From Fraud to Fixes: Designing Usable Security for Financial Applications | An OWASP AppSec Global 2025 Conversation with Wojciech Dworakowski | On Location Coverage with Sean Martin and Marco Ciappelli

Jun 2, 2025

Wojciech Dworakowski, OWASP Poland Board Member and Managing Partner at SecuRing, dives into the vulnerabilities of mobile banking apps, highlighting their risks due to reliance on smartphones for transaction authorization. He shares insights on how attack strategies have evolved from simply stealing cards to sophisticated account takeovers. Wojciech advocates for a multi-layered security approach, emphasizing enhanced device fingerprinting and shared interbank databases as solutions to bolster security without sacrificing user experience.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

INSIGHT

Mobile Banking's Single Point Risk

Modern mobile banking apps converge transaction initiation, authorization, and security settings on one smartphone device.
This concentration creates a single failure point whereby an attacker controlling the device gains full account access.

ANECDOTE

Personal Loss Highlights Attack Threat

Wojciech shares a personal story about his daughter being socially engineered and losing all her e-commerce money.
This highlights the real-world impact of account takeover attacks beyond theoretical risks.

ADVICE

Raise the Bar Security Strategy

Implement multiple defensive steps to 'raise the bar' against attackers rather than relying on a single security solution.
Use device fingerprinting, emulator and rooting detection, and shared interbank device reputation databases.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

In this On Location episode during OWASP AppSec Global 2025 in Barcelona, Sean Martin connects with event speaker, Wojciech Dworakowski, to unpack a critical and underexamined issue in today’s financial systems: the vulnerability of mobile-only banking apps when it comes to transaction authorization.

Wojciech points out that modern banking has embraced the mobile-first model—sometimes at the cost of fundamental security principles. Most banks now concentrate transaction initiation, security configuration, and transaction authorization into a single device: the user’s smartphone. While this offers unmatched convenience, it also creates a single point of failure. If an attacker successfully pairs their phone with a victim’s account, they can bypass multiple layers of security, often without needing traditional credentials.

The discussion explores the limitations of relying solely on biometric options like Face ID or Touch ID. These conveniences may appear secure but often weaken the overall security posture when used without additional independent verification mechanisms. Wojciech outlines how common attack strategies have shifted from stealing credit card numbers to full account takeover—enabled by social engineering and weak device-pairing controls.

He proposes a “raise the bar” strategy rather than relying on a single silver-bullet solution. Suggestions include enhanced device fingerprinting, detection of emulators or rooted environments, and shared interbank databases for device reputation and account pairing anomalies. While some of these are already in motion under new EU and UK regulations, they remain fragmented.

Wojciech also introduces a bold idea: giving users a slider in the app to adjust their personal balance of convenience vs. security. This kind of usability-driven approach could empower users while still offering layered defense.

For CISOs, developers, and FinTech leaders, the message is clear—evaluate your app security as if attackers already know the shortcuts. Watch the full conversation to hear Wojciech’s real-world examples, including a cautionary tale from his own family. Catch the episode and learn how to design financial security that’s not just strong—but usable.

GUEST: Wojciech Dworakowski | OWASP Poland Chapter Board Member and Managing Partner at SecuRing | https://www.linkedin.com/in/wojciechdworakowski/

HOST: Sean Martin, Co-Founder at ITSPmagazine and Host of Redefining CyberSecurity Podcast | https://www.seanmartin.com

SPONSORS

Manicode Security: https://itspm.ag/manicode-security-7q8i

RESOURCES

Learn more and catch more stories from OWASP AppSec Global 2025 Barcelona coverage: https://www.itspmagazine.com/owasp-global-appsec-barcelona-2025-application-security-event-coverage-in-catalunya-spain

Catch all of our event coverage: https://www.itspmagazine.com/technology-and-cybersecurity-conference-coverage

Want to tell your Brand Story Briefing as part of our event coverage? Learn More 👉 https://itspm.ag/evtcovbrf

Want Sean and Marco to be part of your event or conference? Let Us Know 👉 https://www.itspmagazine.com/contact-us

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.