"We have some very bad characters who would like to take our money, take our identification, and run away with it," said Marie Gooding, first vice president of the Atlanta Fed.
Research the Fed cited, done by Boston-based Trusteer Inc., involved 20 computer servers that were used to send out more than 100,000 "phishing" emails. By studying the server records, Trusteer found that about 2,200 of the 3,000 responses the scam artists received came from smartphones.
Doug Johnson, vice president of risk management for the American Bankers Association, said he expects those numbers to get worse.
The Fed helps operate the industry's Automated Clearing House, a system that processed 21 billion transactions last year. While banks are required to adhere to authentication standards for ACH transactions, those protections are often unknowingly compromised by consumers.
Miami attorney Andrew Carter learned the hard way, after misplacing his phone amid the hubbub of a Christmas vacation. He had a mobile banking app installed on his phone, but had turned off his passcode lock because he found it annoying to enter whenever he wanted to use the phone.
"That was a big mistake," he said. Weeks later, Carter found $2,000 had been withdrawn from his account by someone in Texas, possibly through emails retrieved from his phone. He also found someone trying to hack his Facebook account.
Today, he keeps his phone locked and changed to a brand that allows him to remotely erase phone data something he couldn't do with his old phone.
Several manufacturers are planning new "biometric" technology, such as fingerprint scanners, that can make phones more secure. But even with those safeguards, consumer behavior can still lead to danger.
Vikram Thakur, principal security response manager for security software giant Symantec, said attackers can get complete control of a phone simply by getting people to click on a link. Without actually having the phone in their hands, the hackers can access messages, phone calls and personal information.