Last update: July 11, 2016
These are the top 20 online and mobile banking security tips needed to have a threat-free banking on your mobile device.
Since most of today’s financial transactions are done on mobile devices, it means you’re more vulnerable to attacks from malware developers that aim to gain access to your mobile banking details.
But I’ve collated 20 Mobile Banking Security and Privacy Measures to Keep you Protected
“We expect global mobile transaction volume and value to average 35 percent annual growth between 2012 and 2017, and we are forecasting a market worth $721 billion with more than 450 million users by 2017,” , Gartner Report. says
“Nevertheless, we have lowered the forecast of total transaction value for the forecast period due to lower-than-expected growth in 2012, especially in North America and Africa.”
The report means more transactions are expected on the mobile devices using mobile banking application. This also opens the doors for cybercriminals to steal your banking details.
But before that happens, I’ve put together 20 mobile banking safety tips, and mobile banking security solutions to help you stay protected while transacting on your device.
1) Verify Shortened URL Before Clicking
A short URL has been used in the past to redirect people to an unexpected site address like shock sites, or to affiliate site thereby allowing blacklisted scam pages to be accessed.
One of such is Rickrolling.
But, before that let’s understand what short URL is, and why website administrators use shortened URL.
A Uniform Resource Locator (URL) shorter, also known as shortened URL is a service on the World Wide Web that translates long URLs into abbreviated alternatives.
URL shortening services are based on URL redirection.
Some of the major reasons why people use short URLs are:
- because longer ones are either broken in email messages,
- or the number of characters permitted per post is so limited that including a long URL would leave no room for a message to accompany it.
Since it’s shortened, you may be anxious to click so as to know where you would be led.
Clicking on shortened URL may redirect you to a dubious site which may have been designed by online criminals to release cookies unto your device to monitor your financial activity.
Online thieves have a way of luring their potential victims into their sites.
They may even come up with an attention gripping email like this:
“Gandyostyle Bank has designed this special offer for you click here shortened url”
Think twice before you click on the shortened URL, even if Gandyostyle is truly your banker.
- If you’re unsure where a link will lead you, head straight to Long URLand paste the shortened URL into the ‘expand’bar.
- Clicking on expand will show you where a link will lead you before clicking.
- If the expanded URL isn’t the exact URL of your banker, it means it came from one of those online criminals.
- You may even take a step further by forwarding the dubious ‘shortened URL’ to your financial institution for their online security department to take the appropriate sanctions against the site.
Short URL may also be used to perpetrate Identity Fraud
In finance, identity fraud is the stealing of someone else’s personal details to carry out financial ‘evil’.Please contact your bank if you think you are a victim of identity fraud. Don’t delay because once cyber criminal has your financial details, through any dubious means he might have got it, he uses at will which may take you time to detect.
How to Protect yourself from Identity Theft
Since any leak in your online banking can have an impact on your mobile banking, here are some security measures you can take to minimize identity fraud:
- Protect your personal information related to your financial details by not giving your card number information to anyone in whatever means, unless the person is someone you trust.
- It is security advisable to memorize your online passwords and Card Personal Identification Number (PIN) than writing them down. If you must write them down, it’s better you don’t carry the jotter (or anywhere it is written) around. It could get lost.
- Tear up any account statement you print out, or any other receipts that show your financial card numbers. Fraudster may use this to perpetrate ‘evil’ against you if he stumbled upon it.
- Regularly review your account statements to make sure that all transactions on your statement are genuine, and they are legitimate ones carried out by you, or which you’ve consented to. If you discover any suspicious transactions, report to your bank without delay.
- Be doubtful when you receive an e-mail requesting for your personal details. NO bank will ask you for that through e-mail.
- Your details could also be gotten through lottery scam whereby you are told you’ve won, but for you to claim the money, you’re mandated to fill form that will request for your details including your bank account number and other personal ID. They use tricky e-mails to execute this fraud.
2) Use the Official Application of your Bank
Application/ web developer and the CEO of SPRYPIXELS, Dayo Akinkuowo, says it is better to download banking application that has been commissioned by your official bank.
“Most banks will include a section on their Web sites to let you know about the official app. Once you’ve verified the app is official, it shouldn’t be difficult to download and install to your device.”
Mobile Banking Apps Safety Tips
- Make sure you download the mobile banking app of your bank from its recommended application store like Apple App Store or Google Play.
- Don’t use download link gotten from questionable websites, or application market.
- After downloading the banking app, update it frequently whenever an update is available. Banks are one of the most security conscious institutions in the world, that’s why financial institutions update security and add new features from to time as part of banking security measures. Make sure to have the most current version of your bank’s app.
- Anyone could be caught unaware, it’s better to sign out after carrying out any activity on your banking app.
- It’s not advisable to use a rooted device for online banking. Though, most banks use encryption technology for a secure mobile and online banking. But that should not be a reason why you should expose yourself to online attack by conducting online banking on jailbroken device.
3) Avoid Software That Stores Your Password or Pin
Password software helps user store and organize passwords and PIN codes. The Password Manager typically has a local database or a file that holds the encrypted password data for secure logon onto computers, networks, web sites and application data files.
