SuperCard X - Tap and Beware

Think twice before tapping! A sneaky new way for criminals to steal your money has popped up, and it uses your phone's tap-to-pay feature (NFC). It's like a "malware-for-rent" service called 'SuperCard X' that helps bad guys target Android phones.
​

Here's the simple version of how it works:
​

1. Fake Message: You get a fake text or WhatsApp pretending to be your bank. It says there's a problem and you need to call a number.
2. Smooth Talker: A crook answers, acting like a bank worker. They trick you into giving them your card number and PIN over the phone. They might even try to get you to raise your spending limits in your banking app.
3. Fake App: They then convince you to download a seemingly harmless app (they might call it "Reader") that actually contains the SuperCard X malware.
4. The "Tap" Trick: The app asks for very few permissions, mostly just to use your phone's NFC. The crook then tells you to tap your bank card on your phone to "verify" it.
5. Secret Data Grab: When you tap, the hidden malware reads your card's information and secretly sends it to the criminals.
6. Digital Copy: The crooks use this stolen info on another phone with a special app ("Tapper") that acts like a digital copy of your card.
7. Easy Spending: Now, they can just tap their phone at stores and ATMs to make small, hard-to-trace purchases using your money.

This is particularly scary because:

• Sneaky Taps: Because the transactions are small and look normal, banks might not flag them as fraud right away.
• Hard to Detect: This malware is designed to be sneaky and isn't easily picked up by phone security software.

The bad guys behind this seem to be Chinese speakers, and they're even offering support to other criminals who want to use this method. This scam has already been seen in Italy.

What Google says:

Google says their Play Protect system should help protect you from apps with this kind of malware if you download them from the official Play Store. But be careful about installing apps from anywhere else!

The bottom line: Be super careful about messages asking you to call numbers or download apps, especially if they're about your bank. Don't tap your card on your phone if someone you don't trust tells you to!

Ep323

Image created by AI