Insecurity of phone banking

[IvanV]

Phone snatcher took £21,000 from banking apps (BBC News Article)

The victim says that his banking apps were both face id and password protected, and he can't work out how the thief got in. I think it has been shown that face id can be broken with a photo of the subject. And probably a password reset got past the password, as you can when you are also into the email system for the reset. It makes me grateful my office has forced me to have pin protection on my emails on my phone. With your phone, the thief probably has the second factor to undermine any 2-factor verification.

I have an acquaintance who is an IT security expert. He has a higher degree in it. He's one of these people who can demonstrate how insecure a client's computer system is by showing them how quickly and easily he broke into it, and found and got into all the really sensitive stuff. He tells me that having a banking app on your mobile phone is just inherently insecure and you shouldn't do it. Taking his advice, I don't. But it doesn't seem to be well known, as so many people do it. They probably think that if it is available, it ought to be safe enough. But my acquaintance says it isn't.

That doesn't mean that plain banking is secure either. Twice someone has managed to carry out several client-absent just-under-£10k transactions using my payment card number to drain large sums of money. The two incidents added up to over £100k. In my case, the bank gave it all back very quickly and without argument, as they were quite clearly failing to confirm obviously suspicious transactions and let them carry on until it became, very, very obvious they shouldn't. The policeman who talked to me about the second, larger, incident was quite rude about the bank, and said it was the largest case he'd seen all year. But he also said that as all the transactions involved moving money through several other financial institutions, my bank would get the money back off the next company in the chain, and someone else would be left holding the loss. It doesn't help that when the bank does attempt to contact me, as it did in relation to a later third attempted theft, it had several features that made it sound just like a scam call. Fortunately, after I'd put the phone down, I called them to check. And that meant that when I did have a scam call of just that kind a couple of days ago, with similar features, I had to phone the bank again to confirm.

[lpm]

No reason to go to the inconvenience of not having a phone app. The banks are liable and stolen money is refunded.

[IvanV]

No reason to go to the inconvenience of not having a phone app. The banks are liable and stolen money is refunded.

The article quoted says the victim has had £14,000 of the £21,000 refunded straightforwardly. But the other £7,000 was taken in a different way from another bank, who are still arguing about it. We do hear quite often of banks arguing the toss, and finding excuses not to pay, just like insurance companies.

My own thefts were not without consequence. My bank reduced the transaction limit on my card and on-line from £10k to £1.5k for 5 years. That was occasionally a nuisance. Larger purchases, transfers to savings accounts, became hard work. But I was also quite grateful, as it reduced the level of peril I might feel. Even though it was actually to save the bank from itself.

[Stranger Mouse]

Has anyone got any more info on the insecurity of banking apps? I use an app on iPhone and always got the impression it was reasonably safe

[shpalman]

... an IT security expert... tells me that having a banking app on your mobile phone is just inherently insecure and you shouldn't do it.

Experts in things always say stuff like that.

I note that Google Pay doesn't trust the phone if it's only been unlocked by Face ID, and asks for my fingerprint before I can use it to pay.

Similarly, my banking app asks for extra verification on doing anything sensitive, and indeed my banking app is the second authentication factor for anything I do via the browser on my PC.

[Stranger Mouse]

... an IT security expert... tells me that having a banking app on your mobile phone is just inherently insecure and you shouldn't do it.

Experts in things always say stuff like that.

I note that Google Pay doesn't trust the phone if it's only been unlocked by Face ID, and asks for my fingerprint before I can use it to pay.

Similarly, my banking app asks for extra verification on doing anything sensitive, and indeed my banking app is the second authentication factor for anything I do via the browser on my PC.

I always prefer using fingerprint as default. I’m sure it’s not perfect but I haven’t seen any scary videos about fingerprint security issues like I have facial recognition where two people in the same ethnic group get told they’re identical

[Lew Dolby]

Personally, wouldn't use an app for something like bank acccess.

We bank online but our bank (Co-op) recommends not even having he bank website bookmarked and always type in the site name in full each time we want to access it.

[Beaker]

My banking app requires additional biometric to set up a new payee. It needs live video image of my face in an evenly lit space, so I would be surprised if it was easy to fool with a photo.

[Trinucleus]

No reason to go to the inconvenience of not having a phone app. The banks are liable and stolen money is refunded.

Don't forget the inconvenience of the people behind you in the supermarket queue while waiting for you to find and activate the loyalty app, then close that and open the banking app to pay.... compared to the ten seconds it takes to pay by contactless card

[dyqik]

No reason to go to the inconvenience of not having a phone app. The banks are liable and stolen money is refunded.

Don't forget the inconvenience of the people behind you in the supermarket queue while waiting for you to find and activate the loyalty app, then close that and open the banking app to pay.... compared to the ten seconds it takes to pay by contactless card

That's got nothing to do with this, and is down to basic incompetence.

[philbo]

I always prefer using fingerprint as default. I’m sure it’s not perfect but I haven’t seen any scary videos about fingerprint security issues like I have facial recognition where two people in the same ethnic group get told they’re identical

There was a *very* good Mythbusters (at least ten years ago) where they fooled a bunch those fingerprint readers who claimed only to work when the correct (and real) finger was present. Haven't seen anything recent regarding the tech being much better, though. It's the same principles only much quicker & less flaky hardware.

So many face recognition apps similarly claim not to work from a photo, but fail. I don't use face recognition, ever, because it's simply not robust enough.

Banking app needs FP + PIN to authorise a new payee, so I'm keeping the two factors, but if I were to lose my phone, I think I'd be contacting the bank without

[monkey]

There was a *very* good Mythbusters (at least ten years ago) where they fooled a bunch those fingerprint readers who claimed only to work when the correct (and real) finger was present. Haven't seen anything recent regarding the tech being much better, though. It's the same principles only much quicker & less flaky hardware.

