“I bet you never would use an app for online banking.”

This comment might seem a little out of left field, but I received it after spending 60 minutes demonstrating all the ways I create malicious apps to rip people off via their mobile devices.

To be clear, I am not a criminal. However, after spending more than 20 years being paid to hack into organizations, physically rob secured facilities, and create new malware designed to bypass even the most sophisticated security solutions, it is no wonder that people assume I personally would have so little faith in cyber-technology.

“Actually, I do almost all my banking via mobile apps,” was my simple response.

My answer was met by surprise and confusion, so I spent the next several minutes explaining all the reasons why mobile devices are one of the biggest threats to personal banking, and yet, I still trust them enough to manage my personal finances.

First, let me be clear: I think that the security risks mobile devices present to individuals and corporations alike are astronomical. In a recent seminar, I demonstrated a mobile app that I wrote that looked like a Gmail message counter. When installed, the app would show how many unread messages were in your Gmail inbox. Not such an exciting app, but the reality was that it had far more going on behind the scenes. When the app was installed, it would send me the email address of the user who owned the phone. People often fail to realize the value of a simple email address.

As a criminal, I would then take those email addresses and visit a large number of websites such as eBay, Amazon and Paypal, and select the “Forgot Password” option. When you forget your password, these websites allow you to enter your email address, and they then send you a link via that email account to reset your password. In this case, my malicious app was designed to watch for those emails that went out to the users. When they arrived, the app would simply forward those emails to me. In addition, the app would delete the email from the user's account so the user would never see that it arrived. Armed with a copy of the email containing the link to reset the password, I simply clicked on the link, changed the password, and just like that, I had control of the account.

This is all from a simple app installed on a mobile device. Worse yet, this is just one of many malicious apps that I have written and demonstrated to hundreds of thousands of people to show them just how dangerous apps on a mobile device can get.

So why is it that a person like me, who knows first-hand just how malicious a device can be, would still consider using that device for online banking? Because knowing how bad it can be has also shown me just how secure the devices really are.

Mobile apps can be malicious, but they also have their limits. When your personal computer gets a virus, everything on your computer is compromised. On the other hand, when you install a malicious mobile app, the other apps on your device remain secure in most cases. This is the fundamental difference between the security of your personal computer and your mobile device. What this means is that the risks you face are directly related to the decisions you make when installing mobile apps. If you choose to only install apps from reputable organizations such as your financial institution, or from an official app store, and use those apps for their intended purposes, you should feel far more secure than you would be using your web browser on your personal computer to conduct online banking. While there are always risks, the simple fact is that right now, your mobile device is the more secure choice for banking online.

Jim Stickley is CEO of Stickley on Security. He can be reached at 619-797-6131 or Jim@stickleyonsecurity.com.

Instant Insights /

Mobile Devices: The Secure Online Banking Choice

Related Stories

Recommended For You