Almost 300 predatory loan apps found in Google and Apple stores Almost 300 apps, downloaded by around 15 million users, have been pulled from the Google Play and Apple App stores over claims they promised quick loans at reasonable rates but then used extortion and other predatory schemes against borrowers. The loans came with hidden fees and high interest rates that drove up the payments …
I was going to "ask who turns to some random app in the app store when they need a loan?" But as the article says, users in developing countries were targeted. I'm guessing there may be significant numbers of users that don't have bank accounts and do everything on their phone, so maybe for them it's not so strange.
"you can afford an iGizmo, but need a loan?"
Sure. Go find a second-hand old model iPhone with some damage. It will be cheap enough to buy. Then have a medical problem, eviction, etc or other large expensive situation that will be bad for you if you don't resolve it. Voila, you have an iPhone and need a loan. If you do these things in the order specified, then you didn't know you needed a loan when you got the iPhone.
Also, did you read the part in the headline, or the first paragraph, or the comment from the researchers, or the rest of the article that clearly indicated that there were Android variants as well? How about this part of the researchers' statement: "The focus on developing countries may also explain why we found more loan scam apps on Android than on iOS,".
The man on the Clapham omnibus just doesn't apply filters to information spewed through a digital device in the same was as he does with (eg) paper info. Even when explained, it's almost always wilfully ignored, because of something like "you're paranoid" or "everyone's doing it, so it must be fine".
I'm happy to stay with "Man" on the Clapham omnibus in this case, as women appear to much better at this error/BS checking (although that's an observation of mine, rather than empirically sourced).
[Icon: because even if the care is genuine and founded, it's probably an exercise in futility to attempt intervention. Ho hum.]
I've been helping at some sessions on introducing digital skills to the elderly. question I often ask early on is: "If someone came up to you in the street and asked to borrow £500, and let them have your bank details so they can pay you back next week, what would you do?" The reply is always something like "they'd walk away". We then talk about online offers...
I also explain that almost all scams start out with a digital failure - one of the digits at the end of your arm.
This post has been deleted by its author
I'm happy to stay with "Man" on the Clapham omnibus in this case
Not: I hope you're happy with me referring to......
Nothing to do with you AC. Retain your cowardly patronization. [Spelling selected for my Leftpondian colleagues.]
Furthermore, you clearly do need it pointed out that there's more to the sentence, and a reasonable person (such as the man on said onmibus) might see that I'd referenced the quoted gender in order to compare and contrast the genders in context.
A theft is only a crime if reported to the authorities, snd a thief is not going to call the cops on you. Just log it as gambling income (or other socially acceptable way to earn cash) and pay taxes on your ill-gotten gains if you want to get away with it.
A few practical difficulties arise. Probably the first is how are they going to send you money? Probably they deposit it into your bank account. That's a bit harder to fake than having a burner phone, and since they can show loan documents, they can attempt to charge that account for your repayment. Yes, they'll turn to fraud later, but based on the contracts they've shown you, they'll appear to be real creditors until they do. If they're not using a bank account, they still are using something where you can receive cash, and that's more likely attached to your identity because of restrictions on financial services. If they're operating outside the system entirely, they might hand out envelopes of cash, meaning you have to meet someone who can demand to see your identification and photograph everything before you get paid. If they're stupid enough to use a truly anonymous method for the initial payment, you could figure a way to get it, but they probably avoided an easily gamed method.
Also, if they're profitable, they may have a respectable front that claims to give normal loans and may have a relationship with corrupt law enforcement not to investigate their fraud. They can use their front with the contracts you signed to request that the police investigate your theft. I'm not sure whether they have the power to make that happen, but if you got enough from them, they might want either to retrieve it or make an example of you. You'd need to be pretty certain that your method was perfect before making enemies of that nature, and given they're targeting low-income countries, it's possible they won't give you enough money to justify the risks you'd take.
I've always wondered where all the spammers / scammers got my mobile number, since I very rarely use it online.
I guess it makes sense if people who have my number saved download stupid stuff and unwittingly upload all numbers on their phones.
Will not be surprised if these data stealers claiming to be games and other types also provide scammers and spammers with potential victim details as well.
Yes of course. If *anybody at all* has your name and phone number, you can count on that data being available for sale at your nearest "data aggregator". It's not even expensive.
