Almost 300 predatory loan apps found in Google and Apple stores
(2022/12/01)
- Reference: 1669879807
- News link: https://www.theregister.co.uk/2022/12/01/apple_google_predatory_loans/
- Source link:
Almost 300 apps, downloaded by around 15 million users, have been pulled from the Google Play and Apple App stores over claims they promised quick loans at reasonable rates but then used extortion and other predatory schemes against borrowers.
The loans came with hidden fees and high interest rates that drove up the payments and the apps asked for sensitive information on their mobile devices. This included SMS messages, photos, phone history and contact lists that was then used against victims, according to researchers with cybersecurity vendor Lookout.
In some instances, the data exfiltrated from the device was used to extort borrowers by threatening to disclose the data or information about the debt to their contacts, the researchers wrote in a [1]report .
[2]
In total, more than 251 Android apps were found in the Google Play souk – and collectively, downloaded more than 15 million times – and 35 iOS apps in the Apple Store that were found to be among the top 100 financial apps in regional stores.
[3]
[4]
Lookout contacted Google and Apple about the apps and said Wednesday that none of them were still available for download.
"what's been identified is a tiny drop in the bucket overall," Chris Clements, vice president of solutions architecture for Cerberus Sentinel, told The Register , adding that "anything over zero shouldn't be acceptable."\
[5]
There were almost [6]4 million apps in the Apple Store and more than [7]2.6 million in Google Play, according to Statista –
Such predatory lending apps have been a problem before. As we [8]reported earlier this month, India's Home Ministry instructed state governments to come down hard on illegal lending apps that it said led to multiple suicides by borrowers who had been harassed and blackmailed for repayments.
In the first half of the year, Google [9]reportedly removed 2,000 loan apps from its Play Store in India.
[10]
Lookout researchers wrote in their report that there were likely dozens of independent operators behind the apps, with only some of them sharing code bases. However, all the apps followed a similar pattern in tricking victims into unfair loan terms and then threatening borrowers for repayments.
They couldn't tell where the scammers were from, but the apps targeted users in developing regions, including Africa, Southeast Asia, India, Colombia, and Mexico. Such countries tend have looser financial regulations and a lack of enforcement, as well as people with lower incomes and easy access to mobile apps.
"The focus on developing countries may also explain why we found more loan scam apps on Android than on iOS," the researchers wrote. "Outside the US, Android is much more popular, with more than 70 percent of the market, partly because of the availability of extremely low-cost Android devices."
After users downloaded the app, they were required to give information typical for such a loan, like name, address, and employment history. However, they also were told to grant permissions to data on the device. Many of the apps began exfiltrating contact information as soon as the permissions are given.
The victims would receive some of the loan they applied for – unlike similar scams – but it would come with fees that amounted to up a third of the amount borrowed. After that, extremely high interest rates were applied and the borrowers were told to repay the loan within days, much of which was contrary to the lending details the load app promised.
"This approach has the advantage of a veil of legitimacy where the perpetrators can hide behind complex and unethical contract terms," Clements said. "This potentially offsets liability, both from potentially convincing victims that the scam is perfectly legal, as well as from authorities who would react very differently from more traditional forms of online fraud."
While a loan app scam can be time- and resource-consuming, "the payoff is more significant with extorting the victims," James McQuiggan, security awareness advocate at KnowBe4, told The Register .
"Similar to the business world, cybercriminals will invest in something if it has a high return for them. With the high-interest rates and extorting the victims, they no doubt wanted to make their money back with the first dozen victims, and then the money started rolling in for them after that." ®
Get our [11]Tech Resources
[1] https://www.lookout.com/blog/predatory-loan-apps?utm_source=release&utm_medium=pr&utm_content=predatoryloans
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.statista.com/statistics/268251/number-of-apps-in-the-itunes-app-store-since-2008/
[7] https://www.statista.com/statistics/266210/number-of-available-applications-in-the-google-play-store/
[8] https://www.theregister.com/2022/11/01/india_lending_app_crackdown_ordered/
[9] https://www.indiatoday.in/technology/news/story/google-has-removed-2000-personal-loan-apps-from-play-store-in-india-1992668-2022-08-26
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
The loans came with hidden fees and high interest rates that drove up the payments and the apps asked for sensitive information on their mobile devices. This included SMS messages, photos, phone history and contact lists that was then used against victims, according to researchers with cybersecurity vendor Lookout.
In some instances, the data exfiltrated from the device was used to extort borrowers by threatening to disclose the data or information about the debt to their contacts, the researchers wrote in a [1]report .
[2]
In total, more than 251 Android apps were found in the Google Play souk – and collectively, downloaded more than 15 million times – and 35 iOS apps in the Apple Store that were found to be among the top 100 financial apps in regional stores.
[3]
[4]
Lookout contacted Google and Apple about the apps and said Wednesday that none of them were still available for download.
