Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
The Almighty Buck Crime Security

Woeful Security On Financial Phone Apps Is Getting People Murdered 63

Posted by BeauHD from the smartphones-dumb-security dept.
Longtime Slashdot reader theodp writes: Monday brought chilling news reports of the all-count trial convictions of three individuals for a conspiracy to rob and drug people outside of LGBTQ+ nightclubs in Manhattan's Hell's Kitchen neighborhood, which led to the deaths of two of their victims. The defendants were found guilty on all 24 counts, which included murder, robbery, burglary, and conspiracy. "As proven at trial," explained the Manhattan District Attorney's Office in a press release, "the defendants lurked outside of nightclubs to exploit intoxicated individuals. They would give them drugs, laced with fentanyl, to incapacitate their victims so they could take the victims' phones and drain their online financial accounts [including unauthorized charges and transfers using Cash App, Apple Cash, Apple Pay]." District Attorney Alvin L. Bragg, Jr. added, "My Office will continue to take every measure possible to protect New Yorkers from this type of criminal conduct. That includes ensuring accountability for those who commit this harm, while also working with financial companies to enhance security measures on their phone apps."

In 2024, D.A. Bragg called on financial companies to better protect consumers from fraud, including: adding a second and separate password for accessing the app on a smartphone as a default security option; imposing lower default limits on the monetary amount of total daily transfers; requiring wait times of up to a day and secondary verification for large monetary transactions; better monitoring of accounts for unusual transfer activities; and asking for confirmation when suspicious transactions occur. "No longer is the smartphone itself the most lucrative target for scammers and robbers -- it's the financial apps contained within," said Bragg as he released letters (PDF) sent to the companies that own Venmo, Zelle, and Cash App. "Thousands or even tens of thousands can be drained from financial accounts in a matter of seconds with just a few taps. Without additional protections, customers' financial and physical safety is being put at risk. I hope these companies accept our request to discuss commonsense solutions to deter scammers and protect New Yorkers' hard-earned money."

"Our cellphones aren't safe," warned the EFF's Cooper Quintin in a 2018 New York Times op-ed. "So why aren't we fixing them?" Any thoughts on what can and should be done with software, hardware, and procedures to stop "bank jackings"?

Woeful Security On Financial Phone Apps Is Getting People Murdered More | Reply

Woeful Security On Financial Phone Apps Is Getting People Murdered

Comments Filter:

  • Simple. (Score:5, Insightful)

    by msauve ( 701917 ) on Wednesday February 12, 2025 @07:46PM (#65162579)
    >Any thoughts on what can and should be done with software, hardware, and procedures to stop "bank jackings"?

    Sure. Don't carry around financial apps which can transfer thousands of dollars. Leave that to the PC at home.

    • Or...just spitballing here...maybe we shouldn't hanging out with stupid people in stupid places at stupid times?

      Creating a whole system based on the high risk of going to a club, getting wasted, then taking drugs from a random stranger as you go home, seems like demanding that celibate people use condoms when masturbating because people having unprotected sex might get STDs.

      If anything, add a "I'm going out drinking late at night and taking drugs from strangers" button on financial apps, to freeze them from

      • If anything, add a "I'm going out drinking late at night and taking drugs from strangers" button on financial apps, to freeze them from working for 48 hours.

        Now THAT seems like a really good idea! If I used my phone to pay for stuff and to access my accounts, I would activate that feature in a heartbeat - and I don't even do high-risk stuff like that mentioned in TFA.

    • Thanks for letting me know your important shit is at home and not on your person!

    • >Any thoughts on what can and should be done with software, hardware, and procedures to stop "bank jackings"?

      Sure. Don't carry around financial apps which can transfer thousands of dollars. Leave that to the PC at home.

      You sound like you just woke up from 1995. Do you seriously think there are many people these days who have a computer at home?

    • ... the PC at home.

      In one respect you are correct: Security means putting it under lock and key. Now that phones have stopped providing that service, users should not have such applets on their phone.

      The phone OS makers recognize they've dumbed-down security: Now, the high-end models offer secure storage that can hold applets and data, not merely photos and voice recordings. For 10 years, third-party applets on Google Play have provided the same security. Once again, the user failed to learn good habits.

      You are also

    • Yep (Score:2)

      by abulafia ( 7826 )
      That's what I do. Banking and other sensitive apps live on an old phone that doesn't leave the house.

