Credential capture
Keyloggers, automatic screen captures and fake overlaid windows intercept usernames and passwords the moment they are entered.
The context
Why fraud is moving to mobile
Mobile now concentrates a large share of transactional journeys, and fraudsters are adapting their techniques to it.
Modern banking malware combines several vectors: overlaying a fake login screen, reading notifications to capture validation codes, and remote access to initiate transfers without the account holder knowing.
Rooting or jailbreaking the device, sometimes done by the user themselves, disables system partitioning and makes all these attacks markedly easier to carry out.
PSD2 requires payment service providers to take measures to limit the risk of a compromised device, including mechanisms that check the software or device has not been altered. It is being replaced by PSD3 and a European regulation on payment services. PCI MPoC and EMV mobile set comparable requirements for payment applications.
The solution
How Pradeo protects your applications
Pradeo combines two protections. Shielding hardens the application's binary before release: the code becomes hard to analyse, modify and clone. RASP, embedded in the application as an SDK (Android) or framework (iOS), continuously monitors the runtime environment: malicious applications, rigged networks, altered systems.
When facing a threat, the application triggers the configured responses. Security events are reported from devices and help adjust the strategy.