Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
The Almighty Buck Crime Security

Woeful Security On Financial Phone Apps Is Getting People Murdered 84

Posted by BeauHD from the smartphones-dumb-security dept.
Longtime Slashdot reader theodp writes: Monday brought chilling news reports of the all-count trial convictions of three individuals for a conspiracy to rob and drug people outside of LGBTQ+ nightclubs in Manhattan's Hell's Kitchen neighborhood, which led to the deaths of two of their victims. The defendants were found guilty on all 24 counts, which included murder, robbery, burglary, and conspiracy. "As proven at trial," explained the Manhattan District Attorney's Office in a press release, "the defendants lurked outside of nightclubs to exploit intoxicated individuals. They would give them drugs, laced with fentanyl, to incapacitate their victims so they could take the victims' phones and drain their online financial accounts [including unauthorized charges and transfers using Cash App, Apple Cash, Apple Pay]." District Attorney Alvin L. Bragg, Jr. added, "My Office will continue to take every measure possible to protect New Yorkers from this type of criminal conduct. That includes ensuring accountability for those who commit this harm, while also working with financial companies to enhance security measures on their phone apps."

In 2024, D.A. Bragg called on financial companies to better protect consumers from fraud, including: adding a second and separate password for accessing the app on a smartphone as a default security option; imposing lower default limits on the monetary amount of total daily transfers; requiring wait times of up to a day and secondary verification for large monetary transactions; better monitoring of accounts for unusual transfer activities; and asking for confirmation when suspicious transactions occur. "No longer is the smartphone itself the most lucrative target for scammers and robbers -- it's the financial apps contained within," said Bragg as he released letters (PDF) sent to the companies that own Venmo, Zelle, and Cash App. "Thousands or even tens of thousands can be drained from financial accounts in a matter of seconds with just a few taps. Without additional protections, customers' financial and physical safety is being put at risk. I hope these companies accept our request to discuss commonsense solutions to deter scammers and protect New Yorkers' hard-earned money."

"Our cellphones aren't safe," warned the EFF's Cooper Quintin in a 2018 New York Times op-ed. "So why aren't we fixing them?" Any thoughts on what can and should be done with software, hardware, and procedures to stop "bank jackings"?

Woeful Security On Financial Phone Apps Is Getting People Murdered More | Reply

Woeful Security On Financial Phone Apps Is Getting People Murdered

Comments Filter:

  • Simple. (Score:5, Insightful)

    by msauve ( 701917 ) on Wednesday February 12, 2025 @07:46PM (#65162579)
    >Any thoughts on what can and should be done with software, hardware, and procedures to stop "bank jackings"?

    Sure. Don't carry around financial apps which can transfer thousands of dollars. Leave that to the PC at home.

    • Or...just spitballing here...maybe we shouldn't hanging out with stupid people in stupid places at stupid times?

      Creating a whole system based on the high risk of going to a club, getting wasted, then taking drugs from a random stranger as you go home, seems like demanding that celibate people use condoms when masturbating because people having unprotected sex might get STDs.

      If anything, add a "I'm going out drinking late at night and taking drugs from strangers" button on financial apps, to freeze them from

      • If anything, add a "I'm going out drinking late at night and taking drugs from strangers" button on financial apps, to freeze them from working for 48 hours.

        Now THAT seems like a really good idea! If I used my phone to pay for stuff and to access my accounts, I would activate that feature in a heartbeat - and I don't even do high-risk stuff like that mentioned in TFA.

      • Re: (Score:2)

        by Sique ( 173459 )
        Perfect! Victim blaming at its finest!
        • First, in a sane society, being harmless and stupid should not come with the risk of death.
        • Second, the perpetrators are the criminals here.
        • Third, the crime is facilitated by apps that make it attractive to drug and rob the victims of their phones.
        • Fourth, it should be made clear by the providers of the app that installing the app is akin to carrying your whole net worth in cash with you all the time.

    • >Any thoughts on what can and should be done with software, hardware, and procedures to stop "bank jackings"?

      Sure. Don't carry around financial apps which can transfer thousands of dollars. Leave that to the PC at home.

      You sound like you just woke up from 1995. Do you seriously think there are many people these days who have a computer at home?

    • ... the PC at home.

      In one respect you are correct: Security means putting it under lock and key. Now that phones have stopped providing that service, users should not have such applets on their phone.

      The phone OS makers recognize they've dumbed-down security: Now, the high-end models offer secure storage that can hold applets and data, not merely photos and voice recordings. For 10 years, third-party applets on Google Play have provided the same security. Once again, the user failed to learn good habits.

