A method for detecting fraudulent activity in user transactions with a remote bank server via an application of a user's computing device, the method comprising: gathering, by a behavior determination module included in the application of the user's computing device, user behavior data on a user's interaction with a plurality of groups of elements of a graphical interface of an application on a the user's computing device for interaction with a the remote bank server; sending, by the behaviour determination module, the gathered user behaviour data to a behaviour classification module on the remote bank server; collecting, by a security module included in the user's computing device, information as to which applications of the computing device are accessing the data on the user's behavior when the user is interacting with the groups of elements of the graphical interface for performing transactions with the remote bank server; saving, by the security module, the collected information; calculating, by the behavior classification module on the remote bank server, an anomalous user behavior coefficient for each of the groups of elements of the graphical interface by applying a simple probabilistic classifier to the gathered user behavior data specifying the user's interaction with each of the groups of elements of the graphical user interface wherein the anomalous user behavior coefficient is a number which shows to what extent the user's behavior is uncharacteristic of the user; calculating, by a decision making module on the remote bank server, a combination of the anomalous user behavior coefficients; detecting, by the decision making module, a fraudulent activity when the combination of anomalous user behavior coefficients exceeds a predetermined threshold value; in response to detecting a fraudulent activity, transmitting to the security module, by the decision making module, an alert regarding the fraudulent activity, and information containing the data on the user's behavior, which data was used to calculate the anomalous user behavior coefficients; and responsive to receiving the alert, recognizing, by the security module, the application on the user's computing device to be malicious if fraudulent activity was detected during the interaction of the user's device with the remote bank server, and said application accessed the data on the user's behavior during the user's interaction with at least one group of elements of the graphical interface for interaction with the remote bank server, for which group data has been gathered on the user's behavior by the behavior determination module. gathering, by a behavior determination module included in the application of the user's computing device, user behavior data on a user's interaction with a plurality of groups of elements of a graphical interface of an application on a the user's computing device for interaction with a the remote bank server; sending, by the behaviour determination module, the gathered user behaviour data to a behaviour classification module on the remote bank server; collecting, by a security module included in the user's computing device, information as to which applications of the computing device are accessing the data on the user's behavior when the user is interacting with the groups of elements of the graphical interface for performing transactions with the remote bank server; saving, by the security module, the collected information; calculating, by the behavior classification module on the remote bank server, an anomalous user behavior coefficient for each of the groups of elements of the graphical interface by applying a simple probabilistic classifier to the gathered user behavior data specifying the user's interaction with each of the groups of elements of the graphical user interface wherein the anomalous user behavior coefficient is a number which shows to what extent the user's behavior is uncharacteristic of the user; calculating, by a decision making module on the remote bank server, a combination of the anomalous user behavior coefficients; detecting, by the decision making module, a fraudulent activity when the combination of anomalous user behavior coefficients exceeds a predetermined threshold value; in response to detecting a fraudulent activity, transmitting to the security module, by the decision making module, an alert regarding the fraudulent activity, and information containing the data on the user's behavior, which data was used to calculate the anomalous user behavior coefficients; and responsive to receiving the alert, recognizing, by the security module, the application on the user's computing device to be malicious if fraudulent activity was detected during the interaction of the user's device with the remote bank server, and said application accessed the data on the user's behavior during the user's interaction with at least one group of elements of the graphical interface for interaction with the remote bank server, for which group data has been gathered on the user's behavior by the behavior determination module.