      I can count the number of times I've needed to do an unexpected cash transfer when I'm not near home on a veteran meatpacker's hand. Even if it weren't a risk, it simply isn't a capability I need.

      The phone that leaves the house also gets its own email address, which isn't used for anything important, and I set an MDM profile to ensure Icloud doesn't start exfiltrating things randomly and a few other thin

    • This problem does not affect banking apps, *all* of which require you to log in to use them. It's just these personal payment apps that have lax security.

      Google Wallet has the same problem, you can't set it to require a PIN or password to authorize a payment. If your phone is unlocked, you can pay for things, no more questions asked. Nope, not doing that!

    • Re: (Score:2)

      by znrt ( 2424692 )

      that's a good advice in general but won't help in this case. how would the attackers know? they might have beaten you to pulp already before even reaching for that phone, just because you look like carrying a juicy phone and being an easy target.

      the defendants lurked outside of nightclubs to exploit intoxicated individuals

      just don't hang around risky places in such a sorry state. learn to do drugs.

    • Re: (Score:2)

      by Kisai ( 213879 )

      There's two solutions that come to mind.

      1. Require two simultaneous inputs any time an unfamiliar store is used. Eg Apple Pay at a new merchant over $50 requires you to insert the chip + PIN card first. The last 50 dollars is run through Apple Pay and the rest on the chip card. Merchants won't like this because it results in paying two sets of fees.
      2. For P2P (Cashapp/Venmo/PayPal/Zelle/Wise/Xe etc) require establishing trust by
      a) physically meeting and exchanging long tokens by NFC (not QR) which confirms

  • of course (Score:1, Flamebait)

    by Lehk228 ( 705449 )
    Of course the useless DA blames the app companies for his failure to do anything about rampant crime in NY

    • We know what news you watch. Meanwhile crime in NYC is below the national average (for 2022 at least) https://en.wikipedia.org/wiki/... [wikipedia.org]

      Houston has 19 murders per 100,000 people for comparison.

      • This is what they mean by that expression "there are lies, damned lies, and statistics". Other places may have more crime, but they don't have criminals going all Jeffrey Dahmer to commit robbery.

        If you don't have a lot of crime but the crime you do have is seriously messed up, you still have a problem.

        • Dead is dead... doesn't really matter how scary it is, and red states have a higher homicide rate. Also lower education, healthcare and pretty much everything else that matters.

        • Re: (Score:2)

          by ceoyoyo ( 59147 )

          Ah yes, that expression made up by people who are annoyed when reality harshes their narrative.

          Are you comparing a couple guys who drugged people to steal their money and accidentally ODed a couple to a guy who ate his victims?

          • Are you comparing a couple guys who drugged people to steal their money and accidentally ODed a couple to a guy who ate his victims?

            Other than the motive being one of profit rather than psychopathic behavior, the crimes otherwise had a lot of similarities. I'd even go as far to suggest that recent renewed interest in Dahmer's crimes (gee, thanks Netflix) might've provided some inspiration to the Hell's Kitchen criminals.

  • Make banks responsible (Score:3)

    by alexgieg ( 948359 ) <alexgieg@gmail.com> on Wednesday February 12, 2025 @07:52PM (#65162593) Homepage

    Make banks responsible for financial transactions done on their apps by victims of criminals. If the person can prove they were robbed, kidnapped, mugged, intoxicated, or whatever, the bank is obliged to cover the stolen funds so the victim loses nothing.

    Once such a law goes into effect, you'll see banks RUSHING to make their apps as secure as possible. Let them figure out the details, as I'm sure they'll be way more creative than whatever criminals can think of.

    • Re: (Score:2)

      by msauve ( 701917 )
      >Make banks responsible for financial transactions done on their apps by victims of criminals.

      Which is the same as saying "make all the other customers share the responsibility", so those in relatively crime free communities subsidize those in high crime ones.

      • Which is the same as saying "make all the other customers share the responsibility"

        AKA insurance, one of the neatest features of civilization.

    • These aren't bank apps. Bank apps require you to log in to use them. These are non-bank payment apps, like Apple Pay and Cash App. Big difference.

  • What in the actual fuck? (Score:4, Insightful)

    by Powercntrl ( 458442 ) on Wednesday February 12, 2025 @07:58PM (#65162601) Homepage

    "Woeful security" on apps is not getting people killed. People are getting killed because that area clearly has a crime problem that isn't being properly addressed. Even the best security can be defeated by the $5 wrench attack [xkcd.com].

