Fintech security: the challenges and fails of a new era

“I have no idea how this app from my bank works, and I don’t trust what I don’t understand.” Josh is not an old curmudgeon or luddite. He’s 42 with a decent understanding of technology. Nevertheless, the changes in fintech have come too fast for him. It’s not that he doesn’t trust his bank. He doesn’t trust himself to use and manage the banking app securely.

The world we live in has gone through some noticeable changes in the last decade. This is certainly true for the banking industry, which has grasped onto the concept of fintech as nearly interchangeable with finance. However, fintech—or computer programs and other technology used to support banking and other financial services—is the fastest-growing sector in venture capital. It may encompass anything from cryptocurrency to mobile payment apps.

The groundwork was laid for the rise of fintech through a series of major incidents over the last 10 years. These include:

• The banking crisis and subsequent Great Recession of 2007–2009. If you had told someone 15 years ago that a number of big-name banks would not survive the decade, they would have laughed at you. Yet, the list is long.
• New currencies introduced into the playing field, especially crypto. Bitcoin started in 2009, and hundreds of other cryptocurrencies have since followed suit.
• Negative interest rates. Cash deposits incur a charge for storage at a bank rather than gaining interest. Some banks have to pay money to store their surplus in funds at national banks because of the negative interest rates. Some banks even charge their customers with this negative interest.
• New players have entered the field that are different from the establishment. Some are related to the development of cryptocurrencies, but others simply look at financial business in a new and unique way.
• Customers are increasingly expecting their payments to reach their destination account on the same day. This also helps the bank itself, as it reduces the amount they need to store against a negative interest.

What is fintech?

The hardware and software used in the financial world is generally referred to as fintech. But the expression is also used to describe the startups in the financial world. In this article it will be used to describe the technology as many of the settled financial institutions feel they need to adapt to the same new technology that the startups offer their customers. Because of this we can find these new features in banking and other financial applications both in the apps of accomplished firms along with those of the new financials.

Fintech security

While it may come as less than a surprise
that Fintech startups are struggling with security, sometimes the established
names surprise us with how easily they fall prey to data breaches, malware
attacks, or compromised apps.

One of the reasons why some of the fintech
startups are so successful lies in their ability to offer alternatives to
conventional financial solutions through cryptocurrencies, online loans, and
P2P. Along comes a variety of challenges and one of these challenges piques our
interest: cybersecurity. To name one aspect, the huge growth in the number and
size of online platforms makes this industry very vulnerable to security
breaches.

Some of the problems

The introduction of new features sometimes looks as if they were done in a rush and without keeping in mind how secure they are and how clever crooks could abuse them. For example, a mobile banking app that allowed users to add an extra phone to control their account by simply scanning a QR code ended up cleaning out a few bank accounts. Clever imposters tricked people into adding their phone leaving the imposter in full control of the account.

Payment requests leading to fake websites
are a quickly rising threat as banks are rolling out this feature. As always with
newer technology, fraudsters benefit from the victim’s unawareness of how
things work exactly. Someone pretending to buy from you on an online market can
send you a payment request for the amount you are expecting. All you have to do
is click “Accept” and enter your pin. And then find out that you paid them
instead of the other way around.

Fake bank websites in general have been a problem for many years and this will probably remain a problem for some time to come. Most of the times these fake sites are designed to harvest login and payment credentials from the visiting victims. And they are very hard to distinguish from the real bank websites as the threat-actors simply copy all the content and layout from the original sites. And urging customers to look for the green padlock is hardly useful advice anymore.

Payment providers and online shops are plagued by web skimmers. As we have reported frequently especially there are several Magecart groups who are very active at this front. Payments are intercepted and payment card information stolen using compromised e-commerce sites.

And then there is virtual money, or since most money nowadays is virtual to some level, let’s talk about cryptocurrencies in particular. While the introduction of cryptocurrencies was intended to open up a whole new world of payment options, it also opened a virtual cesspit of options to be defrauded. The absence of a central authority gave way to types of fraud and robbery that were unheard of in the old school banking world. Huge steals from marketplaces, bank-owners running with the funds entrusted to them, stolen hot wallet credentials, and let’s not forget drive-by-mining. We covered many of these crimes in our blog about Bankrobbers 2.0.

Financials of all kinds have suffered data breaches in all sorts and sizes. From huge ones like Equifax and Capital One to equally painful ones, for those involved, like the one at P&N bank where sensitive account information was spilled.

Ransomware operators are particularly fond of financials as they usually can afford to pay large sums and they are invested in getting operations back up and running in a hurry. Travelex took the high road and refused to pay the ransom demand made after being hit with Ransom.Sodinokibi.

Privacy concerns

With governments asking for full disclosure of savings both offshore and internal, and on the other hand enforcing privacy laws, financial institutions are expected to balance these demands while keeping their customers on board.

With GDPR in Europe leading the way, financials should be ready or get ready to comply with GDPR or similar laws that apply to them and their customer base.

Countermeasures

The financial industry is considered to be vital infrastructure and for good reason. When we lose trust in our financial institutions, it turns our society upside down. When the paper is no longer worth the number printed on it, or you cannot withdraw money from your account, that rattles the bases of our economy.

Fintech needs to adapt a more security focused
approach to developing new features, especially in their mobile apps. It also
wouldn’t hurt to provide customers with elaborate instructions on how to safely
use the new app or new features of the app.

As a financial startup you want to grow fast. But growing fast comes with its own problems. Making sure your security measures can scale along with your growth is a must. Unless you want to find yourself restricted in your growth or notice your security to start cracking at the seams.

However frustrating it may turn out to be, financials need to think about better identity management and control. Is it enough when someone is logged into an account to allow that entity to fully control the account? Or de we need to add another factor for special actions like raising the maximum amount, allowing withdrawals abroad, or even for transactions that are larger than normal.

Fintech startups can’t expect to get away with security mistakes that other startups might. Being in the financial sector brings with it different responsibilities and expectations.

As I’ve written before: It is key that our
financial institutions protect our dollars and our data so that we can keep
investing our money and our trust in them.

Stay safe, everyone!

The post Fintech security: the challenges and fails of a new era appeared first on Malwarebytes Labs.