Panic as Bankers, Fraudsters Empty Customers' Accounts

Disturbing revelations at the weekend suggested that a worrying fraud scheme-the theft customers’ ID data by employees of financial institutions is on the rise.

Investigations showed that insiders in financial institutions in Nigeria are increasingly taking advantage of highly confidential information of customers and trading same to outsiders for illegal profits.

Experts said that the fraud ring involve longtime employees and top performers who abuse their positions of trust and exploit their access to multiple areas and systems of the banks’ systems.

With the help of people on the inside, the fraud ring are now able to recruit people to assume stolen identities and withdraw funds because they knew the banks affected did not have sufficient technology and security to safeguard the customers’ information or alert the institutions when it was stolen.

In another scheme, bank customers are promised shares of mouthwatering but fake riches in return for details of their bank accounts which are subsequently emptied.

There is also phishing mails that are, but not limited to Advance fee fraud, purchase frauds, counterfeit postal money orders, online automotive fraud, counterfeit cashier's check scam, cash the check system, PayPal Fraud, business opportunity or "Work-at-Home" schemes, money transfer fraud, dating fraud, and charity fraud and boisterous employment promises.

Mr. Tunde Ogunsakin, Commissioner of Police in charge of the Force Special Fraud Unit, Ikoyi Lagos, said that from January this year, the unit investigated about 600 cases of fraud in financial institutions.

In all the cases, the frauds were committed in connivance with bank staff.

This came as the US State Department’s ‘Money Laundering Report 2013’ dubbed Nigeria as ‘a significant center for criminal financial activity.’

Matt Baechtle, leading a team of United States Immigration and Customs Enforcement (ICE) and the department of homeland security, to collaborate with SFU for the purpose of fine-tuning measures on how to tackle the threat posed by cyber-attackers, said that internet fraudsters and corrupt officials and business people, as well as criminal and terrorist organisations are allegedly taking advantage of the country’s location, porous borders, weak laws and lack of enforcement to perpetrate cyber-crime.

The introduction of the Money Laundering Act in February represents some of the milestones recorded by Nigeria in her chase to combat cyber-threat; however, more needed to be done to delist the country from being counted among the world’s 59 most vulnerable cyber prone countries.

Ogunsakin also identified problems and challenges in handling bank frauds to include lack of well equipped forensic laboratories, lack of data base of criminals, inadequate legislation, cost of investigation, inadequate working tools, inadequate collaboration with private sector and inadequate international collaborative framework.

Speaking during International Data Corporation (IDC) road-show 2013 held in Lagos recently, Andy Norton, Threat Intelligence Architect, FireEye, noted that today’s cybercriminals, aided by their targets’ porous defenses and unwitting end users are able to deliver advanced malware that exploits systems and enables a range of malicious activities.

According to him, much of this advanced malware is being delivered via emails with malicious file attachments, adding that presently the criminals are distributing files, specifically those that are effectively bypassing traditional security defenses such as firewalls, next-generation firewalls, intrusion prevention systems (IPS), anti-virus (AV), and secure gateways.

He quoted Gartner’s earlier warning that “Organizations face an evolving threat scenario that they are ill-prepared to deal with….threats that have bypassed their traditional security protection techniques and reside undetected on their systems.”

Study carried by the Organisation also showed that 40% of all IT executives expect a major cybersecurity incident, while there are 9,000+ malicious websites identified per day.

Also every second 14 adults become victims of cyber crime and 95 new vulnerabilities are discovered per week.

“99% of breaches led to compromise within “days” or less with 85% leading to data exfiltration in the same time and 85% of breaches took “weeks” or more to discover. And some of the attacked are spurred by Download Stages,” he said.

Analysts have suggested that some IPS/IDS/NGFW vendors are no better at handling evasions today than they were when they released their original products, just as widening gap between hacker capabilities and security defenses put pressure on security organizations who struggle to keep up with the changing nature, complexity, and scale of attacks.

On her part, Lise Hagen, research manager, Software & IT Services, Africa, suggested that risk should become the main agenda to justify IT Security investments.

The essential guides or wining strategy should involve implementation of user awareness & education, spend smarter, initiate a metric-based approach, create a risk portfolio and plan, update, enforce, security policies.