3 ms·

> Most of the cases are found to be on android devices. Do you have some relevant sources about banking fraud? Android devices make up more than 70% of Thailan

> Most of the cases are found to be on android devices. Do you have some relevant sources about banking fraud? Android devices make up more than 70% of Thailand's market share [0], so it's not a surprise. [0] https://www.statista.com/statistics/814490/market-share-mobile-vendors-thailand/ https://www.statista.com/statistics/814490/market-share-mobi...

zacksiri 3y ago
Usually the cases show up on social media in our country. The victims post that they’ve been frauded and generally blame it on the banks. The banks then reply and say “the fraud transaction originated from customer’s device”. When you look at the screenshots of victims giving example it’s all Android as far as I can see. Generally after talking to the banks and customers discover that it was their own fault for clicking on a seemingly harmless link they shut up and go quiet. This is a story that plays out often here. I don’t particularly have a link because these cases get deleted from social media (by the customer themselves) after the bank has proven that it’s the customers fault. Edit: You can try searching the internet for “mobile banking fraud Thailand” you’ll find these links, here is one example. https://www.bangkokpost.com/business/2524469/mobile-banking-security-rules-toughened https://www.bangkokpost.com/business/2524469/mobile-banking-... Edit: here is an example the article mentions downloading of .apk on android https://www.nationthailand.com/thailand/general/40024972 https://www.nationthailand.com/thailand/general/40024972
- matsemann 3y ago
  Can't the banks implement some measures so that only their own apps can do transactions?
  - zacksiri 3y ago
    Believe me they’re trying. They’re now mandating biometric authentication, and I don’t mean on device, I mean implemented by the banks app / backend. If you read the articles you’ll see. Each year the central banks up the ante on security protocols to implement to stop the fraud. I should know I used to work for a finance app here in Thailand. We have to go through strict security audits, and procedures that costs a lot for any financial institution to implement. Doing 2 FA is already a mandate for doing transactions. However 2FA in Thailand is mostly done using SMS which is still not that secure. Forcing everyone to use a token or a 1Password app is also not viable since that’s going to shut a lot of people out of mobile banking. It’s a complex problem, which I think Apple has already solved. Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man.
    - gambiting 3y ago
      Literally nothing that you've said is a good excuse for forbidding sideloading. It would be actually trivial for a bank to only allow transactions from their apps, if they can't do that then they should be forced to take responsibility for fraud. Guess what happens currently on iOS instead? Instead of installing a custom app, you are sent a link to log in to a dodgy bank page with all your details with the exact same result. >>Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man. I don't believe this is the case, and I really believe any arguments otherwise are made in bad faith to maintain the status quo because obviously apple could never do any wrong.
      - JimDabell 3y ago
        > It would be actually trivial for a bank to only allow transactions from their apps How?
        gambiting 3y ago
        What do you mean how? The app has a secure token only the app has, any traffic without that token is invalid. IOS already sandboxes all apps so the token would be impossible to extract. This is basic app security, I can't believe this is even discussed
        JimDabell 3y ago
        > The app has a secure token only the app has What kind of token? How does it obtain it?
        xgb84j 3y ago
        This is how I think it roughly works where I live: You get a per-user token directly at the bank or via mail (not email, but a physical envelope). Your banking app can use this token once to get a secret key. Secret key + user name + password allows you to use the banking app. Any way to circumvent this requires app isolation to be broken somehow.
heavyset_go 3y ago
The Thai government's Ministry of Digital Economy & Society has made multiple public requests for iOS users[1], mentioning that they need to avoid specific iOS apps[1][2], as well. That means scam apps were being distributed via the App Store. Also, the government mentions that the scams affect users of both platforms, because the scams propagate via calls, web links and emails that ask for personal information[2]. [1] https://www.bangkokpost.com/tech/2487659/phone-users-warned-over-malicious-apps https://www.bangkokpost.com/tech/2487659/phone-users-warned-... [2] https://www.bangkokpost.com/business/2499931/online-scammers-in-the-crosshairs https://www.bangkokpost.com/business/2499931/online-scammers...
- zacksiri 3y ago
  Right, but for Apple to take down those apps, it's much easier than taking down some random link the fraudsters put up. I'm not saying iOS is 100% bullet proof. I'm saying the problem is much more manageable without sideloading.
  - heavyset_go 3y ago
    Google is able to use Play Protect in similar ways as Windows Defender, and the system can prevent malicious apps from installing or running based on signatures, profiling, certificates, etc. Just as iOS uses code signing and signatures to decide if an app was installed via the App Store, Android can do something similar, and more, to prevent malware from running. > Right, but for Apple to take down those apps, it's much easier than taking down some random link the fraudsters put up. Seems like the issue here is that the government has to tell iOS users not to install specific apps because Apple hasn't taken them down. I'm sure it's easy for Apple to do what it wants on the App Store, the issue is making them care. They have a history of letting multimillion dollar scams flourish on the App Store[1]. [1] https://www.theverge.com/2021/2/8/22272849/apple-app-store-scams-ios-fraud-reviews-ratings-flicktype https://www.theverge.com/2021/2/8/22272849/apple-app-store-s...

