Comment by stymaar
5 days ago
I'm pretty sure it's actually anti correlated: not because degoogled Androids are safer by themselves, but because the average user is way savier than the average Joe (which have an out of date Android full of unpatched security vulnerabilities, in the first place).
My theory is that they're trying to counter simulated phones. In the old days fraudsters would use their stolen credentials on a windows RDP rented from someone who sells fraud infra with clean IPs. I wouldn't be surprised if fraudsters have tried to develop an android based VM meant to look like a legitimate customer endpoint.
Though the most effective way to cut out that kind of fraud is to stop using SMS for authentication, which banks don't seem to be interested in doing.
Which is silly because you can get an attested phone for like $50 and factory reset it between "customers"
What's actually used is banks of old, used phones with broken screens, controlled via usb. They can be had for rather cheap.
That's my first instinct too. I've seen a claim that devices with root, which is distinct from degoogled, both of which are distinct from using a third-party Android distribution, have an increased probability of malware. I suspect that statistic includes things like secondary devices people use for cheating in pay-to-win games and the like.
It would be interesting to see statistics comparing who 1. Byod (just gets a SIM card from the carrier) 2. Keeps updating their phone to whatever the carrier offers via billing credits 3. Just keeps using the same phone they got from the carrier when they started