Mobile banking on Android phones could put consumers at risk of fraud and cost banks millions a year. That was the warning from IT security firm MWR InfoSecurity on the final day of the Mobile World Congress, held this week in Barcelona.

MWR Labs, the research arm of MWR InfoSecurity, investigated the security standards of leading Android mobile phone brands to determine the overall exposure to risk of consumers who use mobile devices phones for online banking. Results indicated that on some handsets as many as 64 per cent of manufacturer added applications were exposing users to serious security issues.

Harry Grobbelaar, MWR’s managing director in South Africa, said: “We found that while banking apps were generally well written and had very few security issues, the integrity of consumer phones was often compromised by software provided by the phone manufacturer or additional software added by the network provider, exposing online banking customers to potential fraud. Some of the leading Android handset manufacturers are already looking at shipping mobile devices with native NFC payment functionalities but if the software in the phones is not secure, the risk will then be even higher.”

The increasing number of merchants moving to smartphone based PoS devices, for example using Bluetooth or directly connected chip-and-pin accessories for iPhone or Android, indicates that mobile phones will become a critical element in the payment chain and if not adequately protected, they could introduce additional risks for card fraud that could cost banks millions a year. Grobbelaar commented: "The move by consumers away from PC's for online banking to mobile platforms will inevitably be followed by the criminal gangs who have been successfully targeting online banking for years. We have already seen many examples of malicious apps sending premium rate text messages and expect there will be a natural progression to higher value areas such as payments and banking."

MWR Labs looked at six classes of potential vulnerabilities in apps and packages in the leading brands and mobile phones using a modified version of Mercury, its security testing framework, to automatically scan the devices and identify security weaknesses.

Share Story: