In the last year or so we’ve seen an incredible increase in the number of Android banking Trojans. They are multiplying rapidly, and last year saw a 14-fold rise in their numbers. The first banking Trojans were ZitMo, SpitMo and CitMo – the mobile elements of the famous windows Trojans Zeus, SpyEye and Carberp. But these were soon followed by very different banker Trojans. Some of them still work in tandem with a Windows ‘partner’, but others are fully independent. They can steal credentials for online banking, mTans, credit card info and lots of other data. Some of them can steal money using text messages sent by banks; others harvest data from files on the device or call records. My research focuses on the main Android banking Trojans and shows how they steal your money. Most current banking Trojans are bots. They need instructions from a C&C before they can do their work. I have monitored real communications with command servers for the most significant Android banking Trojans. I will explain how monitoring systems can be built. I used two different methods – patched Trojans running on a real phone, or a communication protocol emulator running on a PC. Then I will show the commands I received and explain how it can affect real users. Finally, I will show how money can be transferred via mobile payment systems and give an idea of how much money is being stolen in this way.