Banking Law

Consultant Jasbir Anand wrote a nice "Viewpoint" piece in  a recent issue of the American Banker (paid subscription required) about "man-in-the-browser" attacks on bank accounts. While banks have invested in multifactor authentication over the past few years (which is a requirement of regulatory guidelines), Anand points out that multifactor authentication alone is no longer sufficient to beat the sophisticated cyber criminals of today (the type we recently discussed).

In the past, banks invested in multifactor authentication to try to ensure that only legitimate users accessed online banking systems; they also invested in systems that provide IP address intelligence for online banking transactions. However, although IP address intelligence detects account takeover where fraudsters have used phishing techniques and malware to obtain login credentials of legitimate users, it falls short at detecting man-in-the-browser attacks ? which take place without affecting the legitimate device and IP address data sent with the transaction.

So what can banks do to protect themselves from man-in-the-browser attacks? Customer authentication measures aren't sufficient, so instead banks can mitigate their risk by gaining a better understanding of the activity within an online banking session to determine if it fits the established profile of the genuine customer.

Anand recommends a "layered approach" to monitoring transaction activity as well as the banking account itself. 

For example, all customer interactions can be categorized into event classes that incorporate monetary and nonmonetary actions such as: payment events ? financial transactions such as funds transfers and bill payments; login events ? IP address and session ID profiling; password events ? changes in logon passwords; profile events ? changes to customer demographic information; and navigation events ? changes to how a customer navigates an online portal. A break in pattern of one of these may not indicate fraudulent activity. However when monitored together, the identification of small anomalies becomes a strong predictor of criminal intent.

Anand also recommends that banks monitor across multiple transaction channels, because fraudsters are gaining access through one channel, then maneuvering across many "silos" within the bank where banks are not connecting the dots. 

Banks and financial institutions need to explore enterprise fraud management systems that take a full view of an institution's relationship with a customer. An enterprisewide approach protects institutions at multiple levels, from identity theft to deposit fraud. This expanded view allows institutions to better detect and prevent fraud by monitoring transactions and events across the range of customer activity.

Yes, this takes effort and expense, and experts who know what they're doing. Unfortunately, "experts who know what they're doing" are exactly what bank security systems are trying to fight. There's no lack of brainpower among criminals, notwithstanding the lack of moral scruples. Banks can't afford to be behind the curve.

As I said a couple of days ago, it's certainly understandable why smaller banks spend a lot of time gnawing their fingernails to the quick about these types of threats and the expertise and expense required to combat them. On the other hand, you can't be in the banking game today unless you offer online banking to consumers and businesses, and you can't offer online banking unless you are prepared to provide sufficient security to meet your regulatory and legal obligations. Well, you can, actually, but you won't be doing it for long. Either the criminals, your regulator, or the outward stampede of customers will fairly quickly put you out of business.

You can find out more about these type of threats to online banking (and others), and how to deal with them, in tomorrow's webinar from Bank Law Stuff, "Online Banking Security: Corporate Account Takeovers, Electronic Money Mules and How to Protect Your Customers."

As the former CEO of a community bank told me over lunch not long ago after we discussed a case of cybercrime that cost a certain community bank a tarnished reputation, "Am I glad I retired when I did. Banking is getting to be such a pain in the a** that I just wouldn't want to be starting all over again today."

I could have told him that the same could be said about bank lawyering, but since most bankers (like most other citizens of this country) don't consider lawyers to be actual "human beings" worthy of sympathy, I kept my mouth shut and just nodded my head sympathetically.