Cybersecurity experts agree that the threats facing financial services providers aren’t just increasing; they’re doubling with each passing year.

In fact, a new report from cybersecurity company Kaspersky states that the amount of data held by financial services companies makes them prime targets for “cyberthreat actors,” but the company cautions that even the most advanced security protocols may not be enough to protect against an attack.

So, what specific threats should companies be on the lookout
for in 2020 and beyond?

According to the report, Kaspersky expects to see a rise in
paid access to banking infrastructure and ransomware attacks against banks over
the next 12 months.

There are several reasons for the expected increase in
attacks, including the amount of consolidation that there’s been in the banking
industry in the last several years, along with banks’ seeming willingness to
pay up when held hostage by a ransomware attack.

According to Kaspersky, the attackers “prime targets” are
likely small banks and other financial organizations that were recently bought
by bigger companies that are rebuilding their cybersecurity system in
accordance with the standards of their new parent companies.

“It is also expected that the same banks may become victims
of targeted ransomware attacks, as banks are among those organizations that are
more likely to pay a ransom than accept the loss of data,” Kaspersky added.

Kaspersky also cautions that there are already “large-scale, anti-fraud bypass” efforts underway.

Over the last few years, Kaspersky notes that cybercriminals
have seriously invested in ways to bypass anti-fraud systems, because, in many
cases, a user’s login, password, and personally identifiable information is not
enough to gain access to their accounts.

And, according to the report, those investments are paying
off because there is now a “huge underground market” called Genesis, which
sells digital fingerprints of online banking users from all over the world.

Digital fingerprints include a combination of system
attributes that are unique to each user’s device, and the personal behavioral
attributes of that user, including the IP address (external and local), screen
information (screen resolution, window size), firmware version, operating
system version, browser plugins installed, time zone, device ID, battery
information, fonts, etc.

The report states that the “Genesis Store” is an online,
invitation-only “private cybercriminal market” for stolen digital fingerprints.

According to Kaspersky, it uncovered more than 60,000 stolen
bot profiles on the Genesis Store earlier this year. These profiles include
browser fingerprints, website user logins and passwords, cookies, credit card
information, etc.

Combine all of that information together and criminals are
able to “masquerade as legitimate online banking users from any region,
country, state, city, etc.” and gain access to banking systems.

The company notes that multi-factor identification is the
“best option” to avoid these type of intrusions, but cautions that even
multi-factor identification can be breached due to issues with biometrics,
using a person’s physical features as a means of security.

“In theory, biometrics should solve a lot of problems
associated with two-factor authentication, but practice has shown that it may
not be so simple,” Kaspersky notes. “Over the past year, several cases have
been identified that indicate biometrics technology is still far from perfect.”

One significant issue in biometric security is leaks of
biometric databases, and there have been several of those in the last year.

“The most notorious was the leak of the Biostar 2 database
that included the biometric data of over 1 million people. The company stored
unencrypted data, including names, passwords, home addresses, email addresses
and, most importantly, unencrypted biometric data that included fingerprints
and facial recognition patterns as well as the actual photos of faces,”
Kaspersky noted. “A similar leak occurred at a US Customs and Border Patrol
contractor, where biometric information of over 100,000 people was leaked.”

So, even a user’s face may not be enough to ensure the
security of sensitive data.

Kaspersky also notes that fintech companies are facing
increasing attacks as well.

“Mobile investments apps have become more popular among
users around the globe, and this trend won’t go unnoticed by cybercriminals in
2020,” Kaspersky stated. “Not all of these apps utilize best security
practices, like multi-factor authentication or protection of the app
connection, which may give cybercriminals a potential way to target users of
such applications.”

Financial services providers also need to aware that their
own employees could be targets for hackers, who could use those employees to
gain access to company systems.

There’s been a rise in this type of cybercrime in recent
years, especially in the real estate industry.

Over the last few years, there has been an increase in hackers targeting real estate transactions and stealing funds from both unsuspecting buyers and companies alike.

Several years ago, the Federal Trade Commission and the National Association of Realtors issued a warning to people interested in buying a home about scammers who were posing as real estate agents, Realtors and title insurance companies to steal consumers’ closing costs.

And last year, the federal government arrested nearly 75 people who allegedly participated in schemes designed to intercept and hijack wire transfers from businesses and individuals, including those involving real estate transactions.

And as Kaspersky noted, these types of phishing attacks are
only going to increase, as the “human factor” is a constant “weak link” in
companies’ security.

Kaspersky also noted that attackers may be willing to offer
“large amounts of money” to insiders to get them to turn against their own
companies.

Kaspersky notes there are a number of ways that “insiders” may be recruited into schemes like these, including:

• By simply posting an offer on forums and offering a reward for certain information.
• The attackers may disguise their actions so that employees don’t realize they are acting illegally, disclosing personal information or engaging in insider activity. For example, the potential victims may be offered a simple job on the side to provide information, while being reassured that the data is not sensitive, though it may, in fact, relate to the number of funds in a bank client’s personal account or the phone number of an intended target.
• Blackmailing. We also expect to see increased demand for the services of groups engaged in corporate cyber-blackmail and, as a consequence, an increase in their activity.

“With 2020 on the horizon, we recommend security teams in
potentially affected areas of the finance industry to gear up for new
challenges,” Yuriy Namestnikov, a security researcher at Kaspersky, said. “There
is nothing inevitable in potential upcoming threats, it is just important to be
properly prepared for them.”

The post Attention finance industry: Here are the cybersecurity threats coming in 2020 appeared first on HousingWire.