Fake banking apps for CommBank and ANZ were available from the Google Play store for weeks and were installed on phones more than 1000 times, according to a report.
Nick FitzGerald from IT security firm ESET has told The Age:
“The apps use obfuscation, which may have contributed to them slipping into the store undetected.
“This is a big concern for anyone who may have handed over personal information. The loss of personally identifiable information can result in financial fraud that may affect you for the rest of your life very negatively.”
Both banks have issued security advice for customers:
CBA SECURITY ADVICE
Tips on keeping safe when downloading our apps:
– Only install apps from official stores, such as Apple’s App Store or Google Play (for Android phone or tablet).
– Check the name of the publisher before downloading the app.
– Avoid installing apps from links received in an email, social media post, text message or a web page that doesn’t look right. The best way to download an app is to go to the store and download it from there.
– Read user reviews and ratings to assess if an app delivers a good experience.
– Many apps collect and send personal data from your phone, including your location and contacts. Keep on top of this by reviewing and managing permissions for each app. On an iOS device, this can be done under the ‘Settings > Privacy’ function. On an Android device, you can find them under ‘Application Manager’.
– Read the terms of any app looking to access your contacts, location or other personal information when you log in using a third party service (such as Facebook or LinkedIn).
– If a customer notices an unusual transaction on their account, they should contact us on 13 2221 immediately to report it.
– Our apps are published from “Commonwealth Bank of Australia” or “CommSec”. MasterCard publishes two apps for business merchants, “CommBank Simplify Controls” and “CommBank Simplify Payments”, on our behalf.
ANZ SECURITY ADVICE
Customers should always check the following before to downloading a new app:
– Check the popularity of the app: thousands of downloads and very few reviews suggests a fake app.
– Check the name of the app or developer and reviews: minor errors in the name, inconsistency with ANZ products or suspicious comments may indicate the app is a fake.
– Check the pattern of reviews including time frames from app launch to commentary: reviews in quick succession of launch are a red flag.
– If in doubt, go to the web page of the developer: lack of details about the developers, and linkage to a legitimate site is another indicator.
– Check that the permissions required by the app are in line with activities you will be performing: if the permissions seem excessive this is another red flag.
– If a customer believes they have downloaded a fake ANZ app please contact us immediately on 1800 033 844
– If they suspect a fake ANZ app is available on Google Play or on the App Store, they should contact hoax [at] cybersecurity [dot] anz [dot] com
– Information on the latest security alerts can be found on ANZ.com — https://www.anz.com.au/security/fraud-detection/latest-security-alerts/
. @ANZ, @CommonwealthBank app scam: Thousands download fake versions https://t.co/lUBV1yzx09 #finserv #security pic.twitter.com/gIPzvwOqiu
— Mark Donohue (@Mark_BankingCX) September 20, 2018
