Financial Services

The financial risks with super apps and how to tackle them

As banks and financial institutions (FIs) foray into verticals other than their core offerings, customers see financial super apps as a one-stop shop for their payment, banking, and financial needs.

Financial super apps bundle day-to-day financial functions such as bill payment, grocery shopping, and ride-hailing with long-term financial planning and wealth management services. Although this enhances the customer experience, it exposes FIs and end-users to considerable personal and financial risk.

What is a financial super app?

A financial super app is an umbrella platform offering a comprehensive suite of financial products and services. It typically integrates the following features:

• A scalable, standalone app with a core function
• Add-on services that complement the core offering
• Third-party partnerships to expand the product suite
• Analytics integration to enable hyper-personalisation and better service

Financial super apps spell convenience for customers by aggregating all their financial needs onto a single platform. They benefit FIs by simplifying transactions, data management, and product marketing.

Potential risks in super app usage

FIs taking their services to a financial super app can benefit from lower operational costs and access to newer data sources. However, these additional services increase financial risks and cybercrimes.

Web applications are comparatively safe since end-users can only engage with their front-end code. Mobile gadgets, however, store the source code within the device. This means that the attack surface grows with every application the user downloads. FIs can control neither the security and hygiene of user devices nor customers’ digital behaviour.

Below are some major risks inherent in financial super app usage:

Phishing attacks

According to studies, 75% of phishing attacks in 2021 specifically targeted mobile devices. Mobile phishing attacks have been growing at the rate of 85% annually.

In-app vulnerabilities

Inadequate app security features greatly increase personal and financial risk. 42% of organisations report security breaches due to in-application vulnerabilities, such as -

• Inadequate jailbreak detection
• Lack of end-to-end data encryption
• Lack of source code integrity
• No automatic logout or session expiration

Man-in-the-middle attacks

Financial super apps are extremely susceptible to man-in-the-middle attacks, where hackers intercept data in transit and steal usernames, passwords, bank account credentials, and credit card numbers.

Money-laundering opportunities

Money laundering and siphoning funds to terrorist organisations are the biggest and most detrimental fallout of online marketplaces. E-commerce sites, online payment portals, and mobile applications enable criminals to launder money through legitimate payment ecosystems and complicit hosts and use it for illegal activities.

Moreover, developers are now looking at enabling cryptocurrency payments through financial super apps. This will make it easier for malicious organisations to trade on the black market without leaving a trace. The more the app functions and offerings, the greater the potential attack surface and financial risk.

What can banks and FIs do?

To fortify financial super apps, banks and FIs must develop apps with strong built-in security measures. Here are two key ways to mitigate financial risk and enhance super app security:

Build robust in-app security features

Financial super app developers must write code that enables -

• Mobile app shielding
• Runtime protection
• Jailbreak detection
• End-to-end data encryption
• Automated updates
• Multi-factor authentication with strong passwords and one-time codes
• Biometric verification involving fingerprints, voice recognition, and facial recognition
• Automatic logout after a period of inactivity

Built-in security insulates financial super apps against reverse engineering, malware, and common cyber threats such as man-in-the-middle. Biometric tools can easily authenticate customers and securely onboard new users.

Optimise CDD measures

Customer Due Diligence (CDD) practices are essential for mitigating fraud and financial risks and staying compliant with Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements. To improve their CDD processes, FIs must -

• Optimise KYC by relevant data collection methods, automation, and plugging the gaps between AML regulations and KYC policies.
• Use AI tools and biometrics for identity verification
• Aggregate publicly available user data to minimise customer reach
• Invest in a data-driven risk assessment model to determine the customer risk score
• Improve financial risk management by assessing KYC data for critical insights and segmenting customers based on their risk score
• Practice continuous monitoring to detect questionable activities or red flags in real-time
• Automate audit and compliance functions and run them on a schedule

With adequate in-app security features and CDD measures, FIs can prevent the abuse of their financial super apps.

For organisations on the digital transformation journey, agility is key in responding to a rapidly changing technology and business landscape. Now more than ever, it is crucial to deliver and exceed organisational expectations with a robust digital mindset backed by innovation. Enabling businesses to sense, learn, respond, and evolve like living organisms will be imperative for business excellence. A comprehensive yet modular suite of services is doing precisely that. Equipping organisations with intuitive decision-making automatically at scale, actionable insights based on real-time solutions, anytime/anywhere experience, and in-depth data visibility across functions leading to hyper-productivity, Live Enterprise is building connected organisations that are innovating collaboratively for the future.

How can Infosys BPM help?

Infosys BPM financial sector services help organisations improve their operating models, optimise business performance, and standardise processes with reduced costs. Know more about our business process management in financial services.