zacksiri 3y ago

Usually the cases show up on social media in our country. The victims post that they’ve been frauded and generally blame it on the banks. The banks then reply and say “the fraud transaction originated from customer’s device”. When you look at the screenshots of victims giving example it’s all Android as far as I can see. Generally after talking to the banks and customers discover that it was their own fault for clicking on a seemingly harmless link they shut up and go quiet. This is a story that plays out often here. I don’t particularly have a link because these cases get deleted from social media (by the customer themselves) after the bank has proven that it’s the customers fault. Edit: You can try searching the internet for “mobile banking fraud Thailand” you’ll find these links, here is one example. https://www.bangkokpost.com/business/2524469/mobile-banking-security-rules-toughened https://www.bangkokpost.com/business/2524469/mobile-banking-... Edit: here is an example the article mentions downloading of .apk on android https://www.nationthailand.com/thailand/general/40024972 https://www.nationthailand.com/thailand/general/40024972

matsemann 3y ago
Can't the banks implement some measures so that only their own apps can do transactions?
- zacksiri 3y ago
  Believe me they’re trying. They’re now mandating biometric authentication, and I don’t mean on device, I mean implemented by the banks app / backend. If you read the articles you’ll see. Each year the central banks up the ante on security protocols to implement to stop the fraud. I should know I used to work for a finance app here in Thailand. We have to go through strict security audits, and procedures that costs a lot for any financial institution to implement. Doing 2 FA is already a mandate for doing transactions. However 2FA in Thailand is mostly done using SMS which is still not that secure. Forcing everyone to use a token or a 1Password app is also not viable since that’s going to shut a lot of people out of mobile banking. It’s a complex problem, which I think Apple has already solved. Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man.
  - gambiting 3y ago
    Literally nothing that you've said is a good excuse for forbidding sideloading. It would be actually trivial for a bank to only allow transactions from their apps, if they can't do that then they should be forced to take responsibility for fraud. Guess what happens currently on iOS instead? Instead of installing a custom app, you are sent a link to log in to a dodgy bank page with all your details with the exact same result. >>Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man. I don't believe this is the case, and I really believe any arguments otherwise are made in bad faith to maintain the status quo because obviously apple could never do any wrong.
    - JimDabell 3y ago
      > It would be actually trivial for a bank to only allow transactions from their apps How?
      - gambiting 3y ago
        What do you mean how? The app has a secure token only the app has, any traffic without that token is invalid. IOS already sandboxes all apps so the token would be impossible to extract. This is basic app security, I can't believe this is even discussed
        JimDabell 3y ago
        > The app has a secure token only the app has What kind of token? How does it obtain it?
        xgb84j 3y ago
        This is how I think it roughly works where I live: You get a per-user token directly at the bank or via mail (not email, but a physical envelope). Your banking app can use this token once to get a secret key. Secret key + user name + password allows you to use the banking app. Any way to circumvent this requires app isolation to be broken somehow.

heavyset_go 3y ago

The Thai government's Ministry of Digital Economy & Society has made multiple public requests for iOS users[1], mentioning that they need to avoid specific iOS apps[1][2], as well. That means scam apps were being distributed via the App Store. Also, the government mentions that the scams affect users of both platforms, because the scams propagate via calls, web links and emails that ask for personal information[2]. [1] https://www.bangkokpost.com/tech/2487659/phone-users-warned-over-malicious-apps https://www.bangkokpost.com/tech/2487659/phone-users-warned-... [2] https://www.bangkokpost.com/business/2499931/online-scammers-in-the-crosshairs https://www.bangkokpost.com/business/2499931/online-scammers...

zacksiri 3y ago
Right, but for Apple to take down those apps, it's much easier than taking down some random link the fraudsters put up. I'm not saying iOS is 100% bullet proof. I'm saying the problem is much more manageable without sideloading.
- heavyset_go 3y ago
  Google is able to use Play Protect in similar ways as Windows Defender, and the system can prevent malicious apps from installing or running based on signatures, profiling, certificates, etc. Just as iOS uses code signing and signatures to decide if an app was installed via the App Store, Android can do something similar, and more, to prevent malware from running. > Right, but for Apple to take down those apps, it's much easier than taking down some random link the fraudsters put up. Seems like the issue here is that the government has to tell iOS users not to install specific apps because Apple hasn't taken them down. I'm sure it's easy for Apple to do what it wants on the App Store, the issue is making them care. They have a history of letting multimillion dollar scams flourish on the App Store[1]. [1] https://www.theverge.com/2021/2/8/22272849/apple-app-store-scams-ios-fraud-reviews-ratings-flicktype https://www.theverge.com/2021/2/8/22272849/apple-app-store-s...