      You are also

    • Yep (Score:2)

      by abulafia ( 7826 )
      That's what I do. Banking and other sensitive apps live on an old phone that doesn't leave the house.

      I can count the number of times I've needed to do an unexpected cash transfer when I'm not near home on a veteran meatpacker's hand. Even if it weren't a risk, it simply isn't a capability I need.

      The phone that leaves the house also gets its own email address, which isn't used for anything important, and I set an MDM profile to ensure Icloud doesn't start exfiltrating things randomly and a few other thin

    • This problem does not affect banking apps, *all* of which require you to log in to use them. It's just these personal payment apps that have lax security.

      Google Wallet has the same problem, you can't set it to require a PIN or password to authorize a payment. If your phone is unlocked, you can pay for things, no more questions asked. Nope, not doing that!

      • Re: (Score:2)

        by havana9 ( 101033 )
        Nowadays you could install a banking app on your smartphone, or getting SMS to have information on suspicious use of your credit cards or to authorize payments. In one case you have to trust an app, in the other case you can be targeted wit a SIM swap attack.

    • Re: (Score:2)

      by znrt ( 2424692 )

      that's a good advice in general but won't help in this case. how would the attackers know? they might have beaten you to pulp already before even reaching for that phone, just because you look like carrying a juicy phone and being an easy target.

      the defendants lurked outside of nightclubs to exploit intoxicated individuals

      just don't hang around risky places in such a sorry state. learn to do drugs.

    • Re: (Score:2)

      by Kisai ( 213879 )

      There's two solutions that come to mind.

      1. Require two simultaneous inputs any time an unfamiliar store is used. Eg Apple Pay at a new merchant over $50 requires you to insert the chip + PIN card first. The last 50 dollars is run through Apple Pay and the rest on the chip card. Merchants won't like this because it results in paying two sets of fees.
      2. For P2P (Cashapp/Venmo/PayPal/Zelle/Wise/Xe etc) require establishing trust by
      a) physically meeting and exchanging long tokens by NFC (not QR) which confirms

    • Sure. Don't carry around financial apps which can transfer thousands of dollars. Leave that to the PC at home.

      That's called throwing the baby out with the bathwater. Why not try saying the word "password", or "2FA" or "transaction limit" instead.

      I went to buy a car the other day but when the shop keeper wouldn't give it to me. Apparently he didn't want to come to my house and didn't understand when I told him I don't carry my wallet so I can't get robbed.

    • Re: (Score:2)

      by Bert64 ( 520050 )

      This is a case of robbery and murder...
      You will probably be carrying some form of ID which contains your home address, and likely to also be carrying the keys for accessing your home address. After murdering you, the criminals are free to take these things and visit your home address, enter using the key and take anything they find.

      As an aside, having stripped your body of identifying material it will take the police longer to identify your corpse and discover your home address, so by the time they turn up

  • of course (Score:1, Flamebait)

    by Lehk228 ( 705449 )
    Of course the useless DA blames the app companies for his failure to do anything about rampant crime in NY

    • We know what news you watch. Meanwhile crime in NYC is below the national average (for 2022 at least) https://en.wikipedia.org/wiki/... [wikipedia.org]

      Houston has 19 murders per 100,000 people for comparison.

      • This is what they mean by that expression "there are lies, damned lies, and statistics". Other places may have more crime, but they don't have criminals going all Jeffrey Dahmer to commit robbery.

        If you don't have a lot of crime but the crime you do have is seriously messed up, you still have a problem.

        • Dead is dead... doesn't really matter how scary it is, and red states have a higher homicide rate. Also lower education, healthcare and pretty much everything else that matters.

        • Re: (Score:2)

          by ceoyoyo ( 59147 )

          Ah yes, that expression made up by people who are annoyed when reality harshes their narrative.

          Are you comparing a couple guys who drugged people to steal their money and accidentally ODed a couple to a guy who ate his victims?

          • Are you comparing a couple guys who drugged people to steal their money and accidentally ODed a couple to a guy who ate his victims?

            Other than the motive being one of profit rather than psychopathic behavior, the crimes otherwise had a lot of similarities. I'd even go as far to suggest that recent renewed interest in Dahmer's crimes (gee, thanks Netflix) might've provided some inspiration to the Hell's Kitchen criminals.

      • You're committing Chesa Boudin Fraud. Just because you refuse to count them doesn't mean the crimes stop existing.

