In a market where digital-first banking is largely replacing in-person transactions, the pressure is on businesses to deliver an increasingly convenient and consistently secure customer experience. While consumers are more accepting and appreciative of security gates from financial institutions, many banks are still searching for the ideal balance between low-friction user experience and account security. A great user experience can contribute to customer retention, as any account security issues can be a deal-breaker. This is because account takeover attacks (ATOs) in banks and fintechs can result in users losing their lifetime earnings and their accounts and personal data becoming a conduit for mass downstream fraud.
The Goal of Financial ATOs
Account takeover (ATO) fraud that targets banks and fintechs is especially lucrative for cybercriminals due to the enormous amounts of valuable data and information these institutions deal with, which makes it an important cybersecurity issue. Financial account takeover not only enables attackers to strike big – due to the value of assets like user credentials and bank account information in these accounts – but the potential to use them for multiple other types of attacks is also immense.
To execute ATO attacks, cybercriminals require valid user credentials that are typically used as part of a login flow or new account creation. These inputs are harvested through account enumeration, account validation, credential stuffing, and social engineering. In the case of financial institutions and fintechs, email IDs are not used as usernames. Therefore, bad actors generally rely on information from previous data breaches or social engineering to elicit the required information that can fuel financial ATO attacks.
Cybercriminals use phishing and vishing to manipulate users into sharing their personal data or login information, like the account's username or password. Hackers also send out emails, purportedly from providers that customers have an existing relationship with in order to create panic and redirect them to a malicious webpage to harvest personal information or identity data at scale.
Commoditized tools, including bots and scripts, are easily available on the internet, which make it possible for cybercriminals to execute such attacks at scale with the least possible investments. Furthermore, creative attackers use all possible measures to reduce investments and maximize their 'profits'. They mobilize their resources and use a mix of automation, bots, and human labor to increase the returns of their theft. This makes account takeover attacks a lucrative 'business' opportunity for cybercriminals that cause losses worth millions of dollars every year to businesses.
Multiple Ways to Monetize an ATO
The stolen user data and corrupted digital identities are used to execute financial account takeover attacks on banks and fintechs in many ways as described below:
- Account draining: The first and the obvious method to monetize compromised attacks is to drain the accounts of the funds contained therein.
- Money laundering: Compromised accounts serve as a conduit for money laundering, whereby, cybercriminals transfer the proceeds of a crime multiple times and across multiple accounts until the roundabout journey results in attackers reclaiming the money as 'clean' money. Multiple transfers also make it difficult to trace, as the origin gets obscured.
- Money muling:This is yet another method cybercriminals use to convert dirty money into clean money. They recruit legitimate users who have active accounts for the purpose. Bad actors also use the compromised user accounts—both active and dormant—as money mules to transfer the funds.
- Credit applications: In this type of attack, compromised accounts are used to open new lines of credit by making fraudulent credit applications. Cybercriminals may hold the compromised accounts for months together before using them. This not only enables them to avoid raising suspicion but also makes it challenging to identify the attack.
Overburdened Banking & Financial Organizations
The increase in the number of users and reliance on digital channels on the internet and via mobile apps has elevated the level of expectations that customers have from their financial services providers. Therefore, the onus of providing a secure and seamless experience rests with these digital businesses. Furthermore, fintechs and financial institutions have additional responsibility of compliance with a number of regulations that mandate them to ensure security and privacy of customer data.
Aware of the challenges that financial institutions are facing at multiple fronts, cybercriminals are taking advantage of the situation by studying the defense mechanisms and devising ways to circumvent them. For example, cybercriminals are now aware that many defense mechanisms require more nuanced human interaction. They have, therefore, found a method to bypass these defenses through the use of human fraud farms, also known as click farms. These adaptations and the use of advanced techniques not only make it simpler for black hat hackers to launch sophisticated and complex financial account takeover attacks, but also extract rewards faster than deployment of countermeasures.
Financial ATOs can result in serious monetary losses to banks and fintechs. In the event of a successful attack, these institutions also run the risk of non-compliance and bearing the burden of paying hefty penalties. In addition, they stand to lose customer trust and erosion of brand equity, which takes years of effort to build. The right solution can not only stop ATOs and credential stuffing attacks, but maximize an enterprise's return on investment as well.
A Solution That Works for Digital-First Financial Institutions
To avoid losses—both tangible and intangible—banks and fintechs need effective solutions that can help them safeguard the interests of their business and customers. Having said that, ATO attacks are not easy to detect. Therefore, financial institutions of the current digital era cannot solely rely on traditional defense approaches or point solutions. This is because these solutions often lack the ability to cope up with the evolution in attack tactics and therefore, cannot ensure the level of protection needed today.
The need for digital-first fintechs and banks is an approach that can protect long-term and from new attack techniques, without adding friction to the customer journey. They need a solution that eases out their burden and frees them from absorbing cyber attack losses as a business cost.
Removing the Economic Drivers of Cybercrime & Financial ATOs
For fintechs and other financial services organizations, ensuring customer accounts are secure can be a key differentiator. One of the best ways to accomplish this is by providing a solution that makes an attack financially untenable for cybercriminals.
Arkose Labs believes that the best way to stop cybercrime is to make the execution of an attack so expensive, it loses its financial viability. This forces attackers to give up and look elsewhere.
Arkose Bot Manager combines highly-transparent detection with targeted attack response to catch malicious activity early in the customer journey, without impacting good users. The platform’s multi-layered detection drives up the cost for attackers to evade defenses, while providing better insight and greater decision confidence across the customer journey.
The targeted friction presented by the Arkose solution makes clearing the Arkose MatchKey challenges at scale nearly impossible for attackers, as bots fail instantly and human attackers are required to clear challenges successively that also increase in complexity.
Wastage of time, effort, and resources soon escalates the costs of a financial ATO attack and ultimately outweighs the returns to hurt the cybercriminal's bottom line. This enables fintechs, banks, and other financial services companies to maximize their own savings and retain customers as well.
Arkose Labs is a trusted partner for leading global financial institutions when it comes to customers' account security with an accessible and customer-focused user experience. To learn how our platform helps fintechs and banks ward off financial ATOs, kick some bot and book a meeting with us today!
Micro-Deposit Fraud: How Arkose Labs Stands Behind Financial Services
Share The Blog
