As the start of the new academic year approaches, many college students will be leaving their parents to start college life. However, a lack of experience makes it easy for college students to become victims of electronic fraud such as phone scams.

The start of the new academic year is often a period of time that sees an uptick in phone scams, especially those targeting college students. Some scammers trick students to download and register an account on malicious financial apps embedded with viruses and Trojan horses or ones that imitate legitimate apps. With such malicious apps installed on students' phones, scammers are able to steal students' sensitive data, such as bank card numbers and passwords. Some scammers trick students, by offering them small gifts or coupons, to scan QR codes which then direct them to pages that ask users to enter their personal information, such as their phone number and address. Once a student has done this, they will receive a large number of fraudulent calls and junk SMS messages from then on. If the students scan QR codes linking to phishing websites, their personal data may be leaked and sold for malicious purposes. Some scammers even lie about offering students scholarships or grants, in order to trick them into visiting phishing websites and entering their bank account numbers and passwords, causing significant financial losses to such students.

To deal with the ever-changing tricks of fraudsters, an app needs to detect phishing websites, malicious apps, and other risks and remind users to be on the lookout for such risks with in-app tips, in order to keep users and their data safe. So, is there a one-stop service that can enhance app security from multiple dimensions?

Fortunately, HMS Core Safety Detect can help developers quickly build security capabilities into their apps, and help vulnerable user groups such as college students safeguard their information and property.

The AppsCheck API in Safety Detect allows your app to obtain a list of malicious apps installed on a user's device. The API can identify 99% of malicious apps and detect unknown threats based on app behavior. Your app can then use this information to determine whether to restrict users from performing in-app payments and other sensitive operations.

The URLCheck API in Safety Detect checks whether an in-app URL is malicious. If the URL is determined to be malicious, the app can warn the user of the risk or block the URL.

Safety Detect also provides capabilities to check system integrity and detect fake users, helping developers quickly improve their app security. The integration process is straightforward, which I'll describe below.

Integration Procedure

Preparations

You can follow the instructions here to prepare for the integration.

Using the AppsCheck API

You can directly call getMaliciousAppsList of SafetyDetectClient to obtain a list of malicious apps. The sample code is as follows:

private void invokeGetMaliciousApps() {
        SafetyDetectClient appsCheckClient = SafetyDetect.getClient(MainActivity.this);
        Task task = appsCheckClient.getMaliciousAppsList();
        task.addOnSuccessListener(new OnSuccessListener<MaliciousAppsListResp>() {
            @Override
            public void onSuccess(MaliciousAppsListResp maliciousAppsListResp) {
                // Indicates that communication with the service was successful.
                // Use resp.getMaliciousApps() to obtain a list of malicious apps.
                List<MaliciousAppsData> appsDataList = maliciousAppsListResp.getMaliciousAppsList();
                // Indicates that the list of malicious apps was successfully obtained.
                if(maliciousAppsListResp.getRtnCode() == CommonCode.OK) {
                    if (appsDataList.isEmpty()) {
                        // Indicates that no known malicious apps were detected.
                        Log.i(TAG, "There are no known potentially malicious apps installed.");
                    } else {
                        Log.i(TAG, "Potentially malicious apps are installed!");
                        for (MaliciousAppsData maliciousApp : appsDataList) {
                            Log.i(TAG, "Information about a malicious app:");
                            // Use getApkPackageName() to obtain the APK name of the malicious app.
                            Log.i(TAG, "APK: " + maliciousApp.getApkPackageName());
                            // Use getApkSha256() to obtain the APK SHA-256 of the malicious app.
                            Log.i(TAG, "SHA-256: " + maliciousApp.getApkSha256());
                            // Use getApkCategory() to obtain the category of the malicious app.
                            // Categories are defined in AppsCheckConstants.
                            Log.i(TAG, "Category: " + maliciousApp.getApkCategory());
                        }
                    }
                }else{
                    Log.e(TAG,"getMaliciousAppsList failed: "+maliciousAppsListResp.getErrorReason());
                }
            }
        }).addOnFailureListener(new OnFailureListener() {
            @Override
            public void onFailure(Exception e) {
                // An error occurred during communication with the service.
                if (e instanceof ApiException) {
                    // An error with the HMS API contains some
                    // additional details.
                    ApiException apiException = (ApiException) e;
                    // You can retrieve the status code using the apiException.getStatusCode() method.
                    Log.e(TAG, "Error: " +  SafetyDetectStatusCodes.getStatusCodeString(apiException.getStatusCode()) + ": " + apiException.getStatusMessage());
                } else {
                    // A different, unknown type of error occurred.
                    Log.e(TAG, "ERROR: " + e.getMessage());
                }
            }
        });
    }

Using the URLCheck API

i. Initialize the URLCheck API.

