Who Moved My Transaction? Uncovering Post-Transaction Auditability Vulnerabilities in Modern Super Apps

• URL: http://arxiv.org/abs/2510.26210v1
• Date: Thu, 30 Oct 2025 07:34:20 GMT
• Title: Who Moved My Transaction? Uncovering Post-Transaction Auditability Vulnerabilities in Modern Super Apps
• Authors: Junlin Liu, Zhaomeng Deng, Ziming Wang, Mengyu Yao, Yifeng Cai, Yutao Hu, Ziqi Zhang, Yao Guo, Ding Li,
• Abstract summary: Super apps are cornerstones of modern digital life, embedding financial transactions into nearly every aspect of daily routine.<n> prevailing security paradigm for these platforms is overwhelmingly focused on pre-transaction authentication.<n>We argue that a critical vulnerability vector has been largely overlooked: the fragility of post-transaction audit trails.
• Score: 25.109590157742712
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Super apps are the cornerstones of modern digital life, embedding financial transactions into nearly every aspect of daily routine. The prevailing security paradigm for these platforms is overwhelmingly focused on pre-transaction authentication, preventing unauthorized payments before they occur. We argue that a critical vulnerability vector has been largely overlooked: the fragility of post-transaction audit trails. We investigate the ease with which a user can permanently erase their transaction history from an app's interface, thereby concealing unauthorized or sensitive activities from the account owner. To quantify this threat, we conducted an empirical study with 6 volunteers who performed a cross-evaluation on six super apps. Our findings are alarming: all six applications studied allow users to delete transaction records, yet a staggering five out of six (83+\%) fail to protect these records with strong authentication. Only one app in our study required biometric verification for deletion. This study provides the first concrete evidence of this near-ubiquitous vulnerability, demonstrating a critical gap in the current mobile security landscape and underscoring the urgent need for a paradigm shift towards ensuring post-transaction audit integrity.

