Vishing defence method and system

Abstract

The invention relates to a computer-implemented system of defending against a vishing attack in which an attacker makes a voice call to an intended vishing attack victim's mobile phone that has a financial transaction application (transaction app) installed in the mobile phone programmable logic means. The system includes a computer system configured for installation in a computer system of the financial institution associated with the transaction app. The system also includes a supplementary computer system configured to communicate with the financial institution computer system and participating mobile phones. When the financial institution computer system transmits a notification to the supplementary computer system, it is programmed to direct the phone supplementary app to scan for the occurrence of a vishing procedure. Upon detection of a vishing procedure, the supplementary app communicates with one or more of the financial institution and supplementary computer systems, to raise an appropriate alarm.

Description

Vishing Defence Method And SystemField of the invention

[0001] This invention relates to a method and system of defending against voice phishing or vishing cybercrime.Background to the invention

[0002] Voice phishing or vishing is the use of voice calling and messaging to conduct phishing attacks. The term “phishing" describes activities that fraudsters use as "bait" to catch victims on the Internet.

[0003] The unique attributes of vishing attacks make it particularly difficult for financial institutions and governments to curb vishing cybercrime and, to date, these entities have yet to find systems or tools to defend effectively against vishing fraud.

[0004] The vishing defence system invention described and claimed in the applicant's PCT application (international Patent Application no. PCT / ZA2022 / 050013) addresses these challenges by providing a system for defending against vishing based on the principle of providing a customer-side defence — a defence executed by the intended victim of vishing fraud. Customerside defences are potentially the most effective form of defence against vishing attacks, since visiting attacks are live attacks that target the customer or victim directly. The financial institution has no knowledge of the occurrence of the attack and, self-evidently, is powerless to do anything about it whilst the attack was inprogress. In the circumstances, the customer is isolated in the fraudster's call and, once the attack is in progress the customer is exposed, directly and in real time, to the calling fraudster's manipulative social engineering techniques. The financial institution, if it learns of the vishing attack at all, will only know of the attack after the attack has been executed.

[0005] The vishing defence system described and claimed in PCT application no. PCT / ZA2022 / 050013 is directed to a computer implemented method and system of defending against a vishing attack in which an attacker makes a voice call to an intended vishing attack victim's mobile phone which, typically, has a financial transaction application (typically a banking app) installed in the mobile phone (in the phone programmable logic means) . The vishing defence system is implemented in the phone by means of a computer vishing defence application or app installed on the phone, typically as a subsystem or module of the financial institution's banking app.

[0006] As described and claimed in PCT / ZA2022 / 050013, the vishing defence app is programmed: to direct the mobile phone programmable logic means to treat each voice call incoming to the mobile phone as a trigger to determine the calling credentials of every incoming voice call; if the calling credentials cannot be determined, to direct the mobile phone programmable logic means to scan for the occurrence of a predetermined vishing procedure executed by means of the mobile phone; and if the execution of such a predetermined vishing procedure is detected, to direct the mobile phone programmable logic means to notify the associated financial institution of the occurrence of the vishing procedure, which enables the financial institution to implement its predetermined vishing risk and avoidance protocols.

[0007] The “calling credentials" of an incoming voice call are data associated with the phone that is used to make the call incoming to the intended victim's mobile phone. The only calling credentials required are the phone number data of thephone that is used to make the incoming call.

[0008] “ Indeterminate calling credentials" are calling credentials that the intended vishing attack victim's call-receiving mobile phone is unable to resolve, which means that the receiving phone is unable to determine at least the phone number of the phone that is used to make the incoming call.

[0009] A “predetermined vishing procedure" is one of a number of specific vishing procedures used in vishing attacks, including: a procedure carried out during or a predetermined time before the occurrence of the voice call being monitored, the procedure comprising processing a One Time Password (OTP) by or by means of the mobile phone; a procedure carried out during the occurrence of the voice call being monitored, the procedure comprising opening of the transaction app on the mobile phone and processing, by means of the transaction app, an in- app transaction authorisation request; a procedure carried out during the occurrence of the voice call being monitored, the procedure comprising the entry, by means of the mobile phone keypad or touch screen, of a number sequence that matches the number sequence of any one of a number of significant number sequences previously stored in the mobile phone programmable logic means; and a procedure carried out during the occurrence of the voice call being monitored, the procedure comprising voice entry of a number sequence that matches the number sequence of any one of a number of significant number sequences previously stored in the mobile phone programmable logic means.

[0010] Of all these procedures, it is only the first procedure — processing received OTP data — that raises any privacy or security concerns. The remaining procedures are processes that occur internally of the phone and are monitored only by the phone. Data security is therefore not an issue, nor is data privacy, since a process that occurs internally on the phone constitutes the processing of phone data by the phone. In other words, the owner of the phone (data subject) processes their owndata, which avoids contravention of data privacy laws.

