12 October 2023
Mobile Banking Scams and How Regulators Are Evolving to Secure Mobile Banking
With the rapid advancement of technology, mobile banking has become an integral part of our daily lives. However, this convenience comes with its own set of risks, especially in the face of increasing mobile banking malware.
In Singapore, more than $8 million was lost in the first half of the year in over 700 malware-related scams. In nine of these scams, CPF savings were involved, resulting in losses of at least $335,000. Victims were tricked into downloading malware onto their phones, resulting in unauthorized transactions from their bank accounts.
So how does mobile banking malware work? And what are governments and regulators doing about the issue? Let’s take a closer look.
Understanding Mobile Banking Malware
Mobile banking malware employs sophisticated tactics to deceive users and gain unauthorized access to sensitive information. These scams typically start with phishing links distributed through emails, SMS messages, or disguised as QR codes. Once clicked or scanned, these links lead users to fake banking pages that appear genuine, compelling them to download what is presented as a companion app but is in reality, malicious software or malware.
Once the malware is installed on the user's device, it scans for banking apps and imitates them to capture login credentials and One-Time Passwords (OTPs). This seamless overlay of the legitimate banking app's login screen allows the malware to intercept and authorize transactions, transferring money out of the account undetected.
Some malware also possess features like remote control and screen sharing to aid in its fraudulent activities.
How Regulators Are Evolving to Secure Mobile Banking
In response to the surge in malware-related scams, regulatory bodies worldwide are mandating various security measures for both traditional and digital-only banks. Here’s what Malaysia and Singapore have done so far.
Reserve Bank of Malaysia
The Reserve Bank of Malaysia published the Risk Management in Technology (RMiT) document, which outlines the Bank's requirements for financial institutions' management of technology risk. It specifies the control measures on mobile applications and devices.
1. A financial institution should ensure digital payment, banking and insurance services involving sensitive customer and counterparty information offered via mobile devices are adequately secured. This includes the following:
- Ensure mobile applications run only on supported and secure versions of operating systems.
- Design mobile applications to operate in a secure and tamper-proof environment. The mobile application should be prohibited from storing customer and counterparty information used for authentication with the application server such as PIN and passwords. Authentication and verification of unique key and PIN should be centralised at the host.
- Undertake proper due diligence processes to ensure the application distribution platforms used to distribute the mobile application are reputable.
- Ensure proper controls are in place to access, maintain and upload the mobile application on application distribution platforms.
- Activation of the mobile application should be subject to authentication by the financial institution.
- Ensure secure provisioning of the mobile application to the customer’s device by binding the app to the customer’s profile such as device ID and account number.
- Monitor the application distribution platforms to identify and address the distribution of fake applications.
2. A financial institution should also ensure the following measures are applied specifically for applications running on mobile devices used by the financial institution, appointed agents or intermediaries for the purpose of processing customer and counterparty information:
- Mobile devices must be adequately hardened and secured.
- Ensure any data stored in the mobile device can be automatically wiped if the device is reported stolen or missing.
- Establish safeguards that ensure the security of customer and counterparty information (e.g. Primary Account Numbers (PAN), Card Verification Value Numbers (CVV), expiry dates and Personal Identification Numbers (PIN) of payment cards), including to mitigate risks of identity theft and fraud.
- Enforce masking of sensitive customer and counterparty information when displayed on mobile devices.
- Limit the storage of customer and counterparty information for soliciting insurance businesses on mobile devices to 30 days.
Monetary Authority of Singapore (MAS)
The Monetary Authority of Singapore (MAS) regulates and supervises over 150 deposit-taking institutions, including full banks, merchant banks, and finance companies. To address mobile banking security, MAS issued revised Technology and Risk Management Guidelines in 2021.
Security measures for securing mobile applications are as follows:
- Avoid storing or caching data in the mobile application to mitigate the risk of data compromise on the device
- Protect private cryptographic keys.
- Implement anti-hooking or anti-tampering mechanisms to prevent injection of malicious code that could alter or monitor the behaviour of the application at runtime.
- Implement application integrity checks (e.g. using checksum and digital signature) to verify the authenticity and integrity of the application and code obfuscation techniques to prevent reverse engineering
- Implement certificate or public key pinning to protect against Man-in-the-Middle Attacks (MITM).
- Implement a secure in-app keypad to mitigate against keystroke-capturing malware.
- Implement device binding to protect against software token cloning.
Security for mobile banking applications must be as dynamic and intelligent as the threats it seeks to combat. Does your organization need help with mobile security? Get in touch to see how we can help.