I block incoming calls and texts from anyone not in my address book (phone doesn't have Google apps or an account), even on my business phone. If it's important, people will eventually figure out a way to get in touch.
if the apps were removed due to unacceptable business practices, then exactly how and why were they approved in the first place, considering both Google and Apple's claims of 'protecting users' by [supposedly] vetting these apps??
Especially Apple in this instance. Google can be rather slack but Apple claims a rigid enforcement of user protections and privacy as one of the benefits of using iOS.
So, Google and Apple, exactly how did you mess up and why aren't you claiming a mea culpa??
If someone introduces an app to connect you with loans, but you aren't yet offering loans how can an app store enforce anything? It is only after it becomes apparent they are making predatory loans that it becomes an issue.
And what's the definition of a "predatory loan"? High interest rates and fees? What if those are totally legal in the country in which they are offered? The problem then isn't really the app, but the law.
When I get a call offering a loan, I tell them that it's welcome and can be shipped in a cardboard box, I tell them that Rick can give them the address details - and then click on "Never Gonna Give You Up" to get them to think that they are "on hold" ... eventually they will hang up and not call me again.
You can click on "down-vote" if I have pissed you off when you called me ...
It's all well and good what you'd like to know. What Google and especially Apple would like to know is how these apps managed to avoid the app store TOS regarding payments made through the app. Mandatory retraining for all app reviewers! 30% of predatory pricing is some nice change.
"if the apps were removed due to unacceptable business practices, then exactly how and why were they approved in the first place"
There's the theory and then what's practiced. I'm not sure any of the app stores do any due diligence on why an app needs access to something on the phone and how that information might be used. All that might be required is that the data the app is asking for is disclosed on the listing.
"exactly how and why were they approved in the first place, considering both Google and Apple's claims of 'protecting users' by [supposedly] vetting these apps??"
Because nobody checked. The apps went through the review process alright: a script to check them against a list of banned packages, another script doing a quick scan to see if any of the assets were obvious unobfuscated malware samples, one to check for some trademarks in descriptions or images, passed all three and we're ready to go. It's pretty obvious that no rigorous check system is in place. Some reactive work is done, but even that can prove to be much less than the companies claim.
"So, Google and Apple, exactly how did you mess up"
We take our customers' security and privacy very seriously, and we're performing a full investigation into ... sorry, my boss has just informed me that I'm being replaced by an old tape recorder someone found and rearranged so it'd loop. Bye.
"and why aren't you claiming a mea culpa??"
We take our customers' security and privacy very seriously, and we're performing a full investigation into ...
after I make a fake person, fake work place, fake friends, okay, that took 15 min, now to use a burner phone proxied out of (country x) time to get a loan from the scammers and the fake person will transfer all the money they borrowed to me before taking their own fake life, lol. hope they aren't reading this :P
1. Buy burner phone.
2. Load with worthless contacts, like putting Interpol's fraud reporting line under Mom, 900 Dial A Perv as Boss, ect. And, download pics from the most disgusting sites in the internet, naming the pics "me and (enter large group name here), ect.
3. Open an on-phone account for loaned money to be deposited to.
4. Load up with hundreds of these apps, and take out as much money as possible.
5. Use money to buy crypto, which you transfer from wallet to wallet until thoroughly washed, where it finally ends up in a Cayman account.
6. Keep going until you can't get more loans.
7. Buy new burner phone ..
Eventually these places will go out of business when they can't get their money back and can't reach anyone. And if you can do it long enough, visit the Caymans, take the money out from one bank and move it as cash to another, wire the money home and declare it as gambling income. Pay your taxes and retire.
Edit -I see after posting this that I am not alone in thinking this.
"This seems easily solvable
1. Buy burner phone.
etc."
Your fake persona would have no footprint that can be seen. I would expect that the loan companies have a subscription to a big data company so it costs them all of 5p to pull up data on somebody. Phone numbers today are like serial numbers on people. If the company finds a blank file, you aren't likely to get the money.
Yep, you're not alone in the crowd of commenters who didn't bother reading the linked report and would rather just make up clever little creative writing exercises on how they'd totally get one over on these scammers after investing 30 seconds of thought:
"Most of the predatory loan apps request ID verification via a video selfie. The two screenshots on the left are from the Indian Android app Flash Rupee asking for the permanent account number (PAN) card and the Aadhaar ID card."
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