[0011] The OTP processing procedure raises potential data privacy and security concerns since, technically speaking, it involves the processing of externally derived OTP data received from an external processor.

[0012] It is an object of this invention to address this concern.Summary and Description of the invention

[0013] This invention provides a computer implemented system of defending against a vishing attack in which an attacker makes a voice call to an intended vishing attack victim's mobile phone that has a financial transaction application (transaction app) installed in the mobile phone programmable logic means, the system comprising: a mobile phone application orapp (phone supplementary app) configured for installation in the programmable logic means of participating mobile phones, being mobile phones that have the transaction app installed on the mobile phone; a computer system configured for installation in a computer system of the financial institution associated with the transaction app, the financial institution computer system being configured: to communicate with participating mobile phones and to authorise transactions conducted by way of the transaction app by means of an authorisation code communicated to the mobile phone: a supplementary computer system configured to communicate with the financial institution computer system and with the participating mobile phones: the financial institution computer system being programmed to transmit a transmission notification to the supplementary computer system uponcommunication of an authorisation code to a participating mobile phone, the transmission notification including at least: a notification of the communication of an authorisation code; the time of the communication; the calling credentials of the mobile phone to which the authorisation code communication is communicated; and a set duration validity period commencing on the time of the communication, during which the authorisation code will remain valid for authorisation of a transaction; the supplementary computer system being programmed, upon receipt of the financial institution computer system transmission notification: to communicate with the mobile phone; to set a scanning period commencing on the time of the communication of the authorisation code to the mobile phone and expiring on expiry of the validity period; and directing the phone to communicate an instruction to the phone supplementary app to enter a scanning mode programmed into the phone supplementary app, in which the phone supplementary app scans the mobile phone for the occurrence of a predetermined vishing procedure executed by means of the mobile phone; and if the supplementary app detects the execution of a predetermined vishing procedure, to communicate with one or more of the financial institution and supplementary computer systems, to raise an appropriate alarm.

[0014] The authorisation code could be any authorisation code, but typically it will be an OTP.

[0015] It will be appreciated that references to the execution of programmed functions by the mobile phone or the mobile phone apps is in fact a reference to execution of such functions by the mobile phone programmable logic means, thereference being used for the sake of brevity and clarity.

[0016] The financial institution computer system, typically, would be the conventional computer systems of the financial institution, with the computer programs of the vishing defence system of the invention simply being incorporated and programmed into the computer programs of the financial institution.

[0017] The supplementary computer system could be a separate computer system operated by a third-party service provider or it could be a computer system operated by the financial institution, with the computer programs of the supplementary computer system simply being incorporated and programmed into the computer programs of the financial institution.

[0018] The vishing defence system of this invention does not process any of the OTP data transmitted and processed by the mobile phone. All such processing is done in and by the mobile phone separately of and external to the vishing defence system of this invention. As a result, the vishing defence system of the invention does not introduce either data security or data privacy issues.

[0019] In the case of the vishing defence system of this invention, the “predetermined vishing procedures" that the supplementary app will scan for include: voice calls with indeterminate calling credentials — the supplementary app could be programmed for this procedure, on its own, not to raise an alarm, but simply to ensure continued scanning for the remaining vishing procedures; opening of the transaction app on the mobile phone and processing, by means of the transaction app, of an in-app transaction authorisation request;

[0020] if the supplementary app detects the execution of any such a predetermined vishing procedure, the supplementary app will raise an appropriate alarm.

[0021] The computer implemented vishing defence system of this invention isequally applicable to defend against a vishing attack in which an intended vishing attack victim makes a voice call on the intended victim's mobile phone to a potential vishing attacker.

[0022] To avoid unnecessary duplication, the application of the vishing defence system of the invention to outgoing voice calls will not be described in any detail because of substantial similarity between the procedures implemented and terminology relating to incoming calls and vishing attacks must, in this specification, be interpreted to apply equally to outgoing calls and vishing attacks occurring on outgoing calls — if the intended victim makes an outgoing voice call in the validity period, the supplementary app will set a scanning period and direct the phone to communicate an instruction to the phone supplementary app to enter a scanning mode programmed into the phone supplementary app, as described above.

