imsmartin presents identity theft trends and protections

Sean Martin, CISSP, and founder of imsmartin consulting, presented to a group of over 100 attendees during the Firefighter's National Credit Union Summit. The group represents the growing National Coalition of Firefighters Credit Unions.

Image source: Advioso

Identities are at the core of nearly everything that takes place within a credit union. And, with the number of fraudulent attempts to use a stolen identity increasing dramatically, credit unions must take a good hard look at how they are managing their members' and employees' identities - including the transaction auditing and access control mechanisms surrounding them.

In his presentation, Martin covered the following topics:

• Identity theft trends
• Detecting identity-based fraud
• Tips for consumers
• Tips for credit unions

Fill in the form at Advioso to obtain a copy of the presentation, along with a few identity theft protection whitepapers from content sponsors TeleSign, Guardtime, and CSID.

Man-in-the-Mobile Attacks Target the Bank Accounts of Android Users

Android users in Portugal, Spain, the Netherlands, and Germany have been plagued by man-in-the-mobile (MITMO) attacks which enable cybercriminals to gain access to victims' banking data and make fraudulent transfers.

Image source: Photozou / CC BY 2.1

Powered by malwares such as Tatanga and SpyEye (SPITMO), these attacks start off as web injections via Windows users' PCs and come under the guise of notices from the victims' financial institutions instructing them to install a security application onto their mobile phones. If installed onto a device that runs on Google's operating system, the app gives the attacker access to all SMS traffic, including banking transaction authorization codes.

With Android devices accounting for most of the smartphone market in these countries, the Android platform is the obvious target and you must ask how many of your CU's members are also Android users. On the upside, there are preventative technologies out there, such as Guardtime's keyless data integrity validation service which shows when a MITMO attack has occurred and can help your CU intercept the attacker.

Learn more about how to spot these attacks.

Phishing the financial and banking seas

Thanks to the emergence of mobile devices, social networks, and new technologies such as Near Field Communications, the attack surface area against financial institutions has expanded at an explosive rate, providing cybercriminals more opportunities than ever to go "fishing" at your CU's expense.

Image source: Hitchster / CC BY 2.0

The top threats are payment card fraud, cheque fraud, phishing/vishing, account takeover, and third-party point-of-sale skimming, with about 80% of such incidents experienced by banking customers and an exponential escalation of malware attacks targeting financial transactions. Many large financial institutions are confident in their security measures and preparedness against the modern threat landscape, but recent history suggests otherwise.

Yet the painfully long list of increased security breaches within the past year is only the tip of the iceberg. As pointed out by U.S. Vice Admiral J. Mike McConnel (Rtd), "if you can just contaminate the data in one large bank, you could cause global banking to collapse."

Is your CU one of these overconfident institutions? Take a look at this Malta Independent report for a reality check...

Federal appeal court raps bank over shoddy online security

A U.S. construction company may stand a greater chance of recovering some of the US$345,000 it lost in fraudulent wire transfers that it blames on poor online banking practices of its bank.

Image source: Flickr

Fraudsters made six wire transfers using the Automated Clearing House (ACH) transfer system amounting to more than $588,000 in May 2009. About $243,000 was recovered.

The court found that Ocean Bank was not monitoring its transactions for fraud nor notifying customers before a suspicious transaction was allowed to proceed, both capabilities that it did possess with its security system.

Pay me now or pay me later...Are you doing enough to protect your members and your CU? Read the full article to see what could have been done to alter the outcome.

Dozens Held in FBI Credit-Card Fraud Sting

The Manhattan District Attorney and the FBI released details of a huge international cybercrime takedown.

Image source: Rude Cactus

The sting, known as Operation Card Shop, was established to thwart criminals from stealing credit or debit card information from the Internet and using the information for fraudulent transactions.

According to a news release, the coordinated action involved 13 countries and resulted in 24 arrests.

Read the full article to learn more about the sting. Were any of your members impacted?