Related papers

• Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia [6.319052540589321]
  FjordPhantom, a malware identified by our industry collaborator, uses virtualization and hooking to bypass the detection of malicious accessibility services.<n>This malware primarily affects banking and finance apps across East and Southeast Asia region.<n>It requires users to be deceived into installing a secondary malicious component and activating a malicious accessibility service.
  arXiv  Detail & Related papers  (2026-01-29T04:37:53Z)
• A High-Recall Cost-Sensitive Machine Learning Framework for Real-Time Online Banking Transaction Fraud Detection [0.8749675983608171]
  This study builds a system using group learning methods adjusted through smart threshold choices.<n>The outcomes reveal that approximately 98 percent of actual fraud is detected.<n>A browser add on built for Chrome is designed to flag deceptive web links and reduce threats from harmful sites.
  arXiv  Detail & Related papers  (2026-01-12T07:34:04Z)
• SAFE-QAQ: End-to-End Slow-Thinking Audio-Text Fraud Detection via Reinforcement Learning [52.29460857893198]
  Existing fraud detection methods rely on transcribed text, suffering from ASR errors and missing crucial acoustic cues like vocal tone and environmental context.<n>We propose SAFE-QAQ, an end-to-end comprehensive framework for audio-based slow-thinking fraud detection.<n>Our framework introduces a dynamic risk assessment framework during live calls, enabling early detection and prevention of fraud.
  arXiv  Detail & Related papers  (2026-01-04T06:09:07Z)
• Bag of Tricks for Subverting Reasoning-based Safety Guardrails [62.139297207938036]
  We present a bag of jailbreak methods that subvert the reasoning-based guardrails.<n>Our attacks span white-, gray-, and black-box settings and range from effortless template manipulations to fully automated optimization.
  arXiv  Detail & Related papers  (2025-10-13T16:16:44Z)
• SilentLedger: Privacy-Preserving Auditing for Blockchains with Complete Non-Interactivity [38.520950743840785]
  SilentLedger is a privacy-preserving transaction system with auditing and complete non-interactivity.<n>We formally prove security properties including authenticity, anonymity, confidentiality, and soundness.<n>Our implementation and benchmarks demonstrate that SilentLedger achieves superior performance compared with state-of-the-art solutions.
  arXiv  Detail & Related papers  (2025-09-10T16:14:34Z)
• Enhancing Customer Contact Efficiency with Graph Neural Networks in Credit Card Fraud Detection Workflow [1.0853764732047277]
  We propose a fraud detection framework incorporating Graph Convolutional Networks (RGCN) to enhance the accuracy of identifying fraudulent transactions.<n>Our experiments are conducted using the IBM credit card transaction dataset to evaluate the effectiveness of this approach.
  arXiv  Detail & Related papers  (2025-04-03T04:50:45Z)
• Are Users More Willing to Use Formally Verified Password Managers? [46.01440321321548]
  We design and implement two experiments to understand how formal verification impacts users.<n>We focus on the application domain of password managers since it has been documented that the lack of trust in password managers might lead to lower adoption.<n>We conclude that formal verification is seen as desirable by users and identify three actional recommendations to improve formal verification communication efforts.
  arXiv  Detail & Related papers  (2025-04-02T20:57:49Z)
• Across-Platform Detection of Malicious Cryptocurrency Transactions via Account Interaction Learning [19.2372535101502]
  Existing malicious transaction detection methods rely on large amounts of labeled data. We propose ShadowEyes, a novel malicious transaction detection method. We conduct extensive experiments using public datasets to evaluate the performance of ShadowEyes.
  arXiv  Detail & Related papers  (2024-10-31T02:01:42Z)
• Nudging Users to Change Breached Passwords Using the Protection Motivation Theory [58.87688846800743]
  We draw on the Protection Motivation Theory (PMT) to design nudges that encourage users to change breached passwords. Our study contributes to PMT's application in security research and provides concrete design implications for improving compromised credential notifications.
  arXiv  Detail & Related papers  (2024-05-24T07:51:15Z)
• Rethinking the Vulnerabilities of Face Recognition Systems:From a Practical Perspective [53.24281798458074]
  Face Recognition Systems (FRS) have increasingly integrated into critical applications, including surveillance and user authentication. Recent studies have revealed vulnerabilities in FRS to adversarial (e.g., adversarial patch attacks) and backdoor attacks (e.g., training data poisoning)
  arXiv  Detail & Related papers  (2024-05-21T13:34:23Z)
• The Importance of Future Information in Credit Card Fraud Detection [3.2465762663605373]
  We propose a new paradigm: posterior fraud detection with "future" information. On a real-world dataset with over 30 million transactions, it achieves higher performance than a regular LSTM. We believe that future works on this new paradigm will have a significant impact on the detection of compromised cards.
  arXiv  Detail & Related papers  (2022-04-11T17:11:34Z)
• Feature-Level Fusion of Super-App and Telecommunication Alternative Data Sources for Credit Card Fraud Detection [106.33204064461802]
  We review the effectiveness of a feature-level fusion of super-app customer information, mobile phone line data, and traditional credit risk variables for the early detection of identity theft credit card fraud. We evaluate our approach over approximately 90,000 users from a credit lender's digital platform database.
  arXiv  Detail & Related papers  (2021-11-05T19:10:35Z)
• Certifiers Make Neural Networks Vulnerable to Availability Attacks [70.69104148250614]
  We show for the first time that fallback strategies can be deliberately triggered by an adversary. In addition to naturally occurring abstains for some inputs and perturbations, the adversary can use training-time attacks to deliberately trigger the fallback. We design two novel availability attacks, which show the practical relevance of these threats.
  arXiv  Detail & Related papers  (2021-08-25T15:49:10Z)
• Fraud Detection using Data-Driven approach [0.0]
  The first known online banking service came in 1980. The ever increasing use of internet banking and a large number of online transactions increased fraudulent behavior also. This research paper aims to construct an efficient fraud detection model which is adaptive to customer behavior changes.
  arXiv  Detail & Related papers  (2020-09-08T20:58:51Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.