    When you think about it, most locks for houses are pretty insecure too. The majority of them can be easily opened with a bump key. Course, here in Florida you can legally be shot for doing that (and even us liberals have guns here), so that's the real deterrent.

    • "Give me access or I break your fingers" is also a pretty good password cracker. I cannot possibly see how the apps or banks are responsible for street crime here. Why not just blame money itself, hence the fed.

  • Security is inconvienient (Score:3)

    by FeelGood314 ( 2516288 ) on Wednesday February 12, 2025 @08:12PM (#65162633)
    If it is inconvienient people will by pass it. People want higher transaction limits. Good security requires the project manager to actually think intelligently about the problem for 5 minutes. ( Collectively all the project managers in the world have never had 5 minutes of intelligent thought). NIST has only just changed their rules to explicitly dissallow password rules like a Capital, small, number, symbol and rotate your password every X days. They finally also dissallowed SMS as a 2FA. Every app wants you to have an account and password. Guess what, most apps aren't important enough for me to create a unique password for, so most people use the same password for everything. (and putting some spin on the app or website as a prefix for you password doesn't add much entropy to your password).

    If I make a more secure app people will use my competitors. My app could even be easier to use but if it doesn't follow the user flow they are used to they won't use it.

    I would recomend banking from home but my bank has a $2000 transfer limit on the web app and a $15000 limit on the phone app. My rent is $2500, guess which I have to use.

    People are dumb. Regulations will likely make it worse as people will all use similar work arounds to make their lives easier.

  • On iphone, if you half-suspect you're 1) about to be arrested or 2) about to be mugged, tap the side button 5 times, or nail and hold the power and volume together.

    Do that,, and the phone won't open unless passcode is given.

    Do people actually walk around with their guard completelydown?!

    (yes, yes they do. No situational awareness at all.)

    • Tried the five button presses just to see what would happen. It activated my accessibility shortcut (I use it for dimming the screen below the normal minimum brightness level) and then brought up my wallet. Must be a feature they added to a later version of iOS.

      Good thing I don't regularly get arrested or mugged.

  • The apps are working as intended and can be encrypted, password protected, or simply not put on whatever device you are going to the bar with. If your defense is "the perpetrator sold me drugs" well thats on you too. Everyone is acting like this is some big mystery to solve when all along its as simple as dont carry wads of cash.

    • The point is, the apps should not *allow* you to make a payment without a password. Real bank apps already do this.

      Your argument is like saying that if a woman wears a bikini to a bar, it's her own fault if she gets raped. Well maybe it's not so smart, but rape is still a crime committed by the rapist.

      • "Real bank apps" do in fact have options to allow transfers, payments, etc. without additional authentication. They're there because, as bad an idea as they are, users have demanded ways to avoid having to enter credentials (even biometrics) every time they want to pay someone. Those of us who understand security have been saying over and over that this is a bad idea because if you can do something without needing to authenticate first then anyone who has your phone can do it too. And users still enable tho

        • If he uses your finger prints or holds your head to make a facial scan, it is not a thief but a robber.
          Significant difference.

    • Re: (Score:2)

      by kiviQr ( 3443687 )
      They are not. FaceID, finger print - that works with drugged person. Banking app should require additional pin for transactions. They should also allow for distress pin that would pretend that action was done.

  • Wait! What? (Score:3)

    by PPH ( 736903 ) on Wednesday February 12, 2025 @09:34PM (#65162759)

    They would give them drugs, laced with fentanyl, to incapacitate their victims

    People just accept drugs from strangers? This sort of blows the whole claim that the pro-drug people have to leave distribution channels alone. Because that is what gets addicts killed. Taking unknown mixtures of who knows what from people that they have no trust relationship with.

    So much for listening to junkies.

  • Nope (Score:2)

    by skogs ( 628589 )

    Adding an extra password, pin number, etc will not have any effect on this. Thumbprint....whatever.

    The bad men got people high in order to do the modern, and significantly longer, version of snatch and grab mugging. If you make it harder to log in to each app...all you're really going to do is force these twats to be rougher with their victims while they molest them to get the pin/face/eyeball/thumb/finger/number/password/pattern/textauthenticator. The person getting victimized is still sitting there. T

  • Tens of thousands? That should be triggering an alert at the bank, requiring the customer to call them to authorise the transfers.
    At least that's how my bank works. They have daily transfer limits.

Slashdot Top Deals

Dead? No excuse for laying off work.

Close