I can't remember if I saw the Mythbusers do it or not, but the one I saw involved gummy bears. You get to eat the evidence after! And I don't think it would work on all types of scanner. I imagine the technology has got better in the last 10 years or so too. Even if it's just better resolution it would be better at detecting a fake.

But stealing your fingerprint to make a fake finger as well as your phone/computer seems like a pretty unlikely crime. I imagine any thief would *really* want to get access to *your* stuff to go to that trouble. I assume that none of us here are that important, I'm not.

Edit: Someone might force you to unlock you phone/app, e.g. a mugger, but that tool works the same for any type of lock.

[Fishnut]

My fingerprint stops working properly if I've been gardening too much and have f.cked up my hands. I'm pretty comfortable using my phone for banking with fingerprint. It requires verification whenever I want to do anything atypical, such as setting up a new payee, and that's a password.

[philbo]

There was a *very* good Mythbusters (at least ten years ago) where they fooled a bunch those fingerprint readers who claimed only to work when the correct (and real) finger was present. Haven't seen anything recent regarding the tech being much better, though. It's the same principles only much quicker & less flaky hardware.

I can't remember if I saw the Mythbusers do it or not, but the one I saw involved gummy bears. You get to eat the evidence after! And I don't think it would work on all types of scanner. I imagine the technology has got better in the last 10 years or so too. Even if it's just better resolution it would be better at detecting a fake.

Gelatin (from gummy bears or wherever) makes a fake print that pretty much no reader can tell from an actual finger: the variation in properties between fingers makes it very difficult to exclude materials that have very similar properties.

Last I looked (three years ago), there were no new fingerprint ideas, just refinements to what was there when I was working with fingerprints 20 years ago. Better resolution, much faster, obvs.. the software probably tries to discern fakes, but I don't what it could do to prevent a read from a fake print

[dyqik]

None of these systems are supposed to be absolutely secure on their own. The idea is that they provide one layer of security that prevents, or makes difficult, one form of attack.

Passwords are one layer - a good password requires so many attempts that the attempt to break in is obvious - just as someone trying a million different keys in your front door would be obvious.

Biometrics of one kind or another are a different kind of password/key, with the advantage that the user doesn't know the exact form of the key, and so can't divulge it (you don't know what features in your face or fingerprint that the software is looking for.

2FA is a different kind of key, that requires a device registered to the cellphone network or other similar actively connected token authority - which will disappear if you report the device stolen or lost.

The net result is the that risk to banks from taking on the liability of break ins is small. And that means that they can cover things.

[Grumble]

The guys who really want to have good security, the credit card thieves selling details on the dark web, use 3FA. I assume the banks have decided that the extra level of inconvenience wouldn’t help their bottom line.

[Sciolus]

No reason to go to the inconvenience of not having a phone app. The banks are liable and stolen money is refunded.

... by their customers. I would rather banks didn't spend my money giving it to crooks through sh.tty security practices but spent it on giving me a decent service and maybe some interest.

Also, when you give money to crooks, they don't just spend it on a nice new telly, they use it to fund larger crimes.

I don't let my phone anywhere near my bank account.

[bjn]

Unfortunately my bank insists on using a banking app on my phone to verify my login on a web browser.

[nekomatic]

It would be good to find out how this exploit worked - presumably not using a photo or a fake fingerprint, since the phone seems to have been snatched opportunistically - but I’m guessing it involved the phone being unlocked when snatched and kept unlocked so the thief could see password reset emails or texts, so if you had a means to remotely lock your phone you’d want to do that as fast as possible. On iPhones everyone in your ‘family’ should appear in the Find My app, and you can set their devices as ‘lost’ there.

[shpalman]

My phone recently gained the feature to detect being "snatched" and lock itself.

[Martin Y]

My phone recently gained the feature to detect being "snatched" and lock itself.

That's rather a neat idea. Not much inconvenience from a false trigger I guess, you just unlock it again.

[IvanV]

My phone recently gained the feature to detect being "snatched" and lock itself.

What does it actually detect? Acceleration? It associates some pattern of acceleration with being snatched?

Fingerprints are a problem for older people. Neither my wife nor I use them, as they would be a problem. And we aren't even at retirement age yet, and my wife is several years younger. My wife's are just too worn. I'm not sure why she has worn hers out. Mine not so badly worn, but I have very numerous secondary creases, which in combination with the fingerprint wear seems to be an issue. The secondary creases tend to change over relatively short time periods, indeed even with the weather. I wonder if cycling might be the cause.

[shpalman]

My phone recently gained the feature to detect being "snatched" and lock itself.

What does it actually detect? Acceleration? It associates some pattern of acceleration with being snatched?

https://blog.google/products/android/an ... rotection/

[headshot]

How to protect an iPhone: https://www.instagram.com/share/_z8atPVEq

[shpalman]

... an IT security expert... tells me that having a banking app on your mobile phone is just inherently insecure and you shouldn't do it.

Experts in things always say stuff like that.

For example: https://x.com/LNuzhna/status/1869697908200898954

Nature just published a piece on why probability doesn't exist.
Lee Cronin said many times chemical reactions are not real.
Your genetics professor probably confessed to you before that there are no genes.
Biologists still disagree on whether cell types are even real.
And we already discussed how there is no such thing as aging.

This summarizes one of my favorite parts of doing science - the longer you stare at your cherished concept, the more it disintegrates and becomes non-existent. Seems to be a universal feeling - struggle to describe reality with words and numbers - experienced by many across fields.

So "IT security expert says IT thing is insecure" falls right into that.