Nigerian Banks Detect 46% eFraud via Customer Complaints

About 46% of cyber incidents are detected through customer complaints, according to Nigerian Cyber Threat Barometer report 2014

This was disclosed by Bukola Smith, head, Payment Sub-committee, Committee of internal Auditors of Banks at E-PPAN 5th e-fraud conference in Lagos, while discussing the “Industry Role And Responsibility In The Criminal Justice Process Of Electronic Fraud”, adding that insider collusion with external parties is identified as one of the likely sources of cyber security breaches in the Nigerian financial services sector.

Smith who doubles as the divisional head, Group Internal Audit, FCMB, said that report shows top cyber vulnerabilities include lack of awareness amongst customers and employees and social engineering, identity theft and social media are the top emerging threats to Cyber security in Nigeria.

She said, “Financial services and banking today is no longer confined to the Banks’ business premises.  Most banking transactions are carried out online over the internet or via the use of technologies such as ATM, PoS, Mobile Banking, electronic funds transfer etc.  In view of the CBN financial inclusion strategy, Agent banking and virtual banking are being imbibed in Nigeria.

“However, this rapid technological evolution now poses significant threats to the electronic payments ecosystem which has resulted in various forms of cybercrimes in Nigeria. Since money is now online and in cyberspace, it is only natural that it will attract the attention of criminals.

“The criminal justice process in Nigeria in relation to electronic frauds is evolving with relevant laws still being enacted and law enforcement agencies and judicial system still in the process of understanding the technicalities of the issue”.

She said that cyber security is becoming so complicated that one could argue that complexity is one of the country’s biggest security challenges.

Smith added that the evolving trends of mobility, social media, cloud-computing and advanced targeted attacks are driving this complexity.

She harped on the “Importance of continuous collaboration between all parties in the ecosystem as e-frauds encompass all parties not just the financial institutions”.

The current challenges in prosecution of electronic fraud cases, she said, include “Lack of digital evidence due mostly to deficiency of expertise in Digital forensics and as such not having adequate evidence to prosecute fraudsters that are apprehended and charged to court;

“Slow process of prosecution by law enforcement authorities.  In addition to clearly setting out which of the law enforcement authorities is saddled with the responsibility of prosecuting e-fraud cases in view of technical know how to handle such cases

“Lack of Cybercrime law – The Senate passed the Cybercrime Bill in October 2014

“Inadequate collaboration and information sharing by parties in the e-payment ecosystem to encourage knowledge sharing amongst all members on current fraud trends  to enable a proactive approach;

“Poor fraud reporting culture due to perceived reputational damage or loss of customers fear of regulators and lack of confidence in law enforcement agencies;

“Lack of centralized fraud management system – this is being currently developed by NIBSS; Insufficient background checks for Bank employees especially contract staff; lack of Identity Management System in the country – Will be partly addressed by the CBN BVN project and lack of legal Arbitration system on resolution of issues on e-frauds between banks and customers”.

To address the challenges, Smith listed some of the processes adopted by the industry to include, “The committee of Chief Internal Auditors of Banks (CCIABN) is working with E-PPAN and other industry groups to set up a central taskforce for coordination of e-fraud investigations and prosecution; Providing adequate support to the law enforcement authorities ( engaging, training etc.); Continuous customer education ( balancing act between protection & convenience e.g. device authentication) and the need for continuous improvement in risk management systems based on finding from investigation of e-fraud cases”.

Other ways include improving skills of staff on evidence gathering and digital forensic investigations; pushing for the establishment of Special courts for quick adjudication of fraud cases; pushing for greater collaboration with Telecos and setup a framework for carrying out detailed background checks on employees of all parties involved in the e-Payment ecosystem.