Cybersecurity Threats in the Financial Industry

Author: Mohamed Fathy – IT Department at EFG Hermes

Over the last decade, cyberattacks have been among the biggest threats to financial institutions. Advances in technology have honed cybercriminals’ skills and techniques. They’ve also become more organized, forming groups that make it difficult for financial service providers to manage cybercrime risk. Losses from cybercrime are substantial in the financial sector, ranging from litigation to having to refund customers, from the cost of preventing another attack and, of course, a dent in the institution’s reputation. Banks are the most targeted financial institution because of the high value of customer deposits, the wealth of data they sit on, and their reliance on vulnerable digital and technology solutions.

 

There are numerous ways in which an institution can protect itself against cyberattacks, and any financial institution is likely to have a comprehensive risk management framework that addresses these kinds of attacks, the most prevalent of which are outlined below:

 

First, statistics from NBC news concludes that Identity theft costs banks $1 billion a year. Identity theft is the use of a person’s information without his/her consent to conduct financial transactions. When a data breach occurs, intruders sell the customers’ data on the dark web to be used in other violations of the customers’ accounts.

 

Second, employees of financial institutions present a threat to the institutions’ security. Employees use their devices to access the firm’s services or use bank devices to check their e-mails. This creates an opportunity for phishing attacks and malware sent to them via e-mail disguised as a genuine offer or gift — such attacks happen when the attackers encourage unsuspecting victims to open false links, leading to malicious software installation.

 

Third, ransomware is a type of software that is malicious by nature. It holds captive the victim’s services until the ransom money is paid. Unsuspecting employees are prone to this attack when they open links from suspicious e-mails.

 

Fourth, jackpotting incidents are rampant in the US, Europe, and, more recently, in the Middle East, where criminals exploit weaknesses in the physical state and software of the ATM to access cash in the machine. They can also install skimmers or devices that scan people’s personal data such as bank account information, and they sell them to other criminals.

 

Fifth, synthetic fraud involves creating fake identities such as identification or one of the executives’ e-mail address. The criminals use false information to seek credit services from banks to purchase goods and services.

 

In short, it becomes clear that some of the most important preventative measures against cyberattacks are knowledge. Informing employees of the breadth and prevalence of cyberattacks and communicating clearly and frequently on prevention measures is the key to protecting an institution from attacks. From a risk management perspective, employees form the “first line of defense” against these kinds of attacks, and the more they’re informed, the better poised the institution is to protect the intellectual assets of both the firm and its clients.