Account Takeover
Credentials work from any device.
Threat Intelligence
Device Binding & Trusted Enrollment
Severity: highAuthenticationSession / Device Trust
Affected: Mobile Banking · Open Banking · Corporate Banking
Threat IntelligenceFraud PreventionPSD2 SCA
Weak or missing device binding allows stolen credentials and session tokens to be used from attacker-controlled devices — enabling account takeover, credential stuffing and SIM-swap fraud.
High
ATO Risk
Without binding
Required
PSD2 Relevance
Possession factor
Common
Implementation Gap
Token-only auth
60–80%
Fraud Reduction
With strong binding
Attack chain
Typical exploitation path in mobile banking
1Phish creds
2Steal token
3New device
4Session replay
5Fraud
Kill Chain
How this attack happens
End-to-end attack timeline observed in mobile banking incidents.
Step 1
Credential theft
Phishing, malware or breach provides login.
Step 2
Token extraction
Session token stolen from device or MITM.
Step 3
Replay on new device
Attacker uses token without enrollment.
Step 4
Account access
Full banking session on untrusted device.
Step 5
Fraud transfer
Payments initiated without step-up.
Business Impact
Impact on financial institutions
Operational, financial and regulatory consequences for BFSI.
Estimated severity
critical
Credential Stuffing
Automated login from bot farms.
SIM Swap Fraud
OTP intercepted on attacker SIM.
PSD2 Non-compliance
Possession factor not demonstrated.
SOC Intelligence
Observed risk signals
Typical APK assessment findings mapped to this threat.
critical
No device fingerprint on login
Backend cannot distinguish devices.
high
Token in plaintext storage
Easily extracted by malware.
high
No step-up for new device
Silent enrollment possible.
Detection
How MobAIsec detects this threat
Four-phase governance pipeline — deterministic evidence only.
Phase 1
Static Analysis
- ›Hardware-backed key usage
- ›Device ID generation review
- ›Secure token storage
Phase 2
Runtime Intelligence
- ›Enrollment flow analysis
- ›Token binding signals
Phase 3
Governance Mapping
- ›PSD2 possession factor
- ›MASVS-AUTH-3
- ›CBUAE
Phase 4
Evidence Collection
- ›Keystore / Keychain usage proof
Static Analysis→Runtime Intelligence→Governance Mapping→Evidence Collection
Mitigation
Recommended banking controls
Layered defenses with coverage, effort and effectiveness ratings.
Cryptographic Device Binding
Coverage: Very HighProtects: Token replay prevention
Effort
High
Effectiveness
90%
Bind refresh tokens to hardware-backed keys.
Step-up on New Device
Coverage: HighProtects: Enrollment fraud
Effort
Medium
Effectiveness
85%
In-branch, video KYC or push to registered device.
Behavioral Analytics
Coverage: HighProtects: Unknown device patterns
Effort
High
Effectiveness
80%
Featurespace / BioCatch complement.
Regulatory Intel
Banking regulations requiring this protection
Compliance confidence and mapped control counts per jurisdiction.
UAE
CBUAE
Compliance confidence94%
12 mapped controls
View mandate →India
RBI
Compliance confidence88%
9 mapped controls
View mandate →Singapore
MAS
Compliance confidence96%
11 mapped controls
View mandate →EU
EBA / PSD2
Compliance confidence91%
10 mapped controls
View mandate →United States
FFIEC
Compliance confidence85%
8 mapped controls
View mandate →Framework Alignment
Security framework alignment
How this threat maps across MASVS, OWASP Mobile, PCI DSS, PSD2, NIST and DORA.
| Control | MASVS | OWASP Mobile | PCI DSS | PSD2 | NIST | DORA |
|---|---|---|---|---|---|---|
| Device binding | ◐ | ◐ | ○ | ● | ● | ◐ |
| Secure token storage | ● | ● | ● | ● | ● | ● |
Executive Summary
Executive risk summary
Board-ready risk dimensions and impact heatmap.
Lower = higher residual risk
Likelihood80%
Impact85%
Exploitability75%
Compliance Risk88%
Impact heatmap
ATO
L: 85%
I: 90%
Vendor Intel
Enterprise protection vendors
RASP, attestation and device-trust solutions for banking programs.
Approov
Runtime app attestation
Enterprise
Banking: excellent
Pros
- + Device + app integrity
Limitations
- − Cost
Transmit Security
CIAM + device trust
Enterprise
Banking: good
Pros
- + Banking-focused
Limitations
- − Platform lock-in risk
iovation FraudForce
Device fingerprinting
Enterprise
Banking: good
Pros
- + Mature fraud graph
Limitations
- − Privacy considerations
APK Preview
APK threat intelligence preview
Sample assessment output for Device Binding exposure.
Risk score
42
/ 100
2 critical findings
Observed risks
- ✗No hardware-backed token binding
Mapped controls
PSD2-SCAMASVS-AUTH
Upload APK to validate →Related Intel
Related intelligence
Related threats
Adjacent attack patterns
Related frameworks
Governance standards
FAQ
Threat intelligence FAQ
SEO-optimized answers for security and governance teams.
What is device binding in mobile banking?
Cryptographically associating a user session with a trusted device fingerprint so tokens cannot be replayed on attacker hardware.
How does PSD2 relate to device binding?
PSD2 SCA requires a possession factor — device binding is the standard way mobile apps demonstrate possession.
Take action
Validate your banking APK against Device Binding
Upload your Android banking app for evidence-backed threat intelligence — no hallucinated findings.
- ✓Threat exposure score
- ✓Runtime hardening analysis
- ✓Banking compliance mapping
- ✓Fraud readiness score
- ✓Executive PDF report
- ✓Remediation guidance