Cybercrime Goes Mobile Thanks To Insecure 
Mobile Banking, mCommerce and mWallet Apps

By Mark Laich

Millions of consumers no longer visit a bank to deposit checks or conduct financial transactions. Instead they rely on the convenience of using their mobile devices to send money, view account balances and bank online.

The same is true for how they spend their money - the shift from brick and mortar to e-commerce to m-commerce is already well underway.  Think about it - how many times do you use your smartphone to research a product or purchase one?

Maybe you're going out to dinner tonight and you've already filled your Apple Pay, Google Wallet or other wallet technology with all of your credit-card information. Ever wonder if you could be pickpocketed wirelessly? Could an app you trust already be stealing your personally identifiable information (PII)? Sadly, the answer is yes.

Many financial institutions and retailers have launched mobile apps in the past 18 months to respond to demands from their customers who want the convenience of 24-hour, anytime/anywhere banking and shopping. Mobile banking apps help build customer loyalty, and mobile-banking transactions are significantly cheaper for banks compared with transactions that require employee interaction.

Mobile-retail apps capture consumers' buying impulse at the moment they occur, and allow for easy comparison shopping - the potential for finding an item cheaper is a quick tap away. Because more and more banks and retailers are making the investment to develop a mobile app, having one has gone from being a competitive differentiator to a "must have" to compete for consumers' business.

And once a bank has made that investment, there is a concerted effort to encourage customers to use their mobile-banking platform. The same holds true for retail. Amazon and others will do anything to get you to shop online from your smartphone or your tablet.

But the growth of mobile banking and retail apps also means that more people are at risk for identity theft and the hacking of sensitive personal and transaction data by cyber criminals who plan to commit fraud. These apps are used on devices that often aren't safeguarded from security holes. Most people have between 30 and 75 apps on their mobile device, and of course, when apps are installed on a device, users must grant multiple permissions for accessing a device's location, SMS capabilities, Wi-Fi, Bluetooth, camera and other device resources.

Some of these resources are used for the apps to do their intended task, but often apps demand resources that can open up a device to security vulnerabilities.  Unfortunately, when consumers install an app on their mobile devices, few of them read all the permissions the app requests to make sure it isn't asking to use device resources that might be suspicious.

This issue is highlighted by a report from Gartner Inc., the technology research company, which concluded 75 percent of apps in the major app stores fail basic security tests. Gartner defines this as an app using mobile-device resources that have nothing to do with the intended function of the app. Rather they can be used to eavesdrop on other apps that are running concurrently to collect data about the consumer. The rationale is that the collected information can be used for data analytics to help with targeted mobile advertising.

However, this has given cyber criminals a rather large attack vector to commit ID Fraud by using malware that looks like trustworthy apps to steal PII and financial transaction data from mobile banking apps, or to steal your credit-card information from your retail apps that reside on the same mobile device.  This type of malware disguised as "trusted" apps has hundreds of millions of downloads from the major app stores.

Worse yet, this new form of malware is undetected by anti-virus and able to circumvent encryption, biometrics, tokenization, sandboxes and authentication. The result is that using mobile-banking apps to conduct transactions is similar to using an ATM to withdraw cash in a dangerous area with criminals lurking around, or handing your credit card to a stranger, in public, who is using the old-fashioned carbon copy credit card imprinter to take your order.

Another popular technique for cyber criminals is spear-phishing attacks - which take the form of email and text messages that appear to be from an official source or someone you know, usually garnered via a social-networking site. These messages can then install monitoring software covertly on the mobile device. Monitoring software can access most mobile device activity and resources, thereby stealing consumer data just like the malware downloaded from an app store.

Most consumers are unaware of these types of threats, and even when they are aware, they don't take actions to protect their security and privacy until it is too late. On the other hand, financial institutions carry the liability associated with the fraud that results from data stolen from mobile banking and retail apps. In a U.S. landscape where almost 1 billion PII records have been compromised and there is identity fraud totaling $24.7 billion in losses - according to statistics from Privacyrights.org and the Department of Justice - greater safeguards are needed to protect consumers' financial data.

At the same time, it is important not to intrude or detract from consumers' mobile banking or retail experiences. Financial institutions and retailers can't solely depend on consumer awareness and training, nor can they make it complicated for consumers to protect themselves.

