Woburn, MA – March 9, 2017 – According to a new Kaspersky Lab report from the Financial Institutions Security Risks survey, financial customers are playing an important role in highlighting security incidents, with nearly one in four (24%) financial institutions claiming that some of the threats they faced in 2016 were identified and reported to them by a customer.

To gain a better understanding of the current financial security landscape, Kaspersky Lab and B2B International surveyed 841 business representatives from financial services businesses across 15 countries. The findings show that financial institutions are under a considerable amount of pressure to ramp up security with the adoption of mobile banking – a trend that is increasingly threatening the security of banks’ IT infrastructures.

The study also shows that security investment is a high priority for banks and financial institutions. After suffering from attacks both on their own infrastructure and on their customers, retail banks are spending three times as much on IT security as comparably sized non-financial institutions. Sixty-four percent of banks admit that they will invest in improving their IT security regardless of the return-on-investment, in order to meet the growing demands of government regulators, top management and even their customers.

Despite banks putting serious efforts and budgets into safeguarding their perimeters against known and unknown cyber-threats, protecting the breadth of IT infrastructure that now exists – from traditional to specialized, ATMs and Point-of-Sale terminals – has proven difficult. The vast and ever-changing threat landscape, coupled with the challenge of improving the security habits of customers, has provided fraudsters with ever more points of vulnerability to exploit.

Emerging Risks: Social Engineering Attacks on Banking Accounts
Emerging risks related to mobile banking are highlighted in the report as a trend that can expose banks to new cyberthreats. Forty-two percent of banks predict that within three years mobile banking will be the main form of customer interaction for servicing accounts.

While customers show signs of online and mobile banking growth, there is a need for more cybersecurity education around safe online behavior. The report reveals that nearly half of the banks surveyed admitted (46%) that their customers are frequently under attack from phishing attempts, with 70 percent of banks also reporting financial fraud incidents as a result, leading to monetary loss.

Rising phishing and social engineering attacks on customers have caused banks to reassess their security efforts in this area. Sixty-one percent of respondents see improving the security of apps and websites that their customers use as one of their main security priorities, closely followed by the implementation of more complex authentication and verification of log-in details (a key priority for 52%).

Although they are vulnerable to the phishing tricks and tools that target their customers, banks are still more concerned about another ‘old enemy’ – targeted attacks – and they’ve got good reasons to be worried. Targeted attack methods are becoming more common-place, with malware-as-a-service platforms even being used to harm financial organizations.

Targeted Attacks: Persistent Threats
Experience of real incidents shows us that investments in security in the financial industry are well worth it in most cases – financial institutions report significantly fewer security events than companies of the same size in other industries – with the only exception of targeted attacks and malware. The detection of abnormal, potentially malicious activity, combining legitimate tools with fileless malware, requires a combination of advanced anti-targeted solutions and extended security intelligence. Still, 59 percent of financial firms are yet to embrace third-party threat intelligence.

Sharing threat intelligence would help banks to identify new and emerging threats quickly considering the low levels of concern banks have about some of their most vulnerable devices, such as ATMs. Sharing more third party intelligence, in this respect, could help banks prepare for threats that they may not otherwise expect.

ATM Protection: Low Level of Concern, High Vulnerability
Banks show comparatively low levels of concern regarding the threat of financial loss due to attacks on ATMs, despite being highly vulnerable to attacks of this nature. Only 19 percent of banks are concerned with attacks on ATM and cash withdrawal machines, despite the growing rate of malware targeting this part of a banks’ infrastructure (in the 2016 threats review we’ve reported a 20 percent growth in ATM malware compared to 2015).

“Combatting the constantly changing threats targeting their own IT infrastructure and customer accounts is an everyday challenge for financial institutions,” said Veniamin Levtsov, vice president, enterprise business at Kaspersky Lab. “To put an effective response in place – that protects all points of vulnerability – requires the financial services industry to have several key components: build a highly integrated anti-targeted attacks protection, embrace multi-channel anti-fraud security and get actionable intelligence on evolving threats.”

For more information about the research, please visit: https://business.kaspersky.com/how-the-financial-industry-reacts-to-cyberthreats/6610.