Please enable JavaScript to view the comments powered by Disqus.

COVID-19 RESOURCES AND INFORMATION: See the Atlanta Fed's list of publications, information, and resources for help navigating through these uncertain times. Also listen to our special Pandemic Response webinar series.

About


Take On Payments, a blog sponsored by the Retail Payments Risk Forum of the Federal Reserve Bank of Atlanta, is intended to foster dialogue on emerging risks in retail payment systems and enhance collaborative efforts to improve risk detection and mitigation. We encourage your active participation in Take on Payments and look forward to collaborating with you.

Comment Standards:
Comments are moderated and will not appear until the moderator has approved them.

Please submit appropriate comments. Inappropriate comments include content that is abusive, harassing, or threatening; obscene, vulgar, or profane; an attack of a personal nature; or overtly political.

In addition, no off-topic remarks or spam is permitted.

January 22, 2018

Business Email Compromise Is a Growing Threat

In April 2016, I wrote about the work of the FBI’s Internet Crime Center (IC3) and the rise of reported cases of business email compromise (BEC) attempts. BEC involves what looks like a legitimate email from another employee or customer requesting a transfer of funds. Since I wrote that post, BEC attempts—both successful and prevented—have continued to increase dramatically. The latest figures from the IC3 website show that from January 2016 through June 2017, BEC attempts totaled $223 million, with losses at $148 million. BEC scams are also attracting a wider variety of criminals, including individuals, small gangs, and professional groups.

At first, the fraudsters primarily targeted financial institutions and businesses dealing in frequent and large-value transfers, such as law firms handling real estate or trust account transactions. But as fraudsters have proliferated, they've begun targeting companies of all sizes. Last May, the FBI issued another BEC alert, which includes useful descriptions of BEC scenarios based on actual cases.

The BEC attempt is usually not the start of the criminal activity but rather the culmination of an extended effort that began with the criminal hacking a business's financial records. The hack may have occurred when an employee opened an email with a bogus attachment or link that loaded malware on the computer, or when the criminal purchased a user's credentials off the dark web. Once the fraudster has accomplished the intrusion, a period of information gathering begins. The fraudster obtains current accounts payable records, wire transfer transactions, and transfer procedures, and may also comb social media for information that could be useful. Perhaps a targeted company official will be out of town attending a conference, or on vacation and difficult to contact.

BEC attempts generally have the following common elements:

  • It is a funds transfer request.
  • The request is based on a routine event or legitimate transaction.
  • The bank account where the transfer is to be sent is new or has been modified in some way from previous transactions, or the requested method of payment is different.
  • The request often carries a sense of urgency—late fees or breach of a contract are threatened—to encourage bypassing of controls.

To avoid falling into this trap, it is imperative that businesses have strong funds transfer controls that are monitored to ensure compliance. Also, businesses should have a continuing program of internal education (and perhaps testing) for all employees involved in funds transfer requests. The FBI suggests that the best control is to verify transactions through a second, independent means, similar to two-factor authentication.

There are several actions a business can take if it becomes a victim of BEC:

  • Immediately contact the receiving financial institution to see if the funds can be frozen.
  • Notify all relevant employees of the attack—multiple employees are often targeted.
  • Contact the FBI or the Secret Service.
  • Conduct an internal investigation to determine the point of compromise, and then take the necessary corrective action.

Finally, financial institutions with customer education programs should consider providing business customers with materials regarding this threat.

We are interested in hearing from you about your experiences with BEC and preventive practices. Criminals are constantly changing their attack methods and sharing information is a valuable way to help develop best practices.

Photo of David Lott By David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed

 

October 16, 2017

No Magic Bullet for Preventing Data Breaches

Much has been written about the Equifax data breach, including a Take On Payments piece several weeks ago. Since the announcement of the breach in early September, my LinkedIn timeline has been filled with articles and messages from sales and development professionals claiming that their technologies and solutions could have prevented the Equifax breach. Unfortunately, the weakest leak isn't a technology problem or issue. It is, and will continue to be, the human element.

Before I hear from the sales and development professionals I just referred to, let me say that I believe that technology does play an important role in mitigating data breaches. For example, statistics show that homes equipped with a security system—"hard targets"—are significantly less likely to be burglarized than homes without them—"soft targets." I suspect the same is true for companies and data breaches in that those who do a better job of securing their data with technology are harder targets than those who do not. However, technology is only one aspect of preventing data breaches—which brings us back to the human element.

We are the weakest link. We architect and program security systems with flaws. We fail to properly update software or install patches on a timely basis. We open suspicious attachments on emails. We sometimes visit dubious websites and click on suspicious ads or links. We divulge too much information over social media. We share sensitive information with people we think we know and who we think are friendly. And we are mistake- and accident-prone. Education does and will continue to help, but humans will continue to make mistakes and be accident-prone, thus data breaches will remain an ongoing problem.