Sure, one of the reasons why you use, or why you want to consider password manager is that: It safes the stress of cracking your brain over those encrypted passwords.
This may surprise you, but since you carry your bank statement and account with you all the time, it’s better to avoid as much as possible software that stores either your PIN or passwords next time you access the website from the same device.
Despite the advantages of password software, one of the World’s online security-conscious banking institutionsopines that password software could give anyone who uses your mobile device access to your accounts, or in an event of theft or loss.
If you’re already using password manager and your device is lost, take the following steps
- Be quick to report to your financial institution of such loss, because someone targeting your device is always ready to be smarter.
- Access your other accounts (social medial) from another system to change your password, if you can easily remember them, or report them as hijacked accounts before heavy damage is done by the thief.
4) Think Twice Before Downloading
One of the best security measures you can take when attempting to download an application on your device is to review and understand the kind of data the apps you’re about downloading can access.
Sometimes you’re in a hurry to download and start enjoying the benefits of your newly found application.
But, you must also know that hackers are becoming sophisticated in response to the technological improvement.
A hacker may develop a game application targeted at gaining access to your device.
So it is very important to carefully read the terms and conditions of any software before you download.
Also, be security cautious of free services you accept to ensure you aren’t accidentally agreeing to have your Internet activity monitored by other parties.
Apart from the first party cookies, block pop-ups or any other third party cookies from your device. Clicking on such pop-ups may unleash ‘terror’ on your account, and your privacy may be compromised.
5) Protect Your Privacy
Your privacy is the key to having safe online/mobile banking. And virtually all the banks across the world persistently say,
“We will never ask you to send your password via text messages, email, or via any social media.”
Similar to this is your online banking password, or Personal Identification Number (PIN) of ATM, which must not be shared with anyone.
Your financial privacy may be at risk if you continue to share password or PIN with another person.
Sometimes, circumstances (like in the hospital bed, or inability to walk) may push you giving out your ATM card to someone to use on your behalf, but make sure he’s someone you trust, and make sure you limit the number of person you give such financial card to. This is to make investigations easier in case of abnormal deductions in your account.
If I Already Gave Out My Card
And in case you already gave out your debit/credit card, change your password. It is also advisable to regularly change your password. This is to make it difficult for third party to guess.
In case you’re having problem using your card, don’t call on a strange person to check for you, instead enter the banking hall to register your complaints at the customer care desk.
Avoid sharing, or providing your financial card number or password with another party or website other than your real bank.
This means you must exercise caution before responding to online and email requests for your personal information.
- Your bank will never present you with unexpected WebPages.
- Your bank will never send you unsolicited messages or emails asking for your password, PIN, Access Code.
- Your bank will never ask for the Serial number of your credit or debit card, or any other confidential information related to bank account via text message or email
Should you get unsolicited message or email from an address similar to your banker, do not respond immediately. Contact your banker to verify its authenticity.
Report suspects to the appropriate authorities. By doing this you’re only not helping yourself, but also alerting the general public about such scam messages.
6) Avoid Juicy Offer From Unknown or Fake Websites
If it’s too good to be true, steer clear. For instance:
“In the latest promo to celebrate the birthday of our dear President, you’ve been selected to benefit from the $5 000, 000 cash Mr. President is using to say, ‘thank you’ for supporting his administration. To be one of the lucky beneficiaries, click here “.
Another trick some of the fake sites use is short URL which they hope you can eagerly click.
7) Avoid Shoulder-to-Shoulder Web Surfing
There may be an urgent situation where you have to logon to your online banking using a browser on your device, it is very important to beware of the next person closer to you.
Even if you already have your password stored on the device, it is still not safe to stand should-to-shoulder to a stranger at a public place while mobile banking.
A hole in any of your passwords could expose your other accounts to vulnerability from hackers.
8) Avoid Fake Application Market
You may get email or message containing a ‘hidden’ link directing you to download the latest wallpapers.
Make sure you verify the weblink before clicking; endevour you know and trust the inventor of an app before downloading it to your mobile device.
Some free utilities like wallpapers, calendars and aggregation services have been known to install malware.
Further consultations on app development and security:
9) Ignore Dubious Custom SMS
Short Message Service could be customized to look like it comes from your financial institution.
This kind of message contains short link instructing you to visit the website for the latest “goodies” which may install malware and take total control of your device.
Any promotions by your banker should be on its official website not exclusively through custom SMS.
Apart from deposit alert, withdrawal alert that may be communicated to you through custom SMS, any other forms of promotion should be official.
Also, fake custom SMS with something like this:
“A sum of $5000 only has just been deposited to your account; please complete this form which would give you access to your account; login to your account here for immediate withdrawal.”
Don’t be quick to click on such link, unless you want to reap where you’ve not sown
And you know what?
The consequence may be handing over your details to a criminal with ease.
10) Avoid Services that Promise You Free Web Browsing Through Hacked Wi-Fi
Succinctly put, “Avoid Banking on Public Networks” Dayo advised.
“Public connections aren’t very secure. If you need to access your account information, you may want to switch to another network.
“If you’re using a smartphone, disabling the Wi-Fi and switching to a cellular network is a good solution. You never know who might be listening in over the public network.”
