Criminals are targeting banking apps and smartphones themselves with malicious overlays, malware and device-level tricks, leaving even users with strong authentication exposed.
Banking apps are facing a new kind of threat, one that goes beyond stolen passwords and fake login pages. Security specialists say criminals are increasingly trying to interfere with the software itself, using manipulated apps, malicious overlays and device-level tricks to reach money and personal data on smartphones. According to the Oaxaca-based report, that means a strong password, two-step verification or facial recognition can still leave users exposed if the app or the device has been compromised.
The shift matters because mobile banking has become a favoured target for fraudsters. BioCatch, as reported by TechRadar, said scam attempts on mobile devices rose 35% over the past year and now account for 90% of all attempts, with investment scams proving particularly costly. The pattern reflects a broader change in fraud tactics: instead of simply trying to break into an account, criminals often pressure victims into moving money themselves, then use mobile channels to make the deception feel routine and urgent.
Researchers have also warned about malware designed specifically to control Android phones and mimic legitimate banking interfaces. Android Central reported on a threat known as Sturnus, which arrives through sideloaded APK files and can read chat content, monitor screen activity and place convincing fake banking overlays on top of real apps. Security teams at Zimperium have separately identified several Android trojan campaigns that hide their icons, block removal attempts and use fake update prompts and accessibility permissions to steal credentials, sometimes streaming live screen content back to attackers.
That is why experts say the risk is no longer limited to whether a user can spot a phishing message. Mario Barrera, commercial director at Nubatech, said authentication tools help protect access, but they do not replace measures that can detect tampering inside the software itself. The Oaxaca report says banks may need integrity checks, anti-debugging systems, code-protection tools, detection of instrumented apps, secure key storage and constant monitoring to spot abnormal behaviour before funds are moved.
For customers, the advice remains straightforward but important. Download banking apps only from official sources, avoid APK files sent through messages or found on unofficial sites, and steer clear of modified phones, such as those with root or jailbreak access, because those changes can weaken built-in protections. Google has also begun rolling out additional anti-scam warnings in the United States for Android users who open financial apps during calls from unknown numbers, a sign that platform makers are also trying to interrupt fraud before it reaches the transfer stage. Even so, the message from security researchers is consistent: protecting money on a phone now means defending the account, the app and the device at the same time.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
