Secure banking – Need of multi-layered security for mobile banking apps in the age of rising cybercrime

By Manish Mimani, Founder & CEO, Protectt.ai

As the digital ecosystem expands, cyber threats have become increasingly sophisticated. Mobile banking apps, integral to India’s financial landscape, face escalating risks necessitating robust, multi- layered security measures. With mobile banking users projected to reach 442 million by 2025, safeguarding financial and personal data has never been more critical.

Rising mobile app threats & frauds
Mobile banking has proven to be a lucrative target for cybercriminals due to the potential for financial
gain across a large user base, made possible by the rapidly growing smartphone market and expanding internet reach.

According to recent reports, India experienced a significant surge in cyberattacks in 2023, with an
average of 2,138 assaults per organisation per week, representing a 15% weekly increase. This surge
elevated India to the second-most targeted country in the Asia-Pacific region. Financial fraud, such as
account takeover, phishing, and identity theft, accounted for 75% of these attacks, which primarily
targeted e-banking apps and the Unified Payments Interface.

Multi-layered security: An indispensable strategy
To effectively mitigate the evolving risks, mobile banking apps must adopt a multi-layered security
strategy to provide comprehensive protection against diverse cyber threats. This approach ensures
that security is maintained even if one layer is compromised, by distributing defences throughout the
entire information system.

Basic security measures:
Anti-tampering & fraud control capabilities
India faces a wide range of mobile banking fraud scenarios, including screen sharing apps, remote access, OTP-based frauds, SMS forwarders, social engineering attacks, and juice jacking frauds. Unauthorised access via screen sharing and remote access apps can result in severe data breaches. Social engineering attacks trick people into disclosing sensitive information, whereas juice jacking scams exploit USB charging ports to steal data from connected devices. To combat these threats, it is critical to implement anti-tampering capabilities and strong fraud controls.

Mobile banking apps must incorporate anti-tampering capabilities through techniques such as anti-
reverse engineering, which prevents the app's code from being decompiled and analysed. Tampered
app detection that detects and prevents the use of modified app versions that may be malicious while
App blacklisting ensures that only authorised applications are allowed to run on the device, effectively blocking potentially harmful apps. Other measures like Runtime integrity checks ensure that the app’s code is unaltered during execution, preventing runtime attacks and Side-loaded app detection monitors & blocks apps downloaded from unofficial sources, which may pose a security threat.

Create unique digital identity
Establishing a unique digital identity through device and SIM binding is critical for preventing identity
theft and fraud. By linking a mobile banking app to a specific device and SIM card, banks can
significantly reduce the risk of unauthorised access, prevent identity theft, and improve security
against fraudulent activities. This approach ensures that only verified devices have access to
sensitive financial information.

Advanced security measures:

Runtime application self-protection
Emphasising the importance of advanced security measures is critical for ensuring strong protection in mobile banking apps. Runtime Application Self-Protection (RASP) technology integrates security measures directly into the application runtime environment, allowing for real-time attack detection and prevention, thereby improving overall security. This ensures that the app can detect and mitigate threats as they arise, adding an extra layer of much needed security.

Protection against malware
Given the ever-changing threat landscape, malware protection is critical. Some of the most common Malware threats in India include app spoofing, unsecured keyboards that capture sensitive information, spyware that monitors user activities, riskware that exposes vulnerabilities, adware that displays unwanted ads, hooking frameworks that intercept data, and keylogger apps that record keystrokes. App spoofing detection, which identifies and blocks apps that mimic legitimate ones in order to steal credentials, is an example of an effective anti-malware control. Unsecured keyboard detection prevents the use of keyboards that may contain sensitive information. Blocking spyware, riskware, and adware protects against a variety of malicious software.

Hooking framework detection detects frameworks that intercept and manipulate data, whereas key-logger app prevention blocks apps that attempt to capture keystrokes and sensitive information.

Mandatories:
Regulatory compliances
Consistent security updates and patching are critical to maintaining the security of mobile banking apps. To ensure effective threat protection, banks must follow regulatory standards. The Reserve Bank of India (RBI) requires comprehensive cybersecurity safeguards, such as multi-factor authentication, secure coding techniques, and periodic security assessments. According to the RBI’s mandate, banks must ensure 100% compliance with RBI Digital Payment Security Controls, implement Man-in-the-Middle (MiTM) prevention and user certification detection, conduct unsecured Wi-Fi security checks, protect data at rest and in motion, enforce device policies, incorporate anti-malware features, prevent tampering and reverse engineering, use anti-screen mirroring and data leakage prevention, and use advanced app & device binding features.

The Indian banking sector’s response
Indian banks are now significantly increasing their mobile banking security standards. Secure coding practices are being emphasised to ensure that the software used in mobile banking apps does not contain vulnerabilities that cybercriminals could exploit. Furthermore, banks also conduct regular security evaluations to continuously assess and improve their defence mechanisms. This ongoing scrutiny helps them in identifying potential flaws and allows timely updates and patches. Continuous innovation has become another important focus area, it allows banks to stay ahead of emerging threats by incorporating the most recent advancements in cybersecurity technology and strategies.

By implementing these strong cybersecurity practices, Indian banks hope to create a more secure digital banking environment. This proactive approach not only helps to mitigate current threats, but it also prepares the banking industry to effectively address future challenges. The comprehensive implementation of these measures demonstrates Indian banks commitment to protecting customer data and ensuring the integrity of digital financial transactions.

Conclusion
As cyber threats become more and more sophisticated, strong security measures are required to safeguard sensitive financial and personal information. The Indian banking sector, guided by Reserve Bank of India mandates, is actively implementing comprehensive and adaptive cybersecurity strategies. Mobile banking apps can now, effectively defend themselves against a variety of threats by focusing on key security areas such as device security, network security, application security, and fraud controls.

Continuous innovation, vigilance, and adherence to stringent security protocols, combined with user education and awareness in recognising and reporting suspicious activities, are paramount in ensuring the integrity and reliability of digital financial systems, thus fostering secure and trustworthy transactions for all users.