Hi, this is Tom Field, senior vice president of editorial with information security media group. I'm talking today about the new faces of fraud survey, how are technical controls evolving to detect and prevent fraud. And it's my privilege to be speaking with Mike Lopez, he's vice president of security and fraud with six-dara technologies. Mike to start out with, what's your gut response to our survey results, in particular, what's surprised you?
So Tom, to be honest with you, what surprised me the most is the fact that financial institutions look like they're taking a strategy that's going to focus a little bit more on customer education than emerging technologies. You know, historically, customers have always been the weakest link in the security chain. So why they would continue to invest in that strategy as opposed to emerging technologies and it was kind of odd, you know, 90% of end users today still typically can't identify a fake email or website, which is why 91% of attacks typically originate via a phishing campaign. The financial institutions should offset the weakest link by investing in these emerging technologies, such as things like machine learning or even artificial intelligence.
We have helped hundreds of financial institutions to leverage these technologies. And when they have found we've seen better detection, improved analysis of the data and ultimately better mitigation. It's clear that the top forms of fraud really haven't changed much over the past five years, except for the emergence of phishing. How does this jive with what you see in the field?
So if we put attacks in the broad categories like malware and phishing, yes, it's true that there hasn't been much change. However, what we're seeing Tom is that the attack factors have evolved. I mean, ultimately what is phishing? It's simply, you know, malicious attempts by a fraud to obtain that information, right?
So what we're seeing is that it's not just a website anymore, you know, the attackers have evolved under leveraging other outlets such as social media, road mobile apps, and we're even seeing attacks that are originating via chatbots as it relates to that jives with what we're seeing. So the emerging of phishing doesn't surprise us as much. Entities do need to evolve in their phishing protection to combat or offset these attacks. Obviously, continuing to monitor for fraudulent URLs is a very key component to a solid fraud strategy.
But they need to start considering these other outlets such as social media and these road mobile app stores. What do you see as the top vulnerabilities and institutions fraud defenses? So Tom, what we're seeing are a couple of things. So first of all, attacks are evolving at an extremely high rate of speed.
Cyber criminals are constantly changing the tactics, looking for new angles, looking for other vectors by which they can penetrate your countermeasures. They know banks can't deploy these countermeasures, so they're simply adjusting to offset them. The biggest problem that we're seeing is that banks are still relying heavily on manual processes, which can obviously hinder their ability to pivot quickly and offset or counter the rate of speed at which cyber criminals are launching their attacks. You can't assume that what was done yesterday will work for today.
The other part that we think is critical here is the entities need to continue to automate. As I said, leveraging manual processes is going to put banks at a disadvantage, so they need to consider leveraging things like artificial intelligence and machine learning. If they can't do it, then we strongly suggest that they partner with a strong partner who can facilitate or help them implement these technologies, and ultimately that will help them be able to counter or respond to these attacks with the same rate of speed at which the frauds and attackers are launching them. Mike, we hear a lot about data analytics and biometric authentication, but our respondents don't seem to be enthusiastically embracing them.
What's your take on that? So my take on that is a new technology, right? So people always fear what's new. It creates an intimidation factor, and historically, the security industry does not like to embrace change at its early emergence.
But we are seeing that there are significant benefits to these types of technologies. You have better and more accurate threat intelligence. You're able to provide protection that is transparent and tated to the end user, and ultimately by leveraging things like biometrics and big data analytics, you can help eliminate the use of passwords which, as you stated, are often compromised. Analytical biometrics provide that healthy balance between security and that reduction in end user friction, and we must embrace the digital transformation, the reality is that's the way the industry is going.
So we have to leverage technologies that are able to allow us to secure those digital channels. What we're also seeing, Tom, is that once the customer does get a taste for the impact that these technologies can have, they really embrace it and become very enthusiastic about leveraging them. About one third of our respondents have seen no significant increase in fraud by the mobile channel. What mobility trends do you see?
So we're seeing a lot in the mobile channel. What we're seeing is that a lot of the time is around device attributes. So what we're seeing is a lot of end users these days embracing that digital transformation are using jailbroken or rooted devices. They're installing unauthorized apps.
And as we all know, a lot of us connect to Wi-Fi that are unsecure open. Leveraging these kinds of attributes will expose yourself to a wide variety of of attacks. Institutions need to have its ability into the device attributes so that they can understand how their customers are connecting to their platforms or how they're initiating sessions to their platforms. The problem that we see, Tom, is that a lot of financial institutions are unable to connect with dots.
And I'll give you an example. If you've got a situation where the PC that the end user is connecting to is compromised, but they're also on a device that is compromised as well, when there is a transaction or a session that is hijacked and a step-up authentication is done via SMS and that SMS is hijacked, a lot of times the banks won't be able to attribute the attack to the PC and the mobile device. And so they simply associate it with that one channel, which is the PC because they simply do not have that visibility into the mobile device to correlate the cross-channel broad. Coming back to phishing, what forms do you see most successful given the amount of credentials that have been compromised as well as the sophistication of the social engineers?
So, Tom, I would say that the most successful attacks that we're seeing are the micro-targeting attacks of the VIP accounts. The reason is that there's a high yield and obviously a high return on investment for the fraudsters when they're targeting these VIPs. Associated with that, we're seeing kind of two variants of those types of micro-targeting attacks. The first one, which was very prominent in 2017 and 2018, is an email compromised with the BEC.
The other one is social media focused attacks. A lot of the financial institutions that responded to the survey said that 20% of them were victims of BEC and 50% of them said that those attacks resolved in a financial loss. As far as the social media, attackers are leveraging methodologies, technologies that are leveraged for legitimate purposes, but to initiate targeted attacks focused at obtaining information from these VIPs so that they can then leverage that information in other ways. So, institutions need to adjust their protection strategy.
They can't just focus anymore on the phishing components. They need to look at implementing email authentication for those groups of messages that are coming into their VIPs. You need to be monitoring the social media channels. It's extremely important, which means a lot of impersonations and things of that nature that can facilitate these types of attacks.
And finally, whenever possible, they should be leveraging on multi-factor authentication framework. Mike, it appears that institutions clearly have made strong investments in traditional anti-fraud controls. Do you see a disconnect between those investments and the prevalent forms of fraud that they actually are facing? We discussed attacks are evolving and are adapting very quickly.
So, traditional tools typically can't keep up. Financial institutions need to embrace artificial intelligence, machine learning, and the big data analytics. I'm encouraged that some of the top investments that banks are focused on in this new year are around these technologies. It proves that we are in a transition period and banks are seeing the need to move forward with these technologies.
However, many won't be able to do this on their own. Some of these technologies are not something that some of the smaller or medium-sized financial institutions will be able to leverage on their own. So, we encourage that they partner with somebody who can help them facilitate and move forward to those types of technologies, and ultimately, this needs a better detection and earlier mitigation, which hopefully will deter future attacks. It would seem that institutions are to decide a disadvantage to their attackers, because one, the investments they've made in legacy controls, two, their siloed organizations, and three, a desire to not inconvenience their customers.
Do you see these as potentially fatal flaws in institutions fraud defenses? So, they don't necessarily have to be, right? So, legacy systems still have a purpose and are useful. However, they're usually missing a few crucial pieces of technology that when properly integrated can significantly improve the tool's capabilities.
Making new technologies to implement systems