"what's been identified is a tiny drop in the bucket overall," Chris Clements, vice president of solutions architecture for Cerberus Sentinel, told The Register , adding that "anything over zero shouldn't be acceptable."\
[5]
There were almost [6]4 million apps in the Apple Store and more than [7]2.6 million in Google Play, according to Statista –
Such predatory lending apps have been a problem before. As we [8]reported earlier this month, India's Home Ministry instructed state governments to come down hard on illegal lending apps that it said led to multiple suicides by borrowers who had been harassed and blackmailed for repayments.
In the first half of the year, Google [9]reportedly removed 2,000 loan apps from its Play Store in India.
[10]
Lookout researchers wrote in their report that there were likely dozens of independent operators behind the apps, with only some of them sharing code bases. However, all the apps followed a similar pattern in tricking victims into unfair loan terms and then threatening borrowers for repayments.
They couldn't tell where the scammers were from, but the apps targeted users in developing regions, including Africa, Southeast Asia, India, Colombia, and Mexico. Such countries tend have looser financial regulations and a lack of enforcement, as well as people with lower incomes and easy access to mobile apps.
"The focus on developing countries may also explain why we found more loan scam apps on Android than on iOS," the researchers wrote. "Outside the US, Android is much more popular, with more than 70 percent of the market, partly because of the availability of extremely low-cost Android devices."
After users downloaded the app, they were required to give information typical for such a loan, like name, address, and employment history. However, they also were told to grant permissions to data on the device. Many of the apps began exfiltrating contact information as soon as the permissions are given.
The victims would receive some of the loan they applied for – unlike similar scams – but it would come with fees that amounted to up a third of the amount borrowed. After that, extremely high interest rates were applied and the borrowers were told to repay the loan within days, much of which was contrary to the lending details the load app promised.
"This approach has the advantage of a veil of legitimacy where the perpetrators can hide behind complex and unethical contract terms," Clements said. "This potentially offsets liability, both from potentially convincing victims that the scam is perfectly legal, as well as from authorities who would react very differently from more traditional forms of online fraud."
While a loan app scam can be time- and resource-consuming, "the payoff is more significant with extorting the victims," James McQuiggan, security awareness advocate at KnowBe4, told The Register .
"Similar to the business world, cybercriminals will invest in something if it has a high return for them. With the high-interest rates and extorting the victims, they no doubt wanted to make their money back with the first dozen victims, and then the money started rolling in for them after that." ®
Get our [11]Tech Resources
[1] https://www.lookout.com/blog/predatory-loan-apps?utm_source=release&utm_medium=pr&utm_content=predatoryloans
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.statista.com/statistics/268251/number-of-apps-in-the-itunes-app-store-since-2008/
[7] https://www.statista.com/statistics/266210/number-of-available-applications-in-the-google-play-store/
[8] https://www.theregister.com/2022/11/01/india_lending_app_crackdown_ordered/
[9] https://www.indiatoday.in/technology/news/story/google-has-removed-2000-personal-loan-apps-from-play-store-in-india-1992668-2022-08-26
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y4iJTs63lIbjI6bHHYf8WgAAAAQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
Re: A Lending app ??
tony72
I was going to "ask who turns to some random app in the app store when they need a loan?" But as the article says, users in developing countries were targeted. I'm guessing there may be significant numbers of users that don't have bank accounts and do everything on their phone, so maybe for them it's not so strange.
Computer Says 'Yes'...
Lil Endian
The man on the Clapham omnibus just doesn't apply filters to information spewed through a digital device in the same was as he does with (eg) paper info. Even when explained, it's almost always wilfully ignored, because of something like "you're paranoid" or "everyone's doing it, so it must be fine".
I'm happy to stay with "Man" on the Clapham omnibus in this case, as women appear to much better at this error/BS checking (although that's an observation of mine, rather than empirically sourced).
[Icon: because even if the care is genuine and founded, it's probably an exercise in futility to attempt intervention. Ho hum.]
Re: Computer Says 'Yes'...
Anonymous Coward
I've been helping at some sessions on introducing digital skills to the elderly. question I often ask early on is: "If someone came up to you in the street and asked to borrow £500, and let them have your bank details so they can pay you back next week, what would you do?" The reply is always something like "they'd walk away". We then talk about online offers...
I also explain that almost all scams start out with a digital failure - one of the digits at the end of your arm.
Obvious flaw here
trevorde
Why not just get a burner phone, take out a loan and... profit!
Shirley...
Lil Endian
I'm not seeing a /sarc or joke icon, so benefit of the doubt!
A Lending app ??
There are apps for getting loans? I'm confused, you can afford an iGizmo, but need a loan? We need a rock icon... one I can crawl back under. Lending apps, geesh.
Maybe there's a rock in my coat pocket?