Mobile shopping has been wildly successful in part because it is fun and instantly gratifying. But the potential consequences of unmanaged mobile devices are serious business. Retailers stand to lose precious dollars and see narrow profit margins erode if customers decide it’s not safe or worth the hassle to shop on their smartphones and tablets. Impulse purchases, convenience ordering of groceries and household sundries, and social media-linked transactions are particularly dependent on smooth and easy mobile shopping.

Moreover, mobile apps play a vital role in driving in-store purchases by way of targeted promotions, local inventory confirmation, and pre-purchase research. Shoppers spend double the time on retail sites from their mobile devices compared to desktop viewing.

The threat of public breach notifications, penalties, reputational damage, and operational outages are at the forefront of retail industry challenges. The EU’s GDPR privacy rules (effective May 2018) have introduced further complications to data management processes, with significant penalties at stake.

After many years of high profile breaches and exposure notices, consumers are weary and wary. Cautionary tales abound — breaches of POS systems and websites at Target, The Home Depot, eBay, and countless others have put shoppers on notice and kept many from adopting mobile payment options. While these may not be app-related breaches, the erosion of trust impacts all channels, making it harder to retain current customers and attract new ones.

The takeaway is the same — hackers target lucrative payment information, especially large, poorly protected pools of PII (e.g., customer credit card records). There are so many points in a mobile transaction that cybercriminals can exploit — the buyer’s device, the retailer’s system, the branded app or advertising, the payment network, and the credit card issuer. In the end, users affected by breaches won’t know or understand root causes, but the highly visible retail brand is most likely to feel the customers’ wrath.

Can your customer pay for purchases through your mobile app?  If so, hackers can access credit card information and additional PII. This could result in hackers gaining unsecured access to customer accounts and potential financial loss from those accounts. Determining liability in these cases is tricky, but if your brand is on the app, customers who have been harmed will blame you.

Can customers download coupons through your mobile app?  If so, you could take a financial hit if the coupon content is changed. Depending on the type of coupon, the hacker may be able to access your supply chain and network through an ERP system.

Can customers save their personal information within your mobile app? If so, this PII is potentially at risk. It may contain financial information, home address and phone number. Hackers can use this information to commit fraud, identity theft, and even in-person crimes like home burglary, if the PII yields insights into family life, work schedule, or vacation plans.

Advanced malware exploits are designed to deliver a payload that doesn’t detonate immediately. In order to inflict maximum damage (and reap the most bounty possible) upon activation, malware uses “dwell time” (the period from initial intrusion to detonation) to establish command and control, test system defenses, and spread to further devices. Ponemon Institute’s 2017 Cost of Data Breach Study pegs the average attack dwell time at 257 days (191 to identify, 66 to contain).

Far too often, due to lack of visibility, the retailer doesn’t know the detonation has occurred and that data and credentials are being stolen. Traditional cyber security methods are unable to detect the malware because the activity is coming from a known (but compromised) mobile device, not from an unknown source that can be traced back to a suspicious IP address or pattern of hacker activity.

After a vulnerability or attack has been detected, app developers often waste time trying to find a flaw in the app, or developing and releasing new versions. There are multiple issues with this remedial approach. To start with, new versions of the app would have to be released as mandatory upgrades because end-users are notorious for ignoring update recommendations. Then there is the fact that hackers are watching for updates and can likewise quickly update their malware based on what they learned from the first stage of the attack, leading to even more damaging exploits.

Retailers and mobile payment processors have no access to an end user’s compromised device; they can’t do forensics in order to the get to the root cause, and so the vicious cycle continues. AppVision’s HackGuard turns a repeating APT cycle that continues over several months into a simple, quick solution process, at the end of which losses have been avoided, and the event is ended with finality.

Hackers are more evasive than the most skilled of shoplifters. It’s hard to tell where they came from, what they grabbed, and where they’re going with it. HackGuard sends all the device and app data it collects to a secure cloud portal, through which granular reporting tools are provided. Each AppVision customer is provisioned with its own separate, securely encrypted database. A unified dashboard provides trend graphs, app activity gauges, install/launch charts, rolling reports, and detailed demographics for your installed app base. Datagrids are sortable and searchable. Alerts can be controlled through trigger and threshold settings.

With this kind of visibility, retail businesses can protect their app, their systems, and their customers by conducting rapid attack vector analysis. And most powerfully, with the granular attack data provided by HackGuard, it is easy to track the device characteristics that are being targeted and identify the users most at risk of compromise.

Other mobile app security products inject foreign code or wrap protective code around apps. App developers are wary of these approaches: they require significant effort to implement, can interfere with app functionality, and can even break the app. The act of injecting anyone else’s code, even from a security solutions provider, effectively increases an app’s attack surface. While developers may have complete control over their own code, they cannot exert the same control over injected code, which makes a prime target for hackers seeking to do widespread damage.

AppVision’s HackGuard employs a different, innovative approach — requiring no injection, no SDKs, no need to touch multiple components of the app. In fact, HackGuard can be enabled for an app in under a minute on both Android and iOS.