This podcast is brought to you by bankinfosecurity.com. Bankinfosecurity.com is your source for the news and views, shaping security, and risk management within the finance base. Corporate account takeover, also known as ACH and Wirefraud, has heard many debates about online security, bank liability when breaches occur, and the need for more regulatory oversight from governing bodies, such as the FFIC. Hi, I'm Tracy Kent with Information Security Media Group.
Today we hear from Terry Austin, CEO of Guardian Analytics, who shares his thoughts about the state of online security. Terry, you and I spoke in February about ACH fraud and online attacks. Now that the new FFIC guidance is out, I'd like you to update that conversation a bit. You said in February that you were surprised by the number of online fraud incidents that were caught by consumers before financial institutions, in the new guidance regulators touched on this concern, saying that they highlight the need for anomaly detection and transaction monitoring.
Can you explain how these types of technologies could have helped banks and credit unions identify previous incidents of fraud before those incidents were brought to their attention by consumers? Thanks, Tracy. Anomaly detection and transaction monitoring is called out by the FFIC as a minimum requirement, one of only two minimum requirements that the FFIC dictates. And they do so because it works.
It really works. It stops a wide array of attacks across a wide variety of payment methods, whether it's ACH, Y, or Bill Pay, or really any of a variety of payment methodologies. So let me just explain a little bit about what anomaly detection is. Anomaly detection really works at an individual account holder level.
And it seeks to monitor that individual account holders specific online behavior and then detect unusual actions that the online user may be taking. And that may be money transfer or it may be something as innocent appearing as changing a phone number or manipulating accounts. But in the context of that, the account holder's normal behavior, it looks unusual. And by really analyzing and zeroing in on that anomalous behavior, it's been proven over and over again that these kinds of frauds and cyber crime attacks can be stopped.
It can spot account reconnaissance where a criminal is actually looking at the account before something to make a transaction. And it can obviously spot fraudulent transactions proactively and allow the financial institution to respond before the money leaves the bank. And we have countless examples. We have a customer that found 75 accounts that have been compromised with millions of dollars at risk.
We've detected dual controls being exploited across all sorts of payment frauds. In fact, recently we stopped a nearly $2 million wire fraud attempt where money was being wired out to China and just a multitude of ACH payments in the hundreds of thousands of dollars involving large networks of money mules where money was being transferred using the ACH system. So anomaly detection, it's not malware specific, it's not threat specific. So it's very resilient as the threat profiles change.
And the customers that we have using the system report that they are account holders are ecstatic because their institution is looking out for them. And you know, this anomaly detection and transaction monitoring, it can sound hard and complex, but it really isn't. It's very easy to deploy, it's very affordable. And we have a growing cadre of customers that are reporting on the value and impact it can have.
And then what about customer education, Terry? You know, of course, this is another area that's been noted in the guidance and obviously it touches on what we've just discussed since customers oftentimes have been picking up on the fraud before financial institutions. But when consumers are the ones who are already aware of what's going on, what additional steps should institutions be taking to educate and collaborate with consumers? Well, you know, the FFIEC guidance really puts the customer education emphasis on transparency and it really calls for the financial institutions to create more transparency between them and their account holders about what the risks are, what the actions are, and what the protections that are in place are.
And I think this is good news. I think the FFIEC got it right here. I think this is good news for both banks and account holders because it will lead to hopefully opening up the discussion and the dialogue. So account holders can make smarter decisions about how they bank and whom they bank with.
And it should give them better awareness of their rights, their protections, their liabilities. And I think ultimately we'll drive account holders to look for banks with the best security solutions in place. Consumer education about threats and about best practices and about doing safe internet usage, that's all good stuff. But account holders will never be able to fully protect themselves from the sophistication and unending attack profiles that are hitting them.
And let's talk a little bit about some of those attack profiles. I wanted to ask you about malware. The new guidance does know that there's increased sophistication of Trojans like Zeus. But our financial institutions really doing much to address those threats.
Well, I think the best step of the institutions can make is to the endpoint device, the consumer's computer or mobile device, is compromised and plan their security strategies accordingly. Now, malware is constantly evolving and it's getting more complex. It's hiding itself from endpoint security solutions even more effectively. And now the malware is even targeting specific malware detection software in order to defeat it.
