Metro Bank’s ‘Scam of the Month’ of August 2023 is a warning about the rise in malware attacks against UK bank customers. Malware, or malicious software, is designed by criminals to compromise devices including computers, laptops, and mobile phones. Globally, 5.5 billion malware attacks were reported last year.[1]
Malware comes in many forms and include words like virus, worm, spyware and trojan. This includes stealing personal data, intercepting SMS messages to steal one-time passcodes (OTPS) or gaining control of online banking applications to make payments. Some devices are turned into ‘zombies’ and used to spread malware further (often to the victims’ contact), or to mine cryptocurrency.
Some forms of malware, known as ‘ransomware’, encrypt all data on a victim’s device and threaten to destroy or sell it unless the victim pays a fee. Ransomware has been designated a Tier 1 national security threat by the UK government[2] owing to its prevalence and the high level of harm it causes to victims.
“UK banks have seen an upward trend in malware attacks, especially on mobile devices, so we want consumers to be aware,” warns Metro Bank’s Head of Fraud & Investigations, Baz Thompson. “There are a number of warning signs we are advising our customers of to help identify a potentially infected device.”
Metro Bank’s tips to spotting a malware attack
- Deterioration of performance – Your device performance suddenly becomes very slow – programs crash or fail to open without reason. You may not be able to use the device at all.
- Heat – Your device becomes unusually hot during regular use.
- New / Unrecognised apps - Unexpected applications appear on your device – These may give criminals further control.
- Abnormal data usage – Malicious applications typically rely on internet connections to send and receive information to their creators. Most phones allow a user to check how much mobile data an application has used – an unusually high amount of data usage respective to the application type can be a tell-tale sign.
- Unexpected messages – friends and family contact you to advise they’ve received odd messages from your phone number, email address, or messaging apps.
Thompson: “There are some very straightforward ways consumers can protect their devices against malware attacks. Keeping your software up-to-date and checking application permissions are often the best defences.”
How to protect yourself from Malware Attacks:
- Keep devices updated: Install the latest updates for your operating systems and other software and applications, including internet browsers.
- Security software: Consider installing security software on all devices (even on a mobile) This may identify malware and assist in removing infections.
- Trustworthy Downloads: Only download files and apps from known reputable trustworthy vendors within Google Store or the App Store. Avoid downloading apps from third party developers.
- Review app permissions before you download: Even legitimate stores can host malicious apps. Think about what information an application needs access to in order to function – does it really need to access your address book, camera, or files? Our research indicates that malicious apps often include .pdf readers or QR code scanners which have requested these permissions.
- Review apps regularly and delete those that are no longer supported or available from the Google Store or App Store.
- Emails and texts: Ensure all emails or texts you receive are from legitimate sources before opening any links or attachments, especially if they are pressuring you into taking urgent action.
- Passwords: Use complex passwords and multi-factor authentication to make it harder for criminals to access your accounts.
If you suspect a malware attack, you need to act fast:
- Notify your banks of possible malware compromise.
- Contact Action Fraud to file a report.
- Text 7726 (SPAM) to forward suspicious or unsolicited messages, your mobile network provider will then block and investigate.
- Conduct a security scan using security software from a reputable vendor.
- Delete and remove any apps identified as malicious from the security scan, unrecognised or seem suspicious, delete risky texts, delete browsing history and empty your cache.
[1] 2023 SonicWall Cyber Threat Report | SonicWall
[2] UK cracks down on ransomware actors - GOV.UK (www.gov.uk)