Cellular phone users are the latest victims of phishing and spyware – and crooks are using mobile malware to intercept and steal money transfers. 


Jimmy Shah writes on the McAfee Avert Labs blog that many people have switched to their mobile phones to send money home from overseas.
Traditionally, a money transfer involved going into an office and filling out a form. In addition, fees tend to be high doing transfer by this method – in same cases as much as one-quarter of the money sent.
The alternative using a mobile phone is much more convenient, more cost-effective and – until recently – secure.
The Philippines is a case in point: it's citizens send a lot of money home; and there is an existing mobile money transfer services.
Users can send amounts to other people using their phones, Shah explains. The recipients get a confirmation number via SMS and then go down to the money transfer centre to receive the money.
"This is a pretty good system, where not much can go wrong," says Shah. "The transfer network is secure enough with the only real risk at the endpoints. Recipients of the money transfers are potentially open to attack."
SMS money transfer services ensure that money is delivered safely to the recipient by having them sign up for an account. When a recipient doesn’t yet have an account, they also get an account number in the SMS. They need the account number to sign up for an account in order to retrieve the money.
So all a crook needs to do is intercept the confirmation SMS, sign up an account and get the money.
"They can install snoopware like Mobispy, Acallno, or Mopifeli on the victims phone," says Shah. "Then they can just wait for the transfer SMS to arrive and take their copy to the centere before the victim does."