How mobile banking fraud works
The attack goes after the device, the phone number or the person holding it:
- Malware: a fake screen laid over the real app, or a remote access tool that drives the phone
- Phishing by text, call or chat: the customer gives up a one-time code or enrols the criminal's device
- SIM swap: the phone number is moved to the criminal's SIM, and the codes with it
- Fake apps that copy the real one and collect the sign-in details
- Scams: the customer is persuaded to send the money personally
- Theft of an unlocked phone, or of a phone whose passcode was watched
How a banking app defends against it
Device binding ties the account to a key held in one phone's secure hardware, so stolen credentials do not work on another device. The app can also detect a rooted or jailbroken phone, a screen overlay or an active remote session, and refuse to show sensitive screens.
Risk rules cover the rest: a new device or a new payee triggers stronger authentication, a waiting period or a lower limit. Device and behaviour signals feed a fraud score on every payment.
Why mobile banking fraud matters to a provider
In the EU, Article 73 of PSD2 requires the payer's provider to refund an unauthorised payment immediately, and no later than the end of the following business day, unless the provider has reasonable grounds to suspect fraud and reports them to the national authority. The cost of a weak mobile channel therefore lands on the provider first.
Payments the customer was deceived into making are a separate problem, with their own rules: authorised push payment fraud.
Where Mobile banking fraud shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- NotificationsEmail, SMS, push and in-app messages in your brand, through the providers you choose.
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
Platforms that need it
Guides that go deeper
- How to launch a neobank without a banking licenceYour own e-money licence, an EMI's agent, a partner bank or a bank licence: how each route works, who holds the money, and what safeguarding and deposit protection cover.
- How to build an app like Revolut: licences, launch order and one ledgerA super app is several regulated businesses behind one sign-up. The licence behind each product in the EU, UK and UAE, the order to launch them, one ledger, the Consumer Duty and app review.
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.