Criminal syndicates are targeting the theft of cellphones not for the value of the phone, but rather to access your data including your banking apps.

This is according to Kevin Hogan, head of fraud risk at Investec Private Bank. Hogan says that technology which was developed by law enforcement to crack phone passwords, is now in the hands of criminal syndicates.

Nazia Karrim, head of product development at the South African Fraud Prevention Services says that these types of incidents have been occurring for over a year now. “The smartphones are stolen, and the consumers’ data is stolen from the device.”

Hogan explains that once the criminal syndicate has the physical phone, they are able to plug it into hardware that unlocks your phone.

They are then able to access data from your phone including all your apps. This can include obtaining your banking app password.

Hogan explains that passwords are saved on the keychain, a password manager that stores and manages sensitive information such as passwords, credit card numbers and other sensitive data. Sensitive data is also held in Random Access Memory (RAM) or internal storage which hackers can access once they have your phone.

“The problem is that the first thing a victim of cellphone theft does is to notify the cellphone company. They then think the cellphone is blocked. But it does not stop the criminals from accessing the apps using wifi,” explains Hogan who says the first thing you should do if your phone is stolen is to notify your bank. “Immediately delink your banking profile from your device.”

Protect yourself from criminal syndicates with a strong password

The best protection of your data is to use a more secure password to protect both your phone and banking app. As Karrim explains, a four-digit pin is easy to crack as it has only 5000 variations which is simple and quick to hack in a few minutes with the right hacking tools.

“An 8-digit password is stronger, and it will take about an hour to crack if the hacker has the right tools. The longer the combination the better, as the greater the variations the longer the time required to hack the device,” says Karrim.

Hogan recommends using passphrases rather than a PIN to protect your device and apps. He recommends a passphrase that has more than 10 characters and even up to 21 characters.

You can set your device to open with biometrics so you are not constantly having to type in the longer password, but if the phone is stolen, it would be impossible to crack a longer passphrase.

Karrim says any password should not be related to your personal affairs such as dates or events or names of people and places you visit, but rather a random phrase with no association to you. It will make it more difficult for criminal syndicates to guess your password. The use of special characters makes it even more difficult.

How to create a strong passphrase

A passphrase is like a sentence and can therefore be easily remembered. You can then include some special characters and numbers. For example, your passphrase could be “I went for a walk today” – you make a mental note to change “a” to an @ sign and “e” to a 3. It would then be Iw3ntfor@w@lktod@y.

This article first appeared in City Press.