  • Make banks responsible (Score:4, Insightful)

    by alexgieg ( 948359 ) <alexgieg@gmail.com> on Wednesday February 12, 2025 @07:52PM (#65162593) Homepage

    Make banks responsible for financial transactions done on their apps by victims of criminals. If the person can prove they were robbed, kidnapped, mugged, intoxicated, or whatever, the bank is obliged to cover the stolen funds so the victim loses nothing.

    Once such a law goes into effect, you'll see banks RUSHING to make their apps as secure as possible. Let them figure out the details, as I'm sure they'll be way more creative than whatever criminals can think of.

    • Re: (Score:2)

      by msauve ( 701917 )
      >Make banks responsible for financial transactions done on their apps by victims of criminals.

      Which is the same as saying "make all the other customers share the responsibility", so those in relatively crime free communities subsidize those in high crime ones.

      • Which is the same as saying "make all the other customers share the responsibility"

        AKA insurance, one of the neatest features of civilization.

    • These aren't bank apps. Bank apps require you to log in to use them. These are non-bank payment apps, like Apple Pay and Cash App. Big difference.

  • What in the actual fuck? (Score:4, Insightful)

    by Powercntrl ( 458442 ) on Wednesday February 12, 2025 @07:58PM (#65162601) Homepage

    "Woeful security" on apps is not getting people killed. People are getting killed because that area clearly has a crime problem that isn't being properly addressed. Even the best security can be defeated by the $5 wrench attack [xkcd.com].

    When you think about it, most locks for houses are pretty insecure too. The majority of them can be easily opened with a bump key. Course, here in Florida you can legally be shot for doing that (and even us liberals have guns here), so that's the real deterrent.

    • "Give me access or I break your fingers" is also a pretty good password cracker. I cannot possibly see how the apps or banks are responsible for street crime here. Why not just blame money itself, hence the fed.

    • Re: (Score:2)

      by havana9 ( 101033 )
      I have a plain old Mastercard credit card, with magnetic strip, chip and pin and wireless options, and embossed numbers.
      Getting mugged at gunpoint near an ATM it's possible and happened in some crime infested areas, or pickpocketers swapping credit cards at ATM while secretly filming the PIN.

    • "Woeful security" on apps is not getting people killed. People are getting killed because that area clearly has a crime problem that isn't being properly addressed. Even the best security can be defeated by the $5 wrench attack [xkcd.com].

      Except the $5 wrench isn't the goal. The goal is to rob people through drugging and weak security. The risk of that crime is fundamentally different for the people committing it than kidnapping someone and wrenching them to hand over their passwords. By the way the best wrench in the world can't beat a transaction limit.

      Your comment is the same as those used in gun control debates - the idea that there is a perfect alternative in every way, and that one less gun means just one more stabbing, or one more bea

  • Security is inconvienient (Score:3)

    by FeelGood314 ( 2516288 ) on Wednesday February 12, 2025 @08:12PM (#65162633)
    If it is inconvienient people will by pass it. People want higher transaction limits. Good security requires the project manager to actually think intelligently about the problem for 5 minutes. ( Collectively all the project managers in the world have never had 5 minutes of intelligent thought). NIST has only just changed their rules to explicitly dissallow password rules like a Capital, small, number, symbol and rotate your password every X days. They finally also dissallowed SMS as a 2FA. Every app wants you to have an account and password. Guess what, most apps aren't important enough for me to create a unique password for, so most people use the same password for everything. (and putting some spin on the app or website as a prefix for you password doesn't add much entropy to your password).

    If I make a more secure app people will use my competitors. My app could even be easier to use but if it doesn't follow the user flow they are used to they won't use it.

    I would recomend banking from home but my bank has a $2000 transfer limit on the web app and a $15000 limit on the phone app. My rent is $2500, guess which I have to use.

    People are dumb. Regulations will likely make it worse as people will all use similar work arounds to make their lives easier.

  • On iphone, if you half-suspect you're 1) about to be arrested or 2) about to be mugged, tap the side button 5 times, or nail and hold the power and volume together.

    Do that,, and the phone won't open unless passcode is given.

    Do people actually walk around with their guard completelydown?!

    (yes, yes they do. No situational awareness at all.)

    • Tried the five button presses just to see what would happen. It activated my accessibility shortcut (I use it for dimming the screen below the normal minimum brightness level) and then brought up my wallet. Must be a feature they added to a later version of iOS.

      Good thing I don't regularly get arrested or mugged.

