Notifications
Clear all
Topic starter
19/08/2026 3:51 pm
TL;DR: Financial fraud is moving from bank infrastructure to consumer devices and mobile execution, with attackers using social engineering, deepfakes, malware, and modded apps to bypass server-side controls, according to Guardsquare. The control gap is no longer just detection latency but the assumption that the mobile client is a trusted execution environment.
NHIMG editorial — based on content published by Guardsquare: How Digital Fraud is Shifting to the Mobile Layer
By the numbers:
- Scammers stole over $1 trillion in 2024, according to the Global Anti-Scam Alliance.
Questions worth separating out
Q: How should security teams handle fraud risk when the mobile app is the execution layer?
A: Treat the mobile app as a control surface, not a passive channel.
Q: Why do backend fraud systems miss many mobile-driven attacks?
A: Because many mobile attacks alter the context before the backend sees anything suspicious.
Q: What do organisations get wrong about digital identity verification in mobile onboarding?
A: They often assume a passed KYC flow means the applicant and device were trustworthy.
Practitioner guidance
- Add client-integrity checks to fraud scoring Incorporate runtime signals such as hooking, debugging, repackaging, and attestation failures into transaction and onboarding risk decisions before approval.
- Harden digital onboarding against synthetic identity abuse Require layered verification that combines liveness, device trust, and behavioural checks so a single successful selfie or document scan cannot complete enrolment.
- Move mobile telemetry into identity decisioning Feed app integrity and device trust data into IAM and fraud policy engines so the mobile session influences step-up, deny, or approve outcomes.
What's in the full article
Guardsquare's full article covers the operational detail this post intentionally leaves for the source:
- How mobile app hardening and runtime protections reduce reverse engineering and tampering.
- The specific fraud patterns observed in mobile environments, including malware-assisted abuse and modded apps.
- How app attestation can verify whether API requests originate from a genuine, untampered app on a trustworthy device.
- Why mobile telemetry improves fraud decisioning when combined with backend analytics.
👉 Read Guardsquare's analysis of how digital fraud is shifting to the mobile layer →
Mobile-layer fraud is growing, are your controls still backend-only?
Explore further
19/08/2026 4:26 pm
Mobile fraud is becoming a trust-execution problem, not just a detection problem. The article correctly identifies that attackers win when they control the device and app session, because backend controls then validate attacker-shaped behaviour. For identity programmes, this is the same structural mistake seen in other trust failures: assuming the channel is trustworthy because the backend is protected. The practitioner conclusion is that trust must be established at the point of execution.
A question worth separating out:
Q: What should fraud and IAM teams do when mobile fraud patterns change faster than rules can keep up?
A: Move from static rule dependency to adaptive policy. Use app integrity, device trust, and behavioural risk to drive step-up authentication, friction, or denial in real time. That reduces overreliance on post-event review and gives defenders a chance to stop fraud at the point of execution.
👉 Read our full editorial: Digital fraud is shifting to the mobile layer and bypassing backend trust
