In the ongoing battle between online attackers and cybersecurity teams, financial service providers are increasingly under attack as cybercriminals devise new ways to gain access to customer accounts.

• Massive man-in-the-middle attacks use phishing-as-a-service kit EvilProxy to target hundreds of enterprises, with a single campaign hitting 340 companies, including banks, across 48 languages last year
• There was a 202% increase in bots attempting to take over consumer financial accounts in Q2 2023
• 29% of Americans have experienced account takeover, a rise from 22% in 2021

From deviously tricking consumers via phishing and social engineering into sharing their financial information to exploiting vulnerabilities in banking systems and applications, the risk of bad actors engaging in account takeover (ATO) attacks has also risen significantly. It is critical for banks that offer digital services to understand ATO attacks, their impact, the role of bots, and best practices for prevention and response to safeguard their customers’ assets.

Why your bank or financial institution is a likely target

A quick review — a bank account takeover (ATO) occurs when a hacker gains unauthorized access to a user’s bank account and uses the compromised account for financial crimes such as siphoning funds, making unauthorized transfers or payments, and more sinister criminal activities like money laundering and money muling.

With cybercrime-as-a-service (CaaS) platforms, bad actors are now able to leverage advanced technology approaches that were initially developed for nation state cyber warfare but are now commercially available via a subscription. This dramatically lowers the barrier for entry to criminals and enables them to more easily trick your consumers and gain access to their credentials. These cybercrime platforms are fueling the rise in phishing and account takeover as attackers can leverage the accuracy and speed of bots to scale up in no time, with minimum investment. Bot-driven account takeover attempts can overwhelm security teams, making it difficult for them to keep pace with the scale of the attack.

If Willie Sutton were around today, he might say he robs banks “because that’s where the digital gold mines are.” Banks, credit unions and other financial institutions are common targets for account takeover attacks not only for the significant amounts of money they hold but also because of the massive amounts of personal identification details and financial records they contain.

Telltales of a bank account takeover attempt

So how do you know if your bank is under attack? Here are some of the symptoms your institution might be experiencing:

• Unusual login activity: A sudden increase in failed login attempts, login activity from unfamiliar devices, IP addresses, multiple login attempts within a short time frame, or logins from countries where the account holder has no history of activity
• Changes in account information: Unauthorized changes to account details, such as email addresses, phone numbers or mailing addresses
• Unexpected transactions: Unexplained or unauthorized transactions, especially large withdrawals, wire transfers to unfamiliar accounts, or payments to new beneficiaries
• Anomalous account activity: Anomalies in account activity, such as sudden changes in spending patterns, transfers to high-risk entities, or purchases outside the account holder’s typical behavior
• Unsolicited contact or phishing attempts: Phishing emails, texts or phone calls designed to trick account holders into revealing sensitive information or login credentials
• Account locked outs: Account holders suddenly unable to access the account or noticing unauthorized changes to account settings
• Alerts from fraud detection systems: Automated alerts from fraud detection systems notifying account holders or bank staff of suspicious activity

Techniques for detecting and preventing bank account takeover fraud: a checklist

Preparing your institution to combat today’s ATO attacks involves a multi-pronged approach — a combination of technologies, robust security protocols and proactive strategies. None is foolproof on its own, but together, they can create a formidable defense that significantly reduces the risk of account takeovers.

1. Multi-factor authentication (MFA)
Implementing MFA adds an extra layer of security beyond just usernames and passwords. This can include something the user knows, such as a password, something the user has, like a mobile device for a one-time code, or something the user is (biometric verification like fingerprints or facial recognition). It’s critical to note, though, that man-in-the-middle attacks can get through MFA controls, so it is just one tool in your cybersecurity arsenal.

2. Behavioral analytics and user profiling
Utilizing advanced analytics to monitor user behavior patterns and detect anomalies. This can involve tracking login locations, devices used, transaction patterns and other activities that deviate from the user’s norm, potentially indicating unauthorized access.

3. Behavioral biometrics
Analyzing the way a user interacts with a device, like mouse motions, keystroke dynamics or touch screen interactions. My colleague Luke Stork nicely summarizes the role behavioral biometrics plays in a security system and how to separate it from user behavioral analysis in his post Behavioral Biometrics: Raising the Bar for Attackers.

4. Endpoint security
Strengthening the security of user devices accessing bank services through antivirus software, firewall protection and regular software updates can help prevent malware-based credential theft.

5. Encryption and secure communication channels
Ensuring that all data transmitted between the bank and its customers is encrypted, using technologies like TLS (Transport Layer Security), can safeguard against data interception and man-in-the-middle attacks.

6. Phishing detection and education
Advanced phishing protection software that can detect, alert and block dangerous man-in-the-middle (MITM) and reverse-proxy phishing attack campaigns is critical. Educating customers about the risks of phishing and how to recognize suspicious emails or links is also important.

7. Credential stuffing protection
Implementing solutions to detect and block repeated login attempts and the use of previously breached credentials. This can include rate-limiting login attempts, CAPTCHA-type challenges, and using databases of known compromised credentials to preemptively warn users. Concerned that this might affect the consumer experience? Then check out my blog post Strong Security or Superior Consumer Experience? The False Dilemma of the Online Gatekeepers.

8. Transaction monitoring and alerts
Offering or even mandating account monitoring services that alert users to suspicious activities, such as logging in from a new device or location, large transactions or changes to account details.

9. Incident response plan
Having a clear, tested incident response plan in place enables a swift reaction to detected ATO incidents, minimizing damage and facilitating rapid recovery.

10. Secure development practices
Adopting secure coding practices and regularly conducting security assessments, penetration testing and vulnerability scans of banking applications to identify and fix security weaknesses.

11. Collaboration and intelligence sharing
Engaging in industry collaboration efforts, such as sharing threat intelligence and best practices with other financial institutions and security entities, to stay ahead of emerging ATO tactics. For example, the Arkose Labs Global Intelligence Network, which includes major corporations and category leaders, leverages data collected from our wide array of deployments in various sectors to analyze and understand the evolving tactics, techniques and procedures cybercriminals use.

A note on how Arkose Labs can help banks prevent ATO attacks

As a leader in bot and human attack prevention and detection, Arkose Labs can help your bank proactively fight ATO. Our platform leverages advanced AI and machine learning capabilities to identify and block bots and automated scripts often used in ATO attacks. By analyzing user behavior and identifying patterns that are indicative of attack activity, the platform can block suspicious activity in real time, before account takeovers can happen. It combines advanced risk scoring and authentication capabilities with behavioral biometrics, device fingerprinting, sophisticated machine learning algorithms, and other advanced authentication techniques to verify user identities, accurately identify suspicious activities, and thwart fraudulent login attempts.

Get valuable visibility into emerging fraud trends and patterns. Book a demo today to find out how we can help!

*** This is a Security Bloggers Network syndicated blog from Arkose Labs authored by Liam Maxwell. Read the original post at: https://www.arkoselabs.com/blog/bank-account-takeover-scenarios/