What if I told you there was a way to borrow money online instantly, without any of the hassle that comes with taking a bank loan? You’d probably say it’s too good to be true — and you would be correct.

Now, there’s a new kind of social engineering attack taking on the form of a financial services app that lures unsuspecting users with exactly these promises. These apps are known as SpyLoan apps and are a fairly recent introduction to an already long list of social engineering techniques, which have rapidly gained traction in just a few years.

Manipulation 101: How A SpyLoan App Works

A SpyLoan app attracts users with promises of instant and easy to obtain loans. However, these apps are nothing but a front for a wide network of data theft and harassment rackets operating in regions like Southeast Asia, Africa, and South America.

When signing up, these apps use typical social engineering tactics, such as creating a false sense of urgency by adding countdowns when you’re setting up your account to receive discounts or lower interest rates. When presented with a timer, a user may be more inclined to enter their details, even sensitive information, without giving it too much thought, and that’s the end goal.

These apps rely on financially desperate people to fall victim to their schemes. Pair this unfortunate financial situation with the manipulation tactics used by the SpyLoan apps and you’ve got a perfect storm of missteps that can lead an unsuspecting user exactly where these malicious actors want them.

Once a user downloads the app and completes the onboarding process, they find themselves facing predatory practices and high interest rates. The app then requests excessive permissions such as access to call logs, messages, and photos. As we’ve already established, a user who’s desperate for cash may be willing to provide these permissions as long as they’re able to obtain the loan they’re seeking. These intrusive permissions then allow these apps to mine sensitive data from the user’s device that may be sold to data brokers or used for even more nefarious purposes.

Digital Loan Sharks

Once the loan has been granted, we get to the most harrowing part: The recovery of the funds. These apps function just like real-life loan sharks and debt collectors, except it’s all digital. There are several cases where people have been harassed with repeated phone calls. It isn’t uncommon for these collectors to also use extremely demeaning and abusive language. Even worse, there have also been reports of them using explicit doctored images to harass their victims, which has even led to people taking despondent decisions because of the constant abuse.

Be Vigilant: Do Not Become A Statistic

As with any kind of cyberthreat, knowledge, awareness, and good judgement are your best defense strategy. Make sure to do plenty of research and always stick to known methods and procedures, especially when money and sensitive data are involved. There’s a reason we’ve used our current financial system for centuries. Despite its flaws, it is still the most effective, safest, and most regulated way to mobilise funds. Remember, there’s no such thing as easy money. If an offer seems too good to be true, assume it’s a scam. Your data, privacy, and peace of mind are worth far more than a quick loan.