There are numerous applications on app market, for instance Wi-Fi hacker that promise you free web browsing.
The developer of such hacked Wi-Fi or other means of free browsing might be monitoring your communication which means a veiled partner is by your neck monitoring your browsing sessions.
11) Download Anti-Virus Software
Just like your personal computer, there is the possibility of virus attack or infiltration by intrusion software commonly known as “Trojan Horses” on your mobile device.
The potential consequences of any of these threats could include damage to your mobile device, compromise of your financial information.
The strength of anti-virus
- Detects, blocks and removes viruses from your device.
- Blocks online intruders from hacking into your device with 2-way Firewall
- Helps identify risky websites before you click
- Automatically update to continuously keep you protected.
There are other free anti-virus softwares. Some of them even offer faster web surfing, email virus scanning, and other strong features like anti-theft, call blocking, and automatic update.
However, it’s advisable you carefully read the terms of any free services you accept or software you download online before you accept them.
According to Scotia Bank, “They are known to sometimes include your consent to having all of your Internet browsing activity, including secure transactions monitored.”
- In consenting to such terms, you’re allowing the service provider to collect highly personal information such as your bank account and credit card numbers and passwords.
- Check out the track record of any free anti-virus software before giving your consent.
- Steer clear of any “backdoor” email or message instructing you to download unknown anti-virus software.
Phishing emails and messages are targeted at getting your financial account. Even if you’re phished on social media, the aim of the ‘phisher’ is to employ your account name to dupe your close associates.
According to phishtank, Phishing is a fraudulent attempt, usually made through email, to steal your personal information.
Wikipediais more elaborate on this: “Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication.”
To Dayo, fishing and phishing are similar concepts — there’s bait involved with both.
“You should never follow a banking link sent to you in a text message or e-mail. These links could potentially lead you to a spoofed Web site.
“If you enter your information into such a site, you’ve just handed that data over to thieves. It’s always a good idea to navigate to a Web site directly.
It’s advisable to use your bank’s official application, but in an event your phone capacity doesn’t support the app, enter your bank’s Web address into your phone browser and bookmark it.”
This would help you to avoid bogus Web sites, Dayo said.
13) Personal Safety Measures
Use a case: Your mobile device may look odd inside a case, but do you also know that the case would reduce the extent of damage if it fell?
Get a screen protector, don’t take your phone to the beach or bathroom, and not putting your phone and your keys in the same pocket are some of the personal safety measures you need to take.
14) Device repair
The failure to take personal safety of your mobile device seriously may lead to a device repair if you’re not ready to purchase a new one quickly.
This means you need an engineer to fix whatever the problem is.
Taking your mobile device to just any engineer for repair may indirectly mean handing over your secret information to the third party.
15) Change of Ownership
You’ve a got a new device, right?
What do you plan to do with the previous one, possibly give it away to a relative, or any other closer person to you?
Giving out your old phone with vital information stored on it could put your financial details at risk.
But, don’t you worry, here is what you can do to secure the info you’ve stored on the device.
What to do
Transfer to your new device and then wipe off your stored information on the former device.
Clear caches on your former device either on the phone or stored on your SD card. It is important to clear the cache after each session in order to safeguarding your account information.
It’s because each time you access the Internet, your device automatically saves a copy of the web pages you visited on your phone or SD card.
16) Limit Extended Period On The Web:
Internet security experts have been able to establish that there are additional vulnerabilities associated with having a device connected to the Internet for an extended period of time.
This applies particularly to all users of personal computer who use cable modem or digital subscriber line (DSL) Internet access.
Unfortunately, as long as your device remains ‘on’ and connected to the Internet, malicious parties have ample of opportunity to penetrate.
- Turn off your data connection when you’re busy doing something else, or when you want to take a break from web surfing.
- If your device doesn’t have ‘data on and off’ feature, keep your anti-virus updated to block a potential malware attack.
17) Keep your Device Updated
Ensure that you keep your operating system updated. This is to improve the security of your device which will help to correct issues that may make your device vulnerable to virus or other web-related worm attacks.
Device update is usually found on settings-About phone (if you’re on android operating system)
Similar to no. 11, Security updates is also important
The makers of Microsoft Windows and Apple MacOS operating systems are security vigilant. They frequently issue security updates to defend new cyber threats.But as a personal precaution, make sure you download and install security updates regularly. Better still, you can configure your operating system to automatically check for available updates.
18) Don’t Leave Confidential Information on WhatsApp Undeleted,
Conversations on WhatsApp are automatically stored, and are not encrypted.
Delete all conversations that contain your banking details on WhatsApp.
19) Do Not Send Confidential Information in E-mail or Text Messages
“It is important to understand that text messages are not encrypted the same way your mobile device information is,” Fifty Third Bank
“If someone gains access to your phone, they will be able to view any text messages sent or received that have not yet been deleted.”
20) Treat your Device Like Credit Card or Debit Card
You should treat your mobile device just how you would a credit card or debit card.
One of the measures you take is to password-protect it. But, it’s advisable NOT to select your birth date, telephone number, or other easy-to-guess combinations.