6 ms·

Usually the cases show up on social media in our country. The victims post that they’ve been frauded and generally blame it on the banks. The banks then reply

Usually the cases show up on social media in our country. The victims post that they’ve been frauded and generally blame it on the banks. The banks then reply and say “the fraud transaction originated from customer’s device”. When you look at the screenshots of victims giving example it’s all Android as far as I can see. Generally after talking to the banks and customers discover that it was their own fault for clicking on a seemingly harmless link they shut up and go quiet. This is a story that plays out often here. I don’t particularly have a link because these cases get deleted from social media (by the customer themselves) after the bank has proven that it’s the customers fault. Edit: You can try searching the internet for “mobile banking fraud Thailand” you’ll find these links, here is one example. https://www.bangkokpost.com/business/2524469/mobile-banking-security-rules-toughened https://www.bangkokpost.com/business/2524469/mobile-banking-... Edit: here is an example the article mentions downloading of .apk on android https://www.nationthailand.com/thailand/general/40024972 https://www.nationthailand.com/thailand/general/40024972

matsemann 3y ago
Can't the banks implement some measures so that only their own apps can do transactions?
- zacksiri 3y ago
  Believe me they’re trying. They’re now mandating biometric authentication, and I don’t mean on device, I mean implemented by the banks app / backend. If you read the articles you’ll see. Each year the central banks up the ante on security protocols to implement to stop the fraud. I should know I used to work for a finance app here in Thailand. We have to go through strict security audits, and procedures that costs a lot for any financial institution to implement. Doing 2 FA is already a mandate for doing transactions. However 2FA in Thailand is mostly done using SMS which is still not that secure. Forcing everyone to use a token or a 1Password app is also not viable since that’s going to shut a lot of people out of mobile banking. It’s a complex problem, which I think Apple has already solved. Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man.
  - gambiting 3y ago
    Literally nothing that you've said is a good excuse for forbidding sideloading. It would be actually trivial for a bank to only allow transactions from their apps, if they can't do that then they should be forced to take responsibility for fraud. Guess what happens currently on iOS instead? Instead of installing a custom app, you are sent a link to log in to a dodgy bank page with all your details with the exact same result. >>Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man. I don't believe this is the case, and I really believe any arguments otherwise are made in bad faith to maintain the status quo because obviously apple could never do any wrong.
    - JimDabell 3y ago
      > It would be actually trivial for a bank to only allow transactions from their apps How?
      - gambiting 3y ago
        What do you mean how? The app has a secure token only the app has, any traffic without that token is invalid. IOS already sandboxes all apps so the token would be impossible to extract. This is basic app security, I can't believe this is even discussed
        JimDabell 3y ago
        > The app has a secure token only the app has What kind of token? How does it obtain it?
        xgb84j 3y ago
        This is how I think it roughly works where I live: You get a per-user token directly at the bank or via mail (not email, but a physical envelope). Your banking app can use this token once to get a secret key. Secret key + user name + password allows you to use the banking app. Any way to circumvent this requires app isolation to be broken somehow.

matsemann 3y ago

Can't the banks implement some measures so that only their own apps can do transactions?

zacksiri 3y ago
Believe me they’re trying. They’re now mandating biometric authentication, and I don’t mean on device, I mean implemented by the banks app / backend. If you read the articles you’ll see. Each year the central banks up the ante on security protocols to implement to stop the fraud. I should know I used to work for a finance app here in Thailand. We have to go through strict security audits, and procedures that costs a lot for any financial institution to implement. Doing 2 FA is already a mandate for doing transactions. However 2FA in Thailand is mostly done using SMS which is still not that secure. Forcing everyone to use a token or a 1Password app is also not viable since that’s going to shut a lot of people out of mobile banking. It’s a complex problem, which I think Apple has already solved. Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man.
- gambiting 3y ago
  Literally nothing that you've said is a good excuse for forbidding sideloading. It would be actually trivial for a bank to only allow transactions from their apps, if they can't do that then they should be forced to take responsibility for fraud. Guess what happens currently on iOS instead? Instead of installing a custom app, you are sent a link to log in to a dodgy bank page with all your details with the exact same result. >>Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man. I don't believe this is the case, and I really believe any arguments otherwise are made in bad faith to maintain the status quo because obviously apple could never do any wrong.
  - JimDabell 3y ago
    > It would be actually trivial for a bank to only allow transactions from their apps How?
    - gambiting 3y ago
      What do you mean how? The app has a secure token only the app has, any traffic without that token is invalid. IOS already sandboxes all apps so the token would be impossible to extract. This is basic app security, I can't believe this is even discussed
      - JimDabell 3y ago
        > The app has a secure token only the app has What kind of token? How does it obtain it?
        xgb84j 3y ago
        This is how I think it roughly works where I live: You get a per-user token directly at the bank or via mail (not email, but a physical envelope). Your banking app can use this token once to get a secret key. Secret key + user name + password allows you to use the banking app. Any way to circumvent this requires app isolation to be broken somehow.