It was reported earlier this month by ‘The Age‘ newspaper that a fake Commbank mobile security app for Android™ is now being seen on the devices of Australian mobile users.
The ‘fake’ app, designed to capture SMS authentication codes and stop phone calls from the bank itself, originate from Russia and have several different variants. This therefore eliminates any two factor authentication in place.
It works by tricking users into installing mobile malware on their PC. Then, when the user logs into their online banking account, the malware projects a page within the browser that appears to be from Commbank, but is actually from a hacker!
The user is then prompted to enter their mobile number and install a ‘new’ mobile app that the bank has recently developed. Potential victims are told the bank has introduced new rules that require the customer to install a ‘special bank certificate’. Without the ‘certificate’, they will be unable to use online banking.
This is a prime example of social engineering, which has taken hold in the online world and continues to be used in many different forms to scam people.
A Commonwealth Bank spokesperson said the bank actively monitors sites promoting malware for Android™ and other mobile platforms, as well as banking sessions for presence of these viruses. The bank also works with CERT Australia and other authorities to try and combat these kinds of threats.
Our advice is to always download apps for their Android™ device from an authorised app store, like Google Play.
Users should also use mobile security applications, such as AVG AntiVirus PRO for Android™ smartphones and AVG AntiVirus PRO for Android™ tablets. These will detect this kind of malware to help keep you safe whilst banking via your mobile device.
Have you been a victim of any ‘fake’ apps on your devices? Leave us your comments in the section below.