The late, great musician Tom Petty said, "Music is probably the only real magic I have encountered in my life. There's not some trick involved with it. It's pure and it's real." While Petty's remark that music is probably the only real magic is debatable, there is no debating that data breach prevention has no magic bullet. Educating people remains critical, but, as is all too often the case, education also ends up falling short. As a risk expert, I really wish that I had the answer to preventing data breaches. Unfortunately, human actions trump any answers that I might have. Given the grim outlook for data breaches, it is imperative for companies and individuals to have a plan in place to minimize the damage when a data breach occurs.

Photo of Douglas King By Douglas A. King, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed

 

August 28, 2017

Identity Theft: A Growing Epidemic

I recently attended a conference that explored improvements in identifying and authenticating individuals. Many of the sessions focused on identity theft. While the conference primarily targeted law enforcement, immigration control, and the military, many of the lessons can easily apply to the public sector. A recent industry report validated the conference's focus, noting that in 2016, 15.4 million Americans were victims of identity theft, an increase of 18 percent from the previous year.

Identity theft (also called identity fraud) covers a wide range of crimes in which the criminal obtains and illegally uses another person's personal information in a fraudulent or deceptive manner, typically for economic benefit. In most cases, the criminals get personal information through a data breach, but malware on a computer or mobile phone or email phishing are other sources. Sometimes criminals can get enough personal information from public data—such as property and voter records, as well as social media accounts—to create a false identity and commit a crime.

Social Security numbers appear to be the most valuable information element in creating false identities. For this reason, legislation was passed in 2015 mandating that the Centers for Medicare and Medicaid Services (CMS) remove Social Security numbers from Medicaid cards. CMS recently announced that it will reissue Medicaid cards in April 2018 with a new beneficiary identification scheme.

The criminal actions of identity theft include using account numbers to obtain merchandise that can be monetized, filing fraudulent tax refund returns, and applying for credit to buy cars, lease homes, or even get home equity lines of credit. Outside the financial services arena, identity theft crimes include obtaining medical services, social program benefits, and false identification documents.

The Identity Theft Resource Center is a nonprofit organization established in 1999 to help identity theft victims resolve their cases and to broaden public education and awareness of identity theft, data breaches, cybersecurity, scams and fraud, and privacy issues. The center also tracks the number of data breaches across five industry sectors. As this chart shows, businesses remain the number one target for data breaches, and the number of attacks targeting businesses increased 4.4 percent during the first half of 2017 compared to that same period in 2016.

Us-breaches-by-industry-sector-chart

The increased use of chip cards at merchant terminals has made it more difficult for the criminal element to commit point-of-sale card fraud. Meanwhile, however, overall identity theft fraud is on the rise. So how do we combat this growing threat? We will look at some threat mitigation tactics and tools in a future post.

Photo of David Lott By David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed

 

May 22, 2017

The Year(s) of Ransomware

I remember, as a child, despising the neighborhood kid who would always say, "I told you so." Well, let's move ahead some 30-odd years to the WannaCry ransomware attack—I now feel like that despised child. You see, on March 29 of this year, I emailed the following note to my colleagues in the Risk Forum:

Just a few high-level and interesting notes from the conference.… 2017 & 2018 will be the Year of Ransomware (I can elaborate on this when we are all together—pretty fascinating business models developed here).

Too bad I kept my thoughts to our little group here at the Atlanta Fed and didn't get the message out to the masses (or at least to our Take on Payments readers) prior to the WannaCry ransomware attack that began on May 12. So why did I (and still do) think 2017 and 2018 will both be the "Year of Ransomware"?

Those who know me know that I am not a very technical person. I see things more strategically than technically and usually sprint away from conversations that become technical. After viewing a demonstration on how to launch a ransomware attack, I was shocked to learn that hardly any technical expertise is required to pull off an attack. This is all made possible by the "pretty fascinating business models" that I referred to in my note, business models known as Ransomware as a Service (RaaS).

I'd always envisioned that serious technical code writing capabilities would be a requirement for developing the code to send the malicious files involved in ransomware. And while coding is needed, that is where the RaaS comes into play. You pay someone else to create the malicious code, which you then use to launch a ransomware attack. And to make the attack even more successful, there are simple tools available that allow you to not only test the code against the market-leading antivirus software detection programs but also to tweak the code embedded in the malicious file to ensure that none of the antivirus software programs will detect it. Antivirus software protects users only from known malicious code, which is the reason the software must be constantly updated.

With the undetectable code in hand, you can now launch a ransomware attack through either an embedded file or a link within a phishing email or social media post to a legitimate-appearing, but malicious, website. And this costs little or nothing up front! The cost for the RaaS is only realized once a successful attack occurs, with a portion of the collected ransom paid to the RaaS provider.

Which brings me back to why I think ransomware attacks will continue to escalate, leading to 2017 and 2018 becoming "The Year(s) of Ransomware." They are simple to execute, low cost, and proving to be highly lucrative. (According to the FBI, an estimated $209 million was paid in ransom in the first quarter of 2016.) Expect a future blog post on how to plan for and defend against attacks.

Photo of Douglas King By Douglas A. King, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed

Take On Payments Search


Recent Posts


Categories