Cyber Defense eMagazine November 2020 Edition

Add a pandemic to fraud prevention
One-third of finance login attempts within the NuData client network are high risk. This is not a negligible
proportion of the average financial institution’s online traffic.
As Robert Capps explains during the same webinar with the Aite Group, “even when those login attempts
are unsuccessful, they hurt your bottom line by raising operational costs.” He also added, “You’re paying
for more bandwidth, more servers, more licensing fees to run software on those servers, more space in
a data center, more power — and so on — all to process transactions that have zero to negative value
for your company.” For many companies, these expenses run into the double-digit millions or more. By
getting top-of-funnel fraud attacks under control, you could reduce your fraud losses but also impact your
bottom line.
Fraud prevention was already a mind-bending challenge, but the pandemic has made it even worse for
many financial institutions. With many offices closed and travel restricted, users log in from fewer
locations on fewer different devices, making them, at first sight, easier to identify and differentiate from
fraudsters. But financial customers have also changed their habits in sometimes unpredictable ways.
They complete different types of transactions and transact more frequently, at different times of day,
compared to before the pandemic. These behavioral changes thwart some financial institutions’ existing
fraud risk models, increasing false positives, while still letting fraud through.
It doesn’t help that cybercriminals are adopting ever more sophisticated tactics to bypass financial
institutions’ defenses. According to NuData research, in the first half of 2020, 96% of attacks against
financial institutions were sophisticated. These are attacks that tried to mimic human behavior in an
attempt to blend in with legitimate traffic. Some attacks take it one step further and solve bot challenges
such as CAPTCHAs by sending them to human farms — essentially call centers for fraudsters. Humanfarm
workers are paid to process as many requests as possible, manually. Financial institutions need to
understand how these attacks happen and how they behave, to tell them apart from legitimate users.
WFH-ing safely
Remote work poses another growing challenge for financial institutions, as it may increase some types
of fraud risk. Many cyberthreats start at home — for example, a personal device on the home network
infected with malware can be an entry point. Bad actors can use that back door to infect a corporate
asset on the same network. It’s increasingly common for the initial attacker to sell such access to a third
party, who then exploits the breach to compromise user data or perform any number of malicious actions.
5 steps to lose the fear of cyberthreats
When shoring up your cybersecurity protections, prioritize solutions — both internal and external — that
enable an uninterrupted customer journey. As mentioned during the Aite Group webinar, 22% of
consumers left their credit or debit card issuer because of a poor experience. Here are a few ways to
tighten security without adding too much friction.
1. Tighten permissions for administrative users. Lessen the risk of internal fraud or data leakage
by reducing the amount of sensitive information that employees can access, for example, by
anonymizing personally identifiable information (PII). Behavioral analytics tools (see #5 below)
Cyber Defense eMagazine – November 2020 Edition 91
Copyright © 2020, Cyber Defense Magazine. All rights reserved worldwide.