Tips for Improving Customer Security Measures

Being in the fraud prevention industry gives me an insider’s view of how fraud attacks work - including seeing new patterns emerge. Here are recent insights on how fraudsters are increasingly targeting people to take control of their bank accounts and initiate unauthorized wire transfers. 📞 The Phone Call Scam: Scammers exploit the vulnerability in PSTN to spoof caller IDs, making it seem like the call is coming from a trusted bank. A number of well-known VoIP providers make this possible. 🔓 Remote Access: Once they establish contact, scammers mention there is some suspicious activity or other important reason behind their call. They then persuade victims to install remote desktop applications like AnyDesk, or to turn on WhatsApp or Skype's screen sharing. This allows them to access banking apps and initiate transfers. This helps them to intercept login data and one-time passcodes. Banks also don't insure against such scams, leaving victims exposed. 🤖 AI in Voice Scams: Imagine combining voice recognition with GPT-based text-to-speech technology. Scammers scale their operations massively, this is a future risk we must prepare for now. So what proactive measures can banks and digital wallets take? 1. Customer Education: Many banks already do this; keeping their customers informed about official communication channels and the importance of calling back through their verified numbers. 2. One-Time Passcodes for Payments: OTPs aren’t just for logins but also useful for transactions, with detailed payment information included. 3. Being On a Call During Transactions: The top FinTechs are already looking into, or developing technology to detect if a customer is on a call (phone, WhatsApp, Skype) during banking activities. 4. Detect Remote Access: Implement detection mechanisms for any remote access protocol usage during banking sessions. 5. Behavior and Velocity-Based Rules: Sophisticated monitoring should be used to flag activities in real-time based on unusual behaviour and transaction speed. 6. Device, Browser, and Proxy Monitoring: This is a quick win, as there are many technologies available to flag unusual devices, browsers, and proxy usage that deviates from the customer's norm. 7. Multiple Users on Same Device/IP: Ability to identify and flag multiple customers who are using the same device or IP address in one way to detect bots. 8. Monitoring Bank Drops and Crypto Exchanges: Pay special attention to transactions involving neobanks, crypto exchanges, or other out-of-norm receiving parties, to identify potential fraud. Some of them might not ask for ID and even if they do, it can be easily faked with photoshopped templates. Hope you find that useful, and in the meantime, I’d love to hear what other emerging threats you’ve seen or heard of. Fostering these open conversations is what enables us all to unite together against combating fraud 👊 #FraudPrevention #CyberSecurity #DigitalBanking #ScamAwareness #AIinFraudDetection

Recently worked on an issue where an account was taken over, even though the account had MFA enabled. Ultimately MFA fatigue caused a user to automatically approve an MFA request when it wasn't valid. Multi-Factor Authentication (MFA) fatigue is a security risk that arises when users are overwhelmed by frequent authentication prompts, potentially leading to carelessness or susceptibility to social engineering attacks. Here are several strategies to prevent MFA fatigue: 1. Implement Adaptive Authentication: Risk-Based Authentication: Use contextual information to assess the risk level of an authentication attempt. For example, consider the user's location, device, and behavior. Only prompt for additional authentication factors when the risk is high. 2. Optimize MFA Frequency Session Duration: Extend the duration of authenticated sessions where appropriate (based on location, app, and other controls), reducing the need for repeated MFA prompts within a short period. Device Trust: Allow users to mark personal devices as trusted, requiring MFA only on new or untrusted devices. 3. Enhance User Experience Single Sign-On (SSO): Implement SSO solutions to reduce the number of logins and MFA prompts by allowing users to authenticate once and gain access to multiple applications. Biometric Authentication: Integrate biometric factors (e.g., fingerprint, facial recognition) to make the authentication process quicker and more user-friendly. 4. Educate Users Security Awareness Training: Regularly educate users about the importance of MFA and the risks associated with MFA fatigue. Teach them how to recognize and respond to social engineering attacks. Clear Communication: Provide clear instructions and support for users experiencing MFA fatigue, ensuring they understand the security measures in place. 5. Continuous Monitoring and Improvement Monitor Authentication Logs: Regularly review authentication logs to identify patterns of MFA fatigue and adjust policies accordingly. User Feedback: Gather feedback from users on their MFA experiences and use this information to improve the process. 6. Leverage Push Notifications and Modern MFA Methods Push Notifications: Use push notifications through a secure app instead of traditional SMS or email-based MFA, reducing friction and improving security. These are just some controls and each environment should be analyzed and appropriate controls be used based on each security context and risks.

Every month I pick a topic for a really short write-up that I put at the top of a weekly update email I send out to some of my customers. I figured I'd start sharing that monthly topic here as well each month. Without further ado... Top 5 Security Tips for Every Organization Security is a huge complex topic, but I wanted to share 5 things at minimum every organization should be thinking about for their security posture. Require strong authentication - Think about MFA and ideally phishing resistent methods like certificate-based, hello for business, passkeys/FIDO2. Less is more - Practice least privilege and just-in-time access. Humans shouldn't be touching production systems except in exceptional circumstances. Permissions should only be the minimum required for the task (both human and service accounts/managed identities) and for humans elevate up to privileged permissions for limited time when needed. Less is more also applies to connectivity, only have the minimum required connectivity between systems and networks. Stay current - This applies to updates on operating systems, runtimes, applications, anti-malware, agents etc WHILE ENSURING YOU FOLLOW SAFE DEPLOYMENT PRACTICES, i.e. don't just update everything at the same time. Use staged deployments to build confidence (as discussed at https://lnkd.in/ghR76sTw). Have isolated backups - Have separtely secured backups that require different credentials to access. For example in Azure Backup you can use Resource Guard, immutable vaults). Stay informed - This applies to everyone. As security practioners understand the threats that exist and how to protect. For your users help them be aware of common threats they can be vigilant for and where possible help protect them. For a more detailed set of guidance see https://lnkd.in/gRyMrzZx. Stay safe out there!