Babu Lal’s Post

The role of Request to Pay solutions in mitigating APP fraud https://bit.ly/3WLv9cN

The role of Request to Pay solutions in mitigating APP fraud https://bit.ly/3WLv9cN

The role of Request to Pay solutions in mitigating APP fraud https://bit.ly/3WLv9cN

The role of Request to Pay solutions in mitigating APP fraud https://bit.ly/3WLv9cN

The new APP fraud rules have been shaking things up for PSPs. In our latest article, we cover the basics that both PSPs and customers need to know. https://lnkd.in/ezcYwkUa

Every 10 minutes, a mobile phone is stolen in London, placing personal and financial information at significant risk. Highlighted by a recent Financial Times article and further underscored by personal stories from neighbors, this surge in mobile thefts has prompted us to examine the security features of iOS and Android aimed at helping against device theft. We also explore a concerning attack scenario targeting the Monzo Bank mobile app, where we suspect that a 'Mechanical Turk' method may be employed for face recognition during the PIN recovery process. Could this human factor be a weak link in what should be a robust security chain? We're eager to hear your thoughts. Please share your insights in the comments below. Attention Monzo Users: We strongly recommend enabling AppLock in the App Settings to further protect your account. #mobilesecurity #mobiletheft #pentesting #applicationsecurity https://lnkd.in/eYC9jzYv

To my friends who are iPhone users, especially those in London where phone thefts are a concern: I highly recommend enabling the new 'Stolen Device Protection' security feature. Set it to 'Always' to ensure your device is safeguarded. This feature is available in iOS 17.3 under: Settings > FaceID & Passcode > Stolen Device Protection.

🔎 Authorised Push Payment (APP) fraud is a complex challenge that can't be solved by simply finding a loophole, fixing a vulnerability, or adding more authentication layers. When an illegitimate transaction is identical to a real one, and the victim unknowingly consents, preventing it becomes a game of Cluedo. So, who’s able to solve it, and how? As UK banks and Financial Service Providers (FSPs) are legally obliged to reimburse customers, they often bear the responsibility of prevention, despite it originating out of house. Via partnership with third parties, banks often utilise data insights which indicate when a transaction is legitimate or not. This includes monitoring the behaviour of the victim, such as erratic mouse movements or lengthy time spent on certain pages, as well as details about the mobile device being used. Preventing APP fraud isn’t just about technology and data; it requires a comprehensive approach involving industry-wide collaboration, continuous customer education, and adaptive regulatory frameworks. At TMT we can't remove scam adverts on Google, but we can provide Mobile Intelligence to spot signs of APP fraud, reach out to us to set up a trial: https://hubs.li/Q02M8Zzz0 #APPFraud #Banks #FSP #PSP #SocialEngineering #DataInsights #MobileNetworkData #MobileIntelligence

Every 10 minutes, a mobile phone is stolen in London, placing personal and financial information at significant risk. Highlighted by a recent Financial Times article and further underscored by personal stories from neighbors, this surge in mobile thefts has prompted us to examine the security features of iOS and Android aimed at helping against device theft. We also explore a concerning attack scenario targeting the Monzo Bank mobile app, where we suspect that a 'Mechanical Turk' method may be employed for face recognition during the PIN recovery process. Could this human factor be a weak link in what should be a robust security chain? We're eager to hear your thoughts. Please share your insights in the comments below. Attention Monzo Users: We strongly recommend enabling AppLock in the App Settings to further protect your account. #mobilesecurity #mobiletheft #pentesting #applicationsecurity

New Fraud Just Dropped: Mule Herding. 👇 Your mobile device could be moving money for criminals without you even knowing about it. Here's how it works. 👉 You download an app like "PDF viewer." These apps often have fake reviews on the Google Play store and 100,000+ downloads. They are easy to download, but they take advantage of Operating System Exploits. 👉 The malicious app installs a keylogger. This helps to capture login credentials and perform an account takeover via a wallet, banking app or service. 👉 Yesterday, I gave the example of Antasa and how its request for SMS and accessibility options can be exploited to directly attack mobile banking apps. Most commonly, this simply steals users' funds. 👉 However, industry professionals have also reported criminals are using the attacked accounts to layer and place funds without the victims being aware. Doing this with 1,000s of user accounts without them being aware it was happening. The scale, and lack of control led to the term "mule herding." The consequences of this can be hugely significant for individuals. 🐟 Always pay attention to your device permissions, especially if an app asks for Accessibility options. Never download apps that aren't from companies you've heard of. Don't blindly trust an app with tens of thousands of reviews, as it may be a bootloader that will silently download a bot on your device in a future update. 🐟 All banking apps and wallets should screen user behavior to ensure the typing and other biometric behavior pattern is natural and consistent with a human instead of a bot. Often these “mule herding” apps will harvest credentials via a lookalike banking app and then replay them on the real one. 🐟 It would be a huge help if all app stores ensured malicious apps were removed and added step up security when additional device permissions were requested. #fraud #aml #moneylaundering