  • The apps are working as intended and can be encrypted, password protected, or simply not put on whatever device you are going to the bar with. If your defense is "the perpetrator sold me drugs" well thats on you too. Everyone is acting like this is some big mystery to solve when all along its as simple as dont carry wads of cash.

    • The point is, the apps should not *allow* you to make a payment without a password. Real bank apps already do this.

      Your argument is like saying that if a woman wears a bikini to a bar, it's her own fault if she gets raped. Well maybe it's not so smart, but rape is still a crime committed by the rapist.

      • "Real bank apps" do in fact have options to allow transfers, payments, etc. without additional authentication. They're there because, as bad an idea as they are, users have demanded ways to avoid having to enter credentials (even biometrics) every time they want to pay someone. Those of us who understand security have been saying over and over that this is a bad idea because if you can do something without needing to authenticate first then anyone who has your phone can do it too. And users still enable tho

        • If he uses your finger prints or holds your head to make a facial scan, it is not a thief but a robber.
          Significant difference.

    • Re: (Score:2)

      by kiviQr ( 3443687 )
      They are not. FaceID, finger print - that works with drugged person. Banking app should require additional pin for transactions. They should also allow for distress pin that would pretend that action was done.

  • Wait! What? (Score:2, Insightful)

    by PPH ( 736903 )

    They would give them drugs, laced with fentanyl, to incapacitate their victims

    People just accept drugs from strangers? This sort of blows the whole claim that the pro-drug people have to leave distribution channels alone. Because that is what gets addicts killed. Taking unknown mixtures of who knows what from people that they have no trust relationship with.

    So much for listening to junkies.

    • People just accept drugs from strangers?

      Yes. Wait where did you think people got drugs from? Do you think they get IDs and do background checks on their dealers? Do you think there is a certification body for drug dealers? Of course most drugs come from strangers.

      Way to go telling the world you've never gone to a music festival before.

  • Nope (Score:2)

    by skogs ( 628589 )

    Adding an extra password, pin number, etc will not have any effect on this. Thumbprint....whatever.

    The bad men got people high in order to do the modern, and significantly longer, version of snatch and grab mugging. If you make it harder to log in to each app...all you're really going to do is force these twats to be rougher with their victims while they molest them to get the pin/face/eyeball/thumb/finger/number/password/pattern/textauthenticator. The person getting victimized is still sitting there. T

  • Tens of thousands? That should be triggering an alert at the bank, requiring the customer to call them to authorise the transfers.
    At least that's how my bank works. They have daily transfer limits.

  • There's no need for any of this (Score:3)

    by hyades1 ( 1149581 ) on Thursday February 13, 2025 @01:24AM (#65162937)

    I've never felt a need to create any link whatsoever between my cell phone and my financial resources. Over the years, I've watched banks where I have accounts pushing to change the rules in ways that would make customers responsible for any losses that may occur from their accounts, no matter how they happen. So far, they've had only limited success, but they just don't stop trying. I have little doubt they'll get what they're after sooner or later.

    Given the inevitable outcome, I have decided I have no compelling need to change my current arrangement. If I want to bank, I'll do it in person or on-line, from a PC far more secure than my cell phone could ever be.

    • Re: (Score:2)

      by ledow ( 319597 )

      I bank via an app-only bank, have done for years. It took me forever to actually find a bank in my country that had any decent online offering (I can remember leaving one bank because they tried to tell me that a Java applet in an HTTP site that showed a padlock in the Java applet window was "secure", when all the other banks were just using SSL/TLS).

      But then I live in a country with consumer law too.

      You are missing that there are certain things that online doesn't do that an app does.

      I stand in a queue.

    • I'm glad I live in a place where what you describe is not legally an option for the bank.

      If I want to bank, I'll do it in person or on-line

      For how long? As you said the banks make the rules. While we have strong consumer protection laws where I live one of the laws we are missing are bank service laws. Sure you can do banking in person but you have to make an appointment first and they charge you a $5 fee.

  • Which is why I have never advised people to use fingerprints for security - it can be used when you're unconscious and without your consent.

    I mean, good luck getting a passcode out of me, even drugged... I'm not sure I know what many of them are, I just know the finger-pattern. And it's hard to type that in when I'm perfectly fine, let alone incapacitated.

    Fingerprints are NOT security, they are NOT your password. We need to make financial apps realise this and stop allowing their use, much like we need p

Slashdot Top Deals

We all live in a state of ambitious poverty. -- Decimus Junius Juvenalis

Close