputable password manager instead.
“Reputable password managers are coded in a way that reduces risk to the user and are highly hardened against potential attackers,” Korinchak says. “Most cyber security experts recommend password manager software.”
4. Avoid using public WiFi.
When you log onto a public WiFi hotspot, you often get a warning that you’re not on a secure network, and that others may be able to watch your online actions. That’s a strong reason not to conduct any financial business using a public network. Instead, use your cellular network or your home WiFi to better protect your personal information.
5. Practice phishing/smishing awareness.
Phishing emails are where scammers attempt to manipulate recipients into divulging personal information, while smishing scammers use such bait in text messages.
“Users should be familiar with their banking application in the first place to detect abnormal questions or pop-ups that look slightly different than the usual features,” Walsh says.
6. Set up alerts via email, text or the bank’s app.
This quick notification helps the consumer to detect potential fraudulent activity, which can then be addressed with your bank in a timely manner.
How banks and financial institutions protect the consumer
Banks, credit unions and investment firms are investing heavily to thwart these cybercriminals.
Last year, JPMorgan Chase CEO Jamie Dimon announced that his firm alone spent nearly US$600mil (RM2.50bil) on cyber defenses, calling the threat of cybersecurity quite possibly “the biggest threat to the US financial system”.
“I think it's safe to say banks spend billions to protect customer accounts,” says ABA’s Benda.
“Banks have very robust controls in place to control fraudulent activity,” says Benda, but the weak link is the consumer. “A lot depends on consumer behaviour, making sure consumers follow safe practices.”
Bottom line
Banks are doing what they can to mitigate mobile banking app security, but consumers also need to take precautions to protect themselves. – Bankrate.com/Tribune News Service
Did you find this article insightful?
100% readers found this article insightful