[0023] The invention includes a computer implemented method of defending against a vishing attack in which an attacker makes a voice call to an intended vishing attack victim’s mobile phone that has a financial transaction application (app) installed in the mobile phone programmable logic means, the method comprising the steps of: installing a mobile phone app, as a phone supplementary app, in the programmable logic means of a participating mobile phone, being a mobile phone that has the transaction app installed; configuring a computer system for installation in a computer system of the financial institution associated with the transaction app, the financial institution computer system being configured: to communicate with participating mobile phones; and to authorise transactions conducted byway of the transaction app by means of an authorisation code communicated to the mobile phone; configuring a supplementary computer system discrete from the financial institution computer system to communicate with the financial institution computer system and with the participating mobile phones;programming the financial institution computer system to transmit a transmission notification to the supplementary computer system upon communication of an authorisation code to a participating mobile phone, the transmission notification including at least: a notification of the communication of an authorisation code; the time of the communication; the calling credentials of the mobile phone to which the authorisation code communication is communicated; and a set duration validity period commencing on the time of the communication, during which the authorisation code will remain valid for authorisation of a transaction; programming the supplementary computer system, upon receipt of the financial institution computer system transmission notification: to communicate with the mobile phone; to set a scanning period commencing on the time of the communication of the authorisation code to the mobile phone and expiring on expiry of the validity period; and to direct the phone to communicate an instruction to the phone supplementary app to enter a scanning mode programmed into the phone supplementary app, in which the phone supplementary app scans the mobile phone for the occurrence of a predetermined vishing procedure executed by means of the mobile phone; and programming the supplementary app to communicate with one or more of the financial institution and supplementary computer systems, to raise an appropriate alarm if the supplementary app detects the execution of a predetermined vishing procedure executed by means of the mobile phone.

[0024] The method may include the steps of programming the phone supplementary app to scan the mobile phone for the occurrence of a vishingprocedure constituted by a voice call with indeterminate calling credentials.

[0025] In this embodiment of the invention, the method may further include the steps of programming the phone supplementary app, upon detecting the occurrence of the indeterminate calling credentials vishing procedure on its own, to not raise an alarm and to remain in the scanning mode, in which the supplementary app is programmed to scan the mobile phone for the occurrence of a further vishing procedure executed by means of the mobile phone.

[0026] The computer implemented method may include, in addition, the steps of programming the phone supplementary app to scan the mobile phone for the occurrence of a vishing procedure constituted by opening of the transaction app on the mobile phone and processing, by means of the transaction app, of an in- app transaction authorisation request.

[0027] The invention includes a mobile phone app substantially as described above, configured for installation, as a phone supplementary app, in the programmable logic means of a mobile phone.

[0028] The invention further includes a data processing system comprising means for carrying out the vishing defence system described above.

[0029] Yet further, the invention includes a data processing system programmed to carry out the computer-implemented method described above.

[0030] In all instances, when the financial institution is alerted to the occurrence of a vishing attack, this will enable the financial institution to implement its own measures which, typically, will comprise of a number of escalating risk protocols, ranging from alerting the customer to implementing measures to prevent the electronic transaction from proceeding. In this regard, financial institutions have standard protocols to deal with potential and actual interference with their customers' financial transactions and electronic financial transactions. These standard protocols would require little modification to serve as appropriate preventative measures for use with the electronic transaction vishing defence system of the invention.

[0031] Preferably only the financial institution is alerted to the occurrence of a vishing attack. The user is not alerted.

[0032] In the first instance, this ensures that the user's customer experience does not change during normal financial transactions on the transaction app.

[0033] In addition, this enables the financial institution to implement preventative measures in a non-intrusive manner and to escalate the preventative measures progressively, eventually to terminate the financial transaction process if it becomes evident that the early warning app has in fact detected a vishing attack. Equally importantly, the financial institution, which is much better resourced than the average banking app user to deal with potential and actual vishing attacks. Besides, while the attack is still in progress, the financial institution can obtain the contact details of the vishing attacker, who is unlikely to know that they are being tracked and possibly located.

[0034] The vishing defence system of the invention makes use of one of the most effective tools at the disposal of financial institutions in the battle against vishing fraud, which is the institution's electronic transaction (banking) app. The app is a digital “representative" of the financial institution that has the advantage of being available at all times and, since it is implemented on the customer's mobile phone, has ready access to the mobile phone calls and call logs. The app is also able to access and interact with the servers of the financial institution and / or its security service providers in real time for purposes of caller verification, for instance. In addition, with suitable permissions, the app can be programmed to perform background operations even while it is not in active use.