For better or worse, the modern-day consumer has become enamored with using their mobile devices for apps such as social networks, location-based services, and games on the same device on which they want to do mobile banking and mobile commerce, thereby compromising their security and privacy. What financial institutions and retailers need is new, innovative security technologies that deliver an optimal balance between protecting consumer data and being un-intrusive to consumers' total mobile-device experience.

In this way, their mobile banking and mCommerce apps can operate in a safe and trusted environment even when multiple applications are running concurrently. By working with companies that specialize in these types of new security technologies designed to thwart zero-day threats and malicious eavesdropping apps, financial institutions and retailers will not only protect themselves from liabilities, they will also be successful at convincing more of their customers to use mobile banking and mobile commerce, thereby increasing the ROI of their mobile-app investment and their operating efficiency.

Finally, as we look forward to what many believe will be the rapid adoption of mWallets in 2015, you must understand that they are inherently insecure because they operate on already infected devices. It's time to take a completely radical, proactive approach to securing consumers' data as the financial, transaction-based world shifts onto our smartphones and tablets.

This year marks the beginning of a new wave of enablement, opportunity and mCrime.  Where there is mobile banking, mCommerce and mWallet there will be mCrime.  Assume it comes in the apps as innocent as that flashlight app you recently installed, because if you don't, you'll be left in the dark missing your identity and your wallet.

About The Author
Mark Laich, VP of Security Solutions, SnoopWall, Inc. (www.snoopwall.com)

Mark joined Snoopwall with a 30-year track record of successful sales in the high-tech industry, generating over a half billion dollars in revenues. His expertise includes successful customer and market development in the mobile, CE, and telecommunications market sectors. He has a long track record of leading successful sales campaigns and developing business at major accounts like Samsung, Microsoft, Philips, Canon, Nikon, Thomson, Cisco, Alcatel, Siemens, and Compaq.

Results Grossed 53 Percent More Than Appraised Value

SPRINGFIELD - The Illinois State Treasurer online auction took in $92,653, eclipsing the anticipated amount of $60,425.

"Our auctions occur after the items have not been claimed after a 10-year search," Illinois Treasurer Michael Frerichs said. "It is exciting to know these valuables will bring enjoyment to so many people after so many years."

Commemorative coins, jewelry, baseball cards and comic books were among the 16,200 items auctioned between March 16 and March 20. More information about unclaimed property, including the ability to search by last name, is available at illinoistreasurer.gov. Click on the I-Cash button.

Following best practices, individual auction items were appraised by an outside vendor and grouped together to increase bidding interest. Net proceeds fund efforts to reunite cash and valuables with their owners. Interest earned on investments is used to pay state bills. Typically, that amount exceeds $130 million each year.

The Treasurer's Office holds more than $2.1 billion in unclaimed cash and property. Examples include forgotten bank accounts, payroll checks, insurance proceeds, consumer refunds and unclaimed safe-deposit box items. Last year, one-in-four people who searched I?Cash found cash or an item. The average discovery was valued at $1,000. The largest amount of unclaimed property recovered through I-Cash was in 2008 and valued at more than $1 million.

Top items in this month's auction included a lot with an 1894 Morgan Silver Dollar ($4,550), a lot with a $50 Liberty Eagle One Ounce Gold Piece ($2,775), and a lot with a Rookwood Pottery vase ($1,075). The lot with a Chicago Cubs 1965 Ernie Banks baseball card and a Chicago White Sox Frank Thomas signed rookie card garnered $685.

Historically, auction items that have received the highest bids include 383 Roosevelt dimes that went for $10,520 in September 2012, five 1947 $50 Mexican Pesos that went for $10,050 in March 2013, and a Platinum 2 Carat Diamond ring that went for $9,000 in November 2014.

Auctions occur after the rightful owners have not claimed the property despite 10 years of public and private notification efforts. These notification efforts will continue and auction proceeds will be held if the rightful owners are identified.

About the State Treasurer's Office

The Illinois Treasurer is the state's chief investment officer and banker. The Treasurer uses the investments to protect residents and promote the economy. Program examples include managing savings plans for colleges and trade schools, increasing financial education among all ages and removing barriers to a secured retirement. Treasurer Michael Frerichs is a Certified Public Finance Officer who invests money on behalf of the state and its residents. The $27 billion portfolio includes $15 billion in state funds, $7 billion in college savings plans and $5 billion on behalf of local and state government. The Treasurer also supports loans to support community development. The investment approach is conservative to ensure the safety of principal. The Treasurer's Office pre-dates Illinois' statehood and was included in Illinois' incorporation in 1818. Voters in 1848 voted to make it an elected office.

