Should you be having sleepless nights stressing about your bank’s cybersecurity defences? A report by the security firm Kaspersky Labs claims that a multinational gang of cybercriminals stole up to $1bn over a two-year period by infiltrating more than 100 banks across 30 countries.

In January, the Bank of England warned banks in the UK that they were facing an “ever-present, ever-evolving threat” from hackers and cybercriminals, and should expect that attempts to penetrate their networks would be successful.

What implications are there for you, your personal data, and your money?

Zero day attacks
One of the biggest dangers facing banks at the moment is a zero day attack, which exploits weaknesses in software before a patch has been developed. “A zero day attack is an attack that’s been developed specifically to bypass traditional security measures,” says Ross Dyer, the UK technical director for Trend Micro, which provides security solutions for banks. “It’s a new piece of malware that no one’s ever seen before, so nobody says: ‘This is malicious, let’s block it.’”
Hackers steal $1bn in series of online bank thefts says report
Read more
Banks that have taken advanced security measures can use a defensive technique, known as “sandboxing”, to isolate the malicious code of a zero day attack before it is executed, then analyse and identify it as malware.

Dyer says he is aware of a specific project at one major UK bank, which he cannot name, that is urgently trying to shore up its defences against a zero day attack following pressure from the Bank of England.

“If I was a customer of that bank and they weren’t protecting against zero day attacks, I’d take my money out of there,” says Steve Bell, spokesman for internet security firm Bullguard. “If a bank hasn’t got defences against zero day attacks, they really don’t have a handle on cybersecurity.”

The Bank of England declined to comment on whether it had told any UK banks to build defences against a zero day attack, but it is openly encouraging banks and other financial institutions to take part in a new, tailored – and entirely voluntary – programme of testing which it has developed, known as Cbest. This test deliberately seeks to highlight the vulnerabilities in a bank’s systems, partly so that a bank can protect itself against a zero day attack,together with other issues. British and US intelligence agencies will also play a series of war games against the financial sector to test their resilience to cyber-attacks this year.

What will happen if a cyber-attack succeeds?
Advertisement

You could be unable to access your bank account online. Both the HSBC and NatWest sites, for example, have been brought to a standstill by hackers in the past.

ATM systems may also fall victim to a cyber-attack: the Federal Financial Institutions Council, a US regulator, says that cybercriminals stole more than $40m from 12 debit card accounts via an ATM hack last year.

Elsewhere, a Ukranian cybergang managed to transfer at least $15m – in chunks of less than $10,000 – from hundreds of compromised accounts at different US financial institutions to prepaid cards they controlled.

Your personal details may also end up in the hands of a hacker. In June 2014, hackers managed to steal the contact details (addresses, phone numbers and email addresses) from JPMorgan in a breach that affected 76m households and 7m small businesses. It may have originated from the theft of a single employee’s login credentials, according to the New York Times. “Fundamentally, the weak link in the whole chain is the human,” says Dyer.

In the worst case scenario, the Bank of England’s executive director Andrew Gracie says a successful attack on a bank today could not only result in the corruption or loss of data held in the bank’s systems, but also “a complete loss of systems, disrupting a firm’s capacity to operate”. He said in a recent speech: “The threat is there not only to steal data but to disrupt or destroy the functions of a firm.”

Is your bank well-protected?
Banks in the UK spend at least £700m a year on cybersecurity, according to the British Banking Association (BBA) – but there is no way to know which banks spend the most or are the best protected.

The Bank of England has, however, analysed the “cyber resilience” of the 36 financial firms that make up the core of the financial system and stressed that it did not find any immediate critical shortcomings, just areas for improvement. It refused to discuss the information it had uncovered about the individual vulnerabilities of various banks and the results of its Cbest testing are confidential.

What steps are banks taking?
Some, such as HSBC, have publicly made a point of recruiting former military intelligence officers to strengthen their systems against cyber-attacks, and some have also hired geopolitical analysts to monitor global threats.

To prevent the spread of cyber-attacks, banks are also privately sharing information about their own cyber threats and vulnerabilities with other firms, IT analysts and government agencies in real time, on a new government platform called Cisp.

Can you protect yourself?
You can’t prevent a cyber attack on your bank, but you can be vigilant about your own accounts, says Joram Borenstein, a spokesperson for Nice Actimize, an IT security firm for global financial institutions.

If you notice any unusual activity, however small, consider reporting it.

There is no obligation on a bank to tell its customers that the bank has been the subject of a cyber-attack. Nevertheless, the Financial Conduct Authority does expect banks to tell any customers about an attack if those individuals suffered a direct or indirect financial loss (for example, through the theft of their personal data) as a result of the attack.

Yet, even when a bank has identified that a customer has been a victim of a cyber-enabled fraud, the BBA would only say that in most cases customers will be told.

“Often, incidents are minor and the banks don’t disclose everything,” says Borenstein. “It’s not uncommon for, say, cards to get replaced for reasons that banks don’t tell you about.”

Bell describes another scenario: “Imagine your bank says: Sorry, there was a technical error in your bank account, you’ve lost £2 and it’s been reimbursed. You might think: OK, no big deal.

“But if hackers can access 2m accounts, and siphon off a little bit from each, they can scoop up millions – and the bank probably wouldn’t want to publicise this.”

Borenstein adds: “We don’t read about attacks on the banks on a daily basis, but I know for a fact in the UK that it’s a regular occurrence.” That’s why, he says “the major banks have teams monitoring alerts, unusual behaviour and spikes in activity, 24/7”.

Should you be worried about losing your money?
“Broadly speaking, customers will not be liable for any transactions on their accounts that they have not authorised if these are a result of a cyber-attack on the bank,” the FCA said, adding that you may also be entitled to compensation for losses you have incurred if your bank fails to execute your transactions properly (for instance paying a standing order late) or has failed to take proper care of your personal information, due to a cyber-attack.

The FCA also emphasised that all bank deposits up to £85,000 are protected by the Financial Services Compensation Scheme and that it has the power to fine banks heavily if they fail to put adequate systems and controls in place to identify and manage IT risks.

Back