Speaker: Evolving cybercrime landscape warrants response

Cyber criminals are becoming bolder in trying to steal money from both bank customers and financial institutions, said Mike Burke, senior robbery and crisis management consultant for SHAZAM..Speaking June 10 during the Minnesota Bankers Association conference in Brainerd, Minn., Burke said criminals are concocting increasingly elaborate schemes such as spoofing banks and sending fraudulent messages to customers alleging they are being investigated for child pornography. They also make requests banks would never have, including asking customers to provide them with a matching one-time-password.Some banks are responding by requiring customers seeking at least $5,000 to answer a questionnaire, Burke said. Others have a Trusted Contact Form, allowing FIs to contact a trusted person if they suspect account fraud. Adopting a direct approach, Burke said bankers should check the status of the money order customers purchased from the Postal Service by visiting the Money Orders Application and ensuring the check has the serial number, Post Office number and dollar amount.Burke is noticing younger customers with little money who fall victim to fraud walking into banks with $18,000 checks. The amount of the check has been either washed or cooked and is often an anomaly. To respond, Burke called on frontline staff to pick up on any anomalies and delay the transaction, potentially by saying they will check with the depositor. Fraudsters will usually have an earbud on and leave once the teller delays the transaction. Successful attempts at fraud ensure that the criminals will go to other branches, Burke said. Fraudsters sometimes call the financial institution to change the contact phone number for an account. Burke recalled one instance in which a bad actor spoofed a number and sought to change contact information. Within 15 to 20 minutes, a fraudster walked into the bank and withdrew $47,000. Burke recalled another instance in which two Chinese nationals with three bank bags full of money and U.S. passport booklets came into a bank seeking new business accounts. Ink was smeared on one of the passports. The nationals didn’t have their business paperwork, and told the bankers they would send it by the end of the day. Authorities quarantined the email and discovered ransomware. In other cases, fraudsters present a real check, correct personally identifiable information but with a photo ID of themselves. Criminals are also impersonating passport cards, leading Burke to recommend having a second form of ID. Banks can also use black gel-ink pens to effectively spot fraud, Burke said, because the substance will permeate the check and not wash off. Fraudsters sometimes seek an instant-issue debit card as they open accounts, Burke noted. They sometimes seek to secure five $1 money orders before altering the check, swapping in $1,000 for each check. The fraudulent checks are then deposited, with the criminals taking some of the ill-gotten gains when a portion of the check clears at midnight. Burke listed a number of red flags for new accounts, including the depositor only issuing the minimum amount, having an instant issue debit card, or depositing checks into the account at an ATM the same day the account opens. In other cases, criminals target business and vendor accounts with malicious emails, with roofing company employees opening the emails. Once that occurs, the malicious material can stay on networks for 280-300 days, Burke noted. In those instances, criminals want to access the business email server to connect with the financial institution. If that contact is successful, the threat actor launches a denial-of-service attack. To respond, Burke advised banks to call a trusted number for the customer when there is an attempt to change the account. Burke also discussed Top Hat Attacks in which cybercriminals gain access to the top portion of an ATM to install malware or skimming devices, allowing them to directly access and remove the cash. Burke advised bankers to thwart such plans by changing the ATM technician key. Banks should ensure their cameras capture the rear plate of the vehicle, as 20 of 50 states don’t require a front license plate reader, Burke added. To prevent hook-and-chain ATM attacks, banks can install landscaping near the machine to keep trucks from backing up.