Before using the URLCheck API, you must call the initUrlCheck method to initialize the API. The sample code is as follows:

SafetyDetectClient client = SafetyDetect.getClient(getActivity());
client.initUrlCheck();

ii. Request a URL check.

You can pass target threat types to the URLCheck API as parameters. The constants in the UrlCheckThreat class include the current supported threat types.

public class UrlCheckThreat {
    // URLs of this type are marked as URLs of pages containing potentially malicious apps (such as home page tampering URLs, Trojan-infected URLs, and malicious app download URLs).
    public static final int MALWARE = 1;
    // URLs of this type are marked as phishing and spoofing URLs.
    public static final int PHISHING = 3;
}

a. Initiate a URL check request.

The URL to be checked contains the protocol, host, and path but does not contain the query parameter. The sample code is as follows:

String url = "https://developer.huawei.com/consumer/cn/";
SafetyDetect.getClient(this).urlCheck(url, appId, UrlCheckThreat.MALWARE, UrlCheckThreat.PHISHING).addOnSuccessListener(this, new OnSuccessListener<UrlCheckResponse >(){
    @Override
    public void onSuccess(UrlCheckResponse urlResponse) {
        if (urlResponse.getUrlCheckResponse().isEmpty()) {
        // No threat exists.
        } else {
        // Threats exist.
        }
    }
}).addOnFailureListener(this, new OnFailureListener() {
    @Override
    public void onFailure(@NonNull Exception e) {
        // An error occurred during communication with the service.
        if (e instanceof ApiException) {
            // HMS Core (APK) error code and corresponding error description.
            ApiException apiException = (ApiException) e;
            Log.d(TAG, "Error: " + CommonStatusCodes.getStatusCodeString(apiException.getStatusCode()));
         // Note: If the status code is SafetyDetectStatusCode.CHECK_WITHOUT_INIT,
        // you did not call the initUrlCheck() method or you have initiated a URL check request before the call is completed.
        // If an internal error occurs during the initialization, you need to call the initUrlCheck() method again to initialize the API.
        } else {
            // An unknown exception occurred.
            Log.d(TAG, "Error: " + e.getMessage());
        }
    }
});

b. Call the getUrlCheckResponse method of the returned UrlCheckResponse object to obtain the URL check result.

The result contains List, which includes the detected URL threat type. If the list is empty, no threat is detected. Otherwise, you can call getUrlCheckResult in UrlCheckThreat to obtain the specific threat code. The sample code is as follows:

final EditText testRes = getActivity().findViewById(R.id.fg_call_urlResult);
List<UrlCheckThreat> list = urlCheckResponse.getUrlCheckResponse();
if (list.isEmpty()) {
        testRes.setText("ok");
    }
else{
        for (UrlCheckThreat threat : list) {
            int type = threat.getUrlCheckResult();
        }
    }

iii. Close the URL check session.

If your app does not need to call the URLCheck API anymore or will not need to for a while, you can call the shutdownUrlCheck method to close the URL check session and release relevant resources.

SafetyDetect.getClient(this).shutdownUrlCheck();

Conclusion

Electronic fraud such as phone scams are constantly evolving and becoming more and more difficult to prevent, bringing great challenges to both developers and users. To combat such risks, developers must utilize technical means to identify phishing websites, malicious apps, and other risks, in order to safeguard users' personal information and property.

In this article, I demonstrated how HMS Core Safety Detect can be used to effectively combat electronic fraud. The whole integration process is straightforward and cost-efficient, and is a quick and effective way to build comprehensive security capabilities into an app.