Banking trojans
Specialized malware that overlays a fake form on your app, captures credentials and then initiates transfers without the account holder knowing.
The context
Why fraud targets mobile
Attackers target the customer's device directly. A keylogger or an overlay captures credentials as they are typed.
Strong authentication, required by PSD2, assumes the device is not compromised. When malware reads notifications and SMS on the same device, the validation code remains valid in the eyes of the server. Regulation therefore also requires measures against the risk of a compromised device. PSD2 is also being replaced.
Since 17 January 2025, DORA has required financial entities to manage ICT-related incidents, with notification of major incidents, and to run a resilience testing programme that may include source code reviews.
The stakes go beyond direct financial loss: a publicized fraud on the app erodes customers' trust in the mobile channel.
The solution
Pradeo's answer for finance
To protect the banking application itself, Pradeo offers In-App Protection. It combines two complementary solutions: Application Shielding hardens the code before release, making it hard to analyse, modify and clone; Runtime Application Self Protection (RASP), embedded in the application, continuously monitors its runtime environment: malicious apps, rigged networks, tampered systems.
When a threat appears, the application triggers the configured responses, such as blocking a risky transaction, and security events are reported to refine the strategy.