###

Financial Expert Explains Why You Should Hire A Good CPA & Not Part-time Help; Offers Tips

It's that time of year for part-time help at the local tax-preparation location, when drivers can see seasonal staff standing at busy intersections wearing costumes of the Statue of Liberty or Uncle Sam. But they're not the only ones who are hired part time, says professional advisor to Certified Public Accountants Gary Marriage, Jr.

"I sometimes ask people, 'Do you want a guy in a costume to handle your taxes?' Of course, the guy actually doing the paperwork probably won't be the guy standing near the traffic, but he's also not the person you want dealing with your bottom line," says Marriage, CEO of Nature Coast Financial Advisors (www.naturecoastfinancial.com).

"I know millionaires who go to these pop-up tax firms; they'd rather spend a few hundred dollars on their return than a grand or two with a skilled CPA. But this apparent savings comes at a cost, because a good accountant is likely to find many thousands of dollars in savings in a single tax return, and they are far less liable to make a mistake."

Marriage offers additional tips for consideration this tax season.

•  Have your records handy, and consider a long-term relationship. Not only is it advantageous to file taxes through a CPA, it's also smart to have all relevant records readily available at your disposal - no matter who is helping you with your return.

"Not only do I strongly advise you to use a reputable CPA that you can trust, I also think you should try to establish a long-term relationship with him or her," Marriage says. "Think of a financial professional as similar to a doctor or lawyer - the better they know you, the better off you'll be. High-net-worth individuals have the most incentive for professional financial services, even if they've made a hobby of saving money by doing things their own way."

•  High-income earners pay the vast majority of income taxes - don't volunteer more. Taxpayers with incomes exceeding $100,000 earn 60 percent of the country's income, yet contribute 95.2 percent of the income taxes, according to recent estimates from Congress'sJoint Committee on Taxation. Additionally, those earning more than $100,000 - a bit more than 20 percent of taxpayers - pay for 75.7 percent of total federal taxes, excluding the burden on corporate and investment taxes.

"There are many high-income earners who are passionate about their careers and love what they do; they care more about their work than their income," he says. "These tend to be the folks who need reminders that there are legal avenues available for protecting their hard-earned money."

•  High-net-worth individuals should consider CRAT. Many people, financial professionals with years of experience, do not know about Charitable Remainder Annuity Trusts, a form of financial protection that Marriage often teaches to CPAs. CRATs are a flexible and effective instrument used in financial and estate planning. A CRAT provides a significant tax shelter for any assets and property placed within it. That allows any assets in a charitable remainder annuity trust to increase in value without being taxed on the increase. A well-constructed CRAT can provide financial security for the annuitants.

"CRATs are surprisingly underutilized, but many CPAs I run into simply don't know about it," Marriage says. "It's worth asking your financial advisor about, and if your advisor is unfamiliar with the structure, encourage him or her to look into it."

About Gary Marriage

Gary Marriage Jr. is the founder and CEO of Nature Coast Financial Advisors (www.naturecoastfinancial.com), which educates retirees on how to protect their assets, increase their income and reduce their taxes. Marriage is a national speaker, delivering solutions for pre-retirees, business owners and seniors on the areas affecting their retirement and estates. He is an approved member of the National Ethics Bureau, and has been featured in "America's Top Hometown Financial Advisors 2011" and most recently selected to co-author a book with Steve Forbes titled, "SuccessOnomics: Power Principles." Marriage is also the founder of Operation Veteran Aid, an advocate for war-time veterans and their families.

Washington, D.C. - Congressman Dave Loebsack released the following statement today on the situation regarding the possible deportation of Iowa City Pastor Max Villatoro.  

"When talking about immigration reform, which Congress has continually kicked down the road, many numbers and statistics are thrown around. The situation involving Max Villatoro puts a human face on these numbers and amplifies the need for action on comprehensive immigration reform. I feel there must be a realistic and pragmatic but tough system that enforces the rule of law and ensures accountability while not tearing apart families who have been here for many years. Mr. Villatoro is a loving husband and father, model employee and a dedicated member of our community. As a compassionate country, we cannot allow Mr. Villatoro's family to be torn apart."