![](https://images.caxton.co.za/wp-content/uploads/sites/22/2015/03/hand-and-cel_560064304.jpg)
According to Zane Renou, from Cellfind, banks should take a proactive approach to securing the vulnerabilities in SIM cards and devices that create opportunities for impostors to defraud customers.
“Internet and mobile banking fraud is on the increase as con artists take advantage of a range of systems and communication channels to pilfer account holders’ information and to access their bank accounts,” said Renou.
“SIM swapping is still perhaps one of the biggest threats, particularly because it lends itself to social engineering or dishonesty by employees in some cases. But other threats are also on the rise such as smartphone malware designed to steal customers’ log-in information and spoofing attacks where hackers produce fake messages or transaction requests so that they can pretend to be someone else.”
Mobile banking fraud
Renou outlined the most common forms of mobile banking fraud and theft as follows:
Eavesdropping: Criminals can eavesdrop on messages since most of these are not encrypted. From these messages, they learn valuable information, for use in their intrusions and attacks.
Smartphones: Because they’re essentially handheld computers, smartphones are vulnerable to malware. Once a hacker has gained control of a smartphone via malware, or by a stolen phone, he or she has access to the account holder’s banking channel.
SIM swaps: Via identity theft or with the collusion of an employee working for a mobile operator or a service-provider company, the fraudster could attain a new SIM card for a user’s cellphone number. This enables the fraudster to, for example, receive one-time PIN codes for online transactions or to use the customer’s mobile banking PIN. Of course the fraudster will need to get the user’s internet banking or banking details first which is usually done through a phishing attack.
Spoofing: Hackers can produce a false USSD request, directing it at a USSD Gateway to masquerade as a user, while cross network roaming means that hackers can gain access to a network while masquerading as a user’s mobile phone roaming on another network. Once hackers gain access to the network, they can make and receive any type of communication on behalf of users.This includes voice, SMS and USSD.
New methods of attack: A recent trend is to combine a SIM swap and network porting. This buys the hackers time as it takes longer to discover the crime and even longer to stop the service across two networks.
“We are extremely concerned about possible future fraud attacks from remote networks. This type of spoofing bypasses the manual processes involved in a SIM swap, so it can be automated,” Renou said.
“The old ways of detecting fraud are constrained and only effective against a small number of attack strategies. The SIM is perhaps the biggest soft spot for criminals’ attacks on user’s bank accounts. There is technology available today, for example ValiPort, which addresses this vulnerability,” said Renou.
These solutions secure mobile financial transactions by validating the authenticity of the originator, and that the handset and SIM card are who they say they are. Renou said through a series of steps, the mobile banking solution can ensure that the risks surrounding spoofing and SIM swapping are effectively exposed and pro-actively managed.
For mobile-originated traffic, the origin of the request is verified when the session starts. This means that spoofs are no longer possible and compromised SIM swapping is a thing of the past. For mobile-terminating traffic such as a PIN number sent to a subscriber via SMS or USSD Push, the destination is similarly verified before the SMS is delivered, effectively reducing the associated risks.