Financial Institutions are One of the Most Targeted Organizations by Cyber Criminals

As a regulated sector, financial institutions, including banks, are greatly affected in the event of cyber-attacks, such as a data breaches. These institutions have to pay fines and penalties for losing personal identifiable information. They also tend to lose the most business and customers after a cyber-attack.

In India, there have been quite a few instances of banks losing valuable information to cyber criminals, through different kinds of cyber-attacks.

Why financial institutions are especially vulnerable

• Banks are undergoing a transformational change. Almost all are using advanced technology, including bots, to improve customer experience. In the process, new opportunities as well as new risks are emerging. Cyber risk is one of the most important non-financial risks that have emerged after the financial crisis of 2008.
• Devices have become ubiquitous. It is normal for a customer to access her bank account from her computer, mobile phone, or tablet. This seamless bank transaction, while ushering in ease of use, also leads to multiple points of data vulnerability.
• Regulations and governance have become stricter, which means the consequences of a data breach have multiplied over the past few years.

Cyber vulnerability in Indian financial institutions

In India, as in other countries, business and technology innovations that financial services companies are adopting in their quest for growth, innovation, and cost optimization have increased cyber risk and made it an enterprise level risk. The financial services technology ecosystem is rapidly evolving and the adoption of alternate channels like automated teller machines (ATMs), kiosks, internet, mobile, cloud, and social media technologies, have potentially increased the number of opportunities for cyber-attacks.

In addition, outsourcing, offshoring, and third-party contracting, driven by the need to reduce cost, may have further diluted financial institutions’ control over information technology systems and access points. Another consequence of this trend is the development of an increasingly boundary-less ecosystem, which offers multiple end points, devices, and attack surfaces for cyber criminals to exploit.

The following are a few of the vulnerabilities of financial institutions.

Account takeovers: Cyber criminals have demonstrated their ability to exploit the internet of things, especially the online interface between financial and market systems, such as automated clearing house (ACH) systems, card payments, and market trades.

Payment systems: Fraudulent monetary transfers and counterfeiting of stored value cards are one of the most common cyber-attacks against financial institutions, payment processors, and merchants.

ATM skimming: ATM skimming is a common cyber-crime in India, similar to other countries. In this crime, a criminal installs a skimming device on an ATM to collect card numbers and personal identification number (PIN) codes. Point of sale terminals: Point of sale (POS) terminals in India are a prime target for cyber criminals in India. Credit and debit cards from many financial institutions were affected by cyber-attack events that target POS terminals.

Mobile banking exploitation: As more mobile devices are being introduced in personal, business, or government networks, they are many instances of PIN thefts. Cyber criminals have successfully used man-in-the-middle attacks against mobile phones using malwares. It is a technique where the attacker secretly relays and alters the communication between two parties who believe they are communicating with each other.

Given that financial institutions’ work is of a sensitive nature, it is important for them to understand, plan, and prepare for a cyber event and its aftermath.