Fraud is often at its most dangerous during downturns and crises — both of which are happening during the COVID-19 pandemic, and now with the Russia-Ukraine conflict.
We are two years into this pandemic, and a global crisis has proven to be the perfect breeding ground for fraudulent activity. With people increasingly seeking connections and communication via digital means, businesses and consumers need to be even more vigilant in recognizing, rejecting and reporting fraud.
In Canada, the Canadian Anti-Fraud Centre (CAFC) reports $379 million were lost to scams and fraud in 2021, which was an increase of 130% compared to 2020. In part, this is due to large scale data breaches, but small and midsize businesses (SMBs) account for a growing number of data breaches as well. As the Office of the Privacy Commissioner of Canada explains, “since reporting became mandatory, we’ve seen the number of data breach reports skyrocket. Some of those reports have involved well known corporate names, but we have also seen significant volumes coming from small- and medium-sized businesses.”
Most recently, we have seen an increase in cyber-attacks from Russia against the Ukrainian government and military institutions. Threat intelligence shows that Russia is focused mostly on Ukraine, Poland and Romania to disrupt logistics around supply movements, etc.. However, over the next 60 days as the situation in Ukraine unfolds, the threat exists that Russia could launch cyber-attacks against the critical infrastructure of the U.S. and its allies as tough economic sanctions are imposed against Russia. Credit union employees should be on guard for any suspicious online activities especially phishing emails with bad links/attachments; threats and fear new opportunities for cyber criminals to instigate phishing attacks or other tactics. Employees need to be particularly mindful of illegitimate news sources or spam emails related to the invasion on Ukraine.
For the first time, bad actors and hactivists are taking sides in a conflict and using cyber crime tactics to incapacitate those they oppose. This has created a risk to Canada, and the Canadian Centre of Cyber Security has advised that operators of critical infrastructure should be on high alert for attacks in the form of malware, distributed denial of service (DDoS) and phishing. The financial industry is considered part of a nation’s critical infrastructure. Keep on reading to find out five fraud threats that may confront your credit union and three ways to mitigate them to keep your organization secure during Fraud Prevention Month (#FPM2022) and beyond.
Phishing
Phishing involves a fraudulent attempt to obtain sensitive data, such as usernames, passwords and credit card details or other sensitive information. Fraudsters do this by impersonating a trustworthy entity. Pandemic scammers are pulling out all the stops as phishing attacks increase in both frequency and creativity. In the wake of COVID-19 and the changes that it brought, including an increasing reliance on a remote workforce and virtual meetings, plus cloud-based operations and storage, bad actors are scrambling to profit.
“With an over 660% increase in 2021, phishing attacks are a plague on cybersecurity teams around the world.” – ID Agent
Remote Workforce
As the global pandemic continues to shape the way that we live and work, many companies are finding themselves supporting a remote workforce for significantly longer than they anticipated in March 2020.
With the chaos of getting everything back up and running in the spring, many of those same companies are discovering that remote workforce cybersecurity is a little bit different than in-office cybersecurity.
Employees, while doing their best, are often a weakness to many organizations while working remotely. Some factors that make a remote workforce a threat to your credit union include employees being distracted by a new work environment, isolated from IT personnel and they could be using a vulnerable endpoint device.
The number one cause of a data breach is always human error, and in each example, it’s apparent that the human element is the X factor that exposes businesses to additional risk. By ensuring your employees are adequately trained in cybersecurity and have the right tools at their disposal, you can reduce the risk to your credit union.
Account Takeover Fraud
Account takeover fraud is when a fraudster gains access to an account that doesn’t belong to them and makes unauthorized transactions — sometimes changing key credentials of the account such as the rightful account owner’s personal information or log-in details. This type of attack often involves phishing attempts to compromise customer data, and has become a lucrative option for fraudsters given the various government assistance programs that have been implemented due to the crisis
“Account takeover fraud makes up 37% of fraud, which is expected to increase in the wake of the pandemic.” – Experian
Canadian credit unions must confidently engage members using holistic and advanced risk-based identity and device authentication. Credit union should also consider targeted, knowledge-based authentication that allows verified customers to move throughout the log-in process but would frustrate fraudsters.
Spear Phishing
Spear phishing was in the top 10 frauds affecting Canadians in 2021 according to the CAFC.
Spear phishing scams involve scammers pretending to be from legitimate sources to convince businesses or individuals to send them money. These scams leverage existing relationships between the person receiving the email and the person sending it. The sender’s address appears to be the actual email address of the source they’re pretending to be, a tactic known as spoofing. Many variations have been reported including business executive spoofs, financial industry client spoofs, head office spoofs and payroll spoofs.
Data Breaches
Data breaches, especially those involving ransomware, climbed steadily throughout the chaotic landscape of 2020. Two in five SMBs were victimized by ransomware, with an estimated 85% of companies experiencing a cyberattack in 2020. That means that cybercriminals were able to rapidly harvest fresh data to sell or dump on the dark web.
“The number of data breaches recorded in 2021 has already exceeded the total number of events in 2020 by 17%, with 1,291 breaches in 2021 compared to 1,108 breaches in 2020.” – ID Agent
The dark web already contained millions of pieces of information that hackers could use to fuel cyberattacks — an estimated 60% of the information that was on the pre-pandemic dark web could harm businesses. That percentage is climbing fast and will continue to grow as the fallout from a record number of data breaches in 2021 is calculated. Plus, dark web activity has climbed by more than 300% in the last three years, making both the buying and selling markets bigger.
Three ways to Mitigate Threats
Security Awareness Training
More than ever, employees are the weak link in an organization’s network security. They are frequently exposed to sophisticated phishing and ransomware attacks. Employees need to be trained to remain on their toes with security top of mind.
Celero Protex Enterprise Security Awareness Training prepares your employees to defend against cyber-attacks including phishing, spear-phishing, executive whaling or CEO fraud. This program is taught by technical experts and includes baseline testing using mock attacks, engaging interactive web-based training for employees, and continuous employee assessment measured through simulated phishing, vishing and smishing attacks to build a more resilient and secure organization.
Find out how we can help you manage the ongoing problem of social engineering and create a human firewall.
Dark Web ID Credential Monitoring
Did you know that passwords are often up for sale on the dark web to the highest bidder?
More cybercriminals are eyeing your passwords than ever before, and credential theft is where it all begins. Despite this, a Ponemon Institute study found that 51 percent of respondents have not changed their password behavior.
Celero Protex Dark Web Monitoring ensures that your credit union’s credentials are secure. The financial services industry is a prime target for digital credential theft because of the wealth of information collected by credit unions and banks. Your employees and members connect to critical business applications and online services with a variety of usernames and passwords. This puts everyone at risk for identity theft, data breaches, and other crime.
We proactively monitor the dark web 24/7 to track and triage potential information leaks and create effective policies and procedures to minimize your future risk. Stay ahead of new trends in cyberattacks with ongoing reporting to keep you informed and your credit union safe.
Password Manager
Speaking of a password manager, we are pleased to announce the recently launch of our new password manager, Passly, in partnership with ID Agent!
The threat of cyberattacks has never been greater, and one layer of security is not enough. Today, nearly 80% of all data breaches are a devastating result that could have been avoided with stronger password protection.
Every organization, regardless of size, must implement a secure identity and access management platform to protect their digital identity, their data, and their business continuity. Passly provides the most comprehensive and cost-effective platform available to enable security, compliance, and efficiency.
If you are interested in learning how Celero can help your credit union reduce their risk of fraud, please contact us or talk to your Celero Account Executive.
Editors note: this post was originally published in March, 2021 and has been updated for accuracy.
