Hackers target financial service providers because they hold sensitive client information that unauthorised individuals could use for fraudulent activities. This is according to Ryan van de Coolwijk, Product Head: Cyber at iTOO Special Risks, who says it is not uncommon for people to interact with their broker when making payments, transferring money, or waiting for payments.
“So, looking at business email compromises, it is a great bet for cybercriminals to insert themselves into this interaction because the emails and discussions about financial transactions are commonplace there,” says Van de Coolwijk.
The Financial Sector Conduct Authority’s (FSCA) Regulatory Actions Report (1 April 2023 to 31 March 2024) states that “The increasing globalisation, interconnectedness, and technological advancements have provided fraudsters with more sophisticated tools and larger platforms to exploit financial customers, requiring the FSCA and its enforcement efforts to adapt continuously.”
The report cites the rise of deep fake scams, the impersonation of legitimate financial service providers, the impersonation of regulators, and exploitation via social media platforms as examples of how fraudsters exploit technological advancements.
“The FSCA is getting a lot more involved in ensuring financial service providers implement good security practices. The Authority is looking to publish its standards that financial service providers must comply with,” says van de Coolwijk.
“The draft standard will touch on many measures to improve a company’s overall security posture. The FSCA is looking to make sure that financial service providers are treating and protecting data as they should.”
However, he notes that instead of awaiting the standard, organisations should already consider what they could do better to safeguard against the impersonation attacks mentioned in the FCSA report.
“This sometimes feels like we are always beating the same drum, but it comes down to education, awareness and vigilance. Companies must continually educate their staff about what to look out for in emails, not to click on links and not to change bank account details without validating the request first,” says van de Coolwijk.
Technology such as DMARC can prevent the spoofing of email domains. For example, it allows a company to say that any emails from it today can only come from specific locations. So, any attempt to spoof that email domain would result in those emails being automatically discarded, never reaching their target.
“While there are technologies designed to help improve companies’ defences against such attacks, ultimately, it is education, awareness, vigilance, and processes that companies must implement to try and safeguard against what has become the weak point in the security ecosystem—the individual,” he explains.
However, should those measures fail, cyber insurance coverage is the last layer of protection that organisations can rely on. Different covers are available that protect businesses and even individuals against financial losses incurred due to cybercrime.
While prevention remains the best line of defence, cyber insurance is an essential part of cyber risk management. It helps businesses respond and recover from the financial costs of a cyber-event. The drastic rise in cyberattacks on financial services providers should be a stark reminder that it is not a matter of ‘if’ but ‘when’ hackers will strike.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version