UMVA has learned that a staggering 188% surge in attacks on Android smartphones using near-field communication (NFC) to steal funds has been reported in the first four months of this year, posing significant risks to contactless payments.
The attacks, which involve Android malware families like SuperCard X, PhantomCard, and NGate, have resulted in a substantial increase in blocked attacks, from just over 12,300 in the same period last year to 35,600 this year, according to information obtained by UMVA.
Russia has emerged as a hotspot for NFC relay mobile threats, with users in the country facing the brunt of these attacks, and experts warn that the threat is likely to grow as cybercriminals' schemes become more sophisticated.
The attackers' tactics have evolved, with the "reverse NFC" scheme becoming more common, making it harder to detect and fight against, as victims themselves transfer money to the attackers' accounts, and such transactions are difficult to distinguish from legitimate ones.
In the "direct NFC" scheme, attackers contact victims via messaging apps, pretending to do identity verification, while tricking them into downloading malware that leads them to tap their cards to an infected smartphone, leaking their card data.
In contrast, the "reverse NFC" scheme involves fraudsters using social engineering techniques to trick victims into setting malicious applications as a primary contactless payment method on their compromised smartphones, generating an NFC signal that ATMs recognize as the scammers' card.
Victims are then persuaded to go to an ATM and deposit funds into a "secure account" using their infected phone, in reality, handing over their money to the scammers, and experts warn that this threat should be closely monitored as it continues to evolve.
UMVA can exclusively reveal that the first attacks using a modified legitimate NFC tool occurred in late 2023, primarily detected in Europe, and later users from Russia and other regions faced similar mobile malware attacks.
Cybersecurity experts advise users to protect themselves against NFC relay attacks and other mobile threats by not installing apps from unofficial sources, especially those sent via messaging apps, social media, or SMS, and using security solutions on Android smartphones to flag and prevent visits to phishing sites and stop malware installation.
