Assume a customer of a bank is using online banking facility and he is using an online banking application on mobile (android).

There could be a possibility that particular mobile could be compromised and the purpose of having dual factor authentication could be void. The attacker could initiate online transaction through installed online application and he will receive the OTP to same mobile.

Is it safe to receive OTP to the same mobile where the online application is being used? Or any other alternate way of ensuring purpose of dual factor authentication?

1 Answer 1


Sensitive services' OTP to a mobile is not a good idea. Banks should use hardware OTP or other else.

The typical attack vector for OTPs are three types.

Gaining control of the phone

Well. Literally.

Mobiles, though not so often these days, are easily compromised. Especially, Android applications can freely access the SMS messages(of course with permission).

Exploiting the SMS spam block feature

Most carriers now support automatic spam block, which blocks spam before entering user's phone. Users can log in to the spam control system, set spam numbers, and view spam SMSes.

The attacker uses credientials from breached data, sets the target(ex. bank)'s number as a spam number, and successfully gain OTP data from the spam control system.

SIM Swap/Copy

One particular vulnerability that has gained popularity with hackers is SIM card fraud. This is basically an attack that essentially dupes your telco into swapping your line of communication to a different SIM card that the hackers have in their possession. This allows a culprit to take over your phone line. Every time you call your GSM provider with any sensitive request, they’ll ask you for some personal data that helps them identify you as the true owner of the line. This is where hackers come in. Armed with personal information on you, a fraudster has the ability to request a SIM change.

Source: https://www.standardmedia.co.ke/business/article/2001296918/sim-card-fraud-why-it-hurts-when-it-hits

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .