NFC Malware Allows Real-Time Theft Of Victims’ Bank Cards

by Justin Erickson

Security researchers at Group-IB have identified a new Android malware family called WindRelay that allows criminals to relay contactless bank card transactions in real time – it is being used alongside SpyNote, a remote access trojan (RAT), and socially-engineered phone calls. While the victim is on the phone, the attacker instructs them to tap their physical bank card against the NFC (Near Field Communication) enabled phone and enter their PIN. WindRelay then transmits it to another attacker-controlled device, which then relays the transaction to a payment terminal or ATM. To stay safe against scams like these:

1. Be skeptical of unknown calls and messages – especially if they push you into urgency and acting fast.
2. Call your bank/institution through their official number.
3. Never give your personal information to unexpected callers.
4. Don’t install apps on your device outside the official Playstore.
5. Install a trustworthy antivirus on your device.

(advice from MalwareBytes)