The Standard Bank Group says it shut down over 5 000 fake Web sites in the first quarter of 2021, and blocked millions of e-mails created by cyber fraudsters who impersonated the bank in efforts to solicit funds from customers.
Africa’s largest lender by assets says it has observed an alarming increase in sophisticated financial cyber crimes over the past year, and it has deployed advanced technologies and intelligent tools to fight criminal activity, as fraudsters stop at nothing to exploit the COVID-19 pandemic.
During a webinar yesterday, titled: “Let's talk digital security”, Carolina Reddy, head of fraud risk management for the Standard Bank Group, explained the dark Web is home to a hive of illegal marketplaces, from which hackers buy tools and develop malicious Web sites to impersonate actual banking sites.
The bank has foiled fraudsters who adopt sophisticated ways to spoof its Web site and employees’ e-mail addresses.
In addition to shutting down thousands of spoofed sites, Standard Bank Group in the past year blocked over 180 million e-mails with fraudulent attachments that attempted to rob victims of their hard-earned cash, she noted.
“Standard Bank is trying very hard to stay ahead of the fraudsters and keep our customers protected, and it’s important for customers to always notify us of these criminal activities – because if we aren’t aware of fraudsters impersonating us, we aren’t able to shut down these phishing Web sites,” explained Reddy.
“And often, as quickly as we shut them down, the fraudsters are able to open new phishing sites. We are proactively looking for these phishing sites by running online scans that look at brand abuse activity, and Web sites which have our brands, etc, but sometimes customers receive things that we may not have picked up, so it’s really important to partner with customers to fight these crimes.”
In her presentation, Reddy showed the audience a fake Standard Bank Web site mimicked by the fraudsters, which looks exactly the same as the bank’s genuine site.
She also demonstrated how fraudsters have in the past impersonated the big-four bank’s SA CEO Lungisa Fuzile in a common e-mail impersonation scam.
“As you can see, this e-mail address really looks like a Standard Bank address – it has the CEO’s name and the correct e-mail domain name, but as soon as the recipient responds to it, in the header you can identify there is suddenly additional information as part of the e-mail address. You can now see this is not a Standard Bank e-mail address, although it has some Standard Bank information, and you realise the e-mail address is actually that of a fraudster.”
Operating as professional firms
The COVID-19 pandemic resulted in more digitally-active users and infinite possibilities for criminals to exploit, she added.
Providing an analysis of the cyber crime trends observed by the bank, particularly since the onset of the pandemic, Reddy pointed out that phishing (attempt to illegally obtain data), vishing (phone phishing), smishing (SMS phishing), online shopping scams and business e-mail compromise scams have been among the most popular methods adopted by criminals.
Another trend observed in light of COVID-19 relief grants and business loans is fraudsters impersonating government departments or financial institutions to gain victims’ sensitive data in order to “deposit COVID-19 relief payments into their accounts”.
Cyber crime syndicates operate in the same way as formal enterprises, with experts specialised in each area of the illegal activity, she pointed out.
“Fraudsters send e-mails, which say you qualify for grants, and have attachments that more often than not, have malware in them. These criminals actually have business plans and execution strategies, and they call our customers and organisations from their set-up call centres impersonating banks. When they call customers, they may have a little bit of their information and credentials, which they would have harvested from the dark Web or from social media.”
Also presenting during the webinar, cyber security expert and author Jamie Bartlett commented that cyber fraud is now a multibillion-rand industry and one of the most gripping industries in the world, becoming just as advanced and professional as any other sector.
He highlighted the challenges faced by law enforcement agencies across the globe in combating the increasing levels of cyber crime: “The main reasons why it’s often so tough to catch these criminals is because there are so many good uses for these encrypted tools found on the dark Web. So you find the good guys who are professionals use the same tools as the bad guys – so we don’t want to fully get rid of [these tools] and this means we’re always going to have to live with a good degree of online crime.”
Secondly, he noted crime has evolved in the last 20 years, with technology bridging all physical barriers between victim and perpetrator. This evolution also means criminals not only target the big powerful financial companies, but essentially any organisation that stores sensitive customer data.
“The law enforcement authorities responsible to investigate these crimes may have no interest in investigating an international crime and catching a criminal who is sitting in another country. While they’re getting better at that, of course, it’s still very difficult to catch a criminal who is sitting across the globe and who is just as smart and creative as they are.”
Share