So I think this is why the minimum requirements that the FFIC pointed out focus on anomaly detection and transaction monitoring and putting better controls in around banking administration functions because you just can't guarantee security at the endpoint. And the FFIC put malware detection solutions in as a layer, but not a core minimum expectation because of that fact. Now, the guidance also touches on the need for banks and credit unions to invest more heavily in device identification as well as log analysis. These are technologies and solutions that work in tandem to match login credentials with devices.
Can you tell us how these technologies help? Well, it definitely helps to be able to identify if the device that is logging in is a trusted device or if it's a known bad actor device. And being able to put that capability in place is a good practice. Again, the FFIC makes that, distinguishes that as a layer to be considered and not a core minimum requirement.
And the reason again is a lot of the malware that's out there effectively defeats some of the device identification solutions. So, you know, if the financial institution really starts with that core anomaly detection and then adds layers like device identification or any malware techniques, it all creates, can combine to create a very comprehensive solution. Now, I'd like to go back to the discussion that you and I had in February when we talked about socially engineered schemes perpetrated by phishing or vishing and how those schemes have elevated the number of corporate account takeover cases over the last two years. How are institutions addressing those socially engineered schemes, Terry?
And in line with the new FFIC guidance, what more should they be doing in that arena? Well, you know, it keeps coming back to the sort of same topic, social engineering schemes and all the phishing and phishing that's going on, it's another way to compromise the credentials and gain access to the account. So, it's in the same category as malware, it's another way that the criminals penetrate the accounts and they do it very effectively. So, if the bank or credit union assumes that the endpoint is compromised whether it's because of malware or a social engineering scheme and they're continually monitoring every session for suspicious behavior, they can detect the account takeover and fraud before the money leaves the banks, whether the threat comes from social engineering from phishing from malware or any of the other multiplees of threats.
So, you know, again, it's an important layer for institutions to be thinking about in the context of doing this continual transaction monitoring and the anomaly detection. And overall, Terry, when you take a look at the guidance, what next steps do you advise institutions to take to ensure that they comply with the changes that they have to have in place by January 2012? Well, it begins with risk assessment. We recommend that institutions really educate themselves on the complete set of threats and risks they're offering today and for the new financial products or expedited service levels that they're considering in the future.
And they should be sure to understand the entire scope of threats, facing both their retail and commercial online banking customers. And I also encourage institutions to think through the total impact of fraud, not just the dollars lost, but the impact on productivity, the impact on brand reputation, and all the potential impacts that are fraud it can have to be pretty substantial. From a technology standpoint, the minimum requirements on page five of the FFI AC guidance are very clear and institutions should just start there. They should deploy the technology associated with the minimum requirements and then create a plan for additional layers on the level of risk there's an organization.
So we recommend that they move quickly to address the minimum requirements. The technology is available. It's straightforward, it's easy to deploy. And institutions can very quickly check off these minimum requirements without spending a lot of time or money or resources.
And they have so many other issues on their place to deal with with Durban and Dodd-Frank and all these other things that are being thrown at them. They can address these FFI AC core minimum requirements very quickly and very easily with existing technologies in the market today. And in closing, Terri, and you've kind of done this, so this could just be a bit of a recap, but if you had to offer three priorities for banks and credit unions when it comes to compliance, what would those priorities be? Well, yeah, I think I have to meet the minimum requirements for anomaly detection, transaction monitoring, and administrative controls, have a plan and a process for risk assessments and rethink the customer communication strategy to increase the transparency between them and their customers.
And I think, you know, if they do that, they're really meeting me at the FFI AC guidance and they're doing a much better job of really protecting themselves and their customers. Terri, I want to thank you again for your time today. Thank you, Tracy. Again, we've just heard from Terri Austin of Guardian Analytics.
For Information Security Media Group, I'm Tracy Kitten. This podcast has been brought to you by bankinfosecurity.com. For more interviews, breaking news, research, and educational webinars, please visit www.bankinfosecurity.com.