Claims

Claims1. A computer implemented system of defending against a vishing attack in which an attacker makes a voice call to an intended vishing attack victim's mobile phone that has a financial transaction application (app) installed in the mobile phone programmable logic means, the system comprising: a mobile phone app configured for installation, as a phone supplementary app, in the programmable logic means of participating mobile phones, being mobile phones that have the transaction app installed; a computer system configured for installation in a computer system of the financial institution associated with the transaction app, the financial institution computer system being configured: to communicate with participating mobile phones: and to authorise transactions conducted byway of the transaction app by means of an authorisation code communicated to the mobile phone: a supplementary computer system configured to communicate with the financial institution computer system and with the participating mobile phones: the computer system being programmed to transmit a transmission notification to the supplementary computer system upon communication of an authorisation code to a participating mobile phone, the transmission notification including at least: a notification of the communication of an authorisation code: the time of the communication:the calling credentials of the mobile phone to which the authorisation code communication is communicated; and a set duration validity period commencing on the time of the communication, during which the authorisation code will remain valid for authorisation of a transaction; the supplementary computer system being programmed, upon receipt of the financial institution computer system transmission notification: to communicate with the mobile phone; to set a scanning period commencing on the time of the communication of the authorisation code to the mobile phone and expiring on expiry of the validity period; and directing the phone to communicate an instruction to the phone supplementary app to enter a scanning mode programmed into the phone supplementary app, in which the phone supplementary app scans the mobile phone for the occurrence of a predetermined vishing procedure executed by means of the mobile phone; and if the supplementary app detects the execution of a predetermined vishing procedure, to communicate with one or more of the financial institution and supplementary computer systems, to raise an appropriate alarm.

2. The computer implemented system of claim 1, in which the phone supplementary app is programmed to scan the mobile phone for the occurrence of a vishing procedure constituted by a voice call with indeterminate calling credentials.

3. The computer implemented system of either of claims 1 or 2, in which the phone supplementary app is programmed to scan the mobile phone for the occurrence of a vishing procedure constituted by opening of the transaction app on the mobile phone and processing, by means of the transaction app,of an in-app transaction authorisation request.

4. The computer implemented system of claim 2, in which the phone supplementary app is programmed, upon detecting the occurrence of the indeterminate calling credentials vishing procedure on its own, to not raise an alarm and to remain in the scanning mode, in which the supplementary app is programmed to scan the mobile phone for the occurrence of a further vishing procedure executed by means of the mobile phone.

5. A computer implemented method of defending against a vishing attack in which an attacker makes a voice call to an intended vishing attack victim's mobile phone that has a financial transaction application (app) installed in the mobile phone programmable logic means, the method comprising the steps of: installing a mobile phone app, as a phone supplementary app, in the programmable logic means of a participating mobile phone, being a mobile phone that has the transaction app installed; configuring a computer system for installation in a computer system of the financial institution associated with the transaction app, the financial institution computer system being configured: to communicate with participating mobile phones: and to authorise transactions conducted byway of the transaction app by means of an authorisation code communicated to the mobile phone: configuring a supplementary computer system discrete from the financial institution computer system to communicate with the financial institution computer system and with the participating mobile phones: programming the financial institution computer system to transmit a transmission notification to the supplementary computer system upon communication of an authorisation code to a participating mobile phone, the transmission notification including at least:a notification of the communication of an authorisation code; the time of the communication; the calling credentials of the mobile phone to which the authorisation code communication is communicated; and a set duration validity period commencing on the time of the communication, during which the authorisation code will remain valid for authorisation of a transaction; programming the supplementary computer system, upon receipt of the financial institution computer system transmission notification: to communicate with the mobile phone; to set a scanning period commencing on the time of the communication of the authorisation code to the mobile phone and expiring on expiry of the validity period; and to direct the phone to communicate an instruction to the phone supplementary app to enter a scanning mode programmed into the phone supplementary app, in which the phone supplementary app scans the mobile phone for the occurrence of a predetermined vishing procedure executed by means of the mobile phone; and programming the supplementary app to communicate with one or more of the financial institution and supplementary computer systems, to raise an appropriate alarm if the supplementary app detects the execution of a predetermined vishing procedure executed by means of the mobile phone.

6. The computer implemented method of claim 5, including the steps of programming the phone supplementary app to scan the mobile phone for the occurrence of a vishing procedure constituted by a voice call with indeterminate calling credentials.. The computer implemented method of either of claims 5 or 6, including the steps of programming the phone supplementary app to scan the mobile phone for the occurrence of a vishing procedure constituted by opening of the transaction app on the mobile phone and processing, by means of the transaction app, of an in-app transaction authorisation request.

8. The computer implemented method of claim 6, including the steps of programming the phone supplementary app, upon detecting the occurrence of the indeterminate calling credentials vishing procedure on its own, to not raise an alarm and to remain in the scanning mode, in which the supplementary app is programmed to scan the mobile phone for the occurrence of a further vishing procedure executed by means of the mobile phone.

9. A mobile phone app according to claim 1 configured for installation, as a phone supplementary app, in the programmable logic means of a mobile phone.

10. A data processing system comprising means for carrying out the vishing defence system of any one of claims 1 to 4.

11. A data processing system programmed to carry out the computer- implemented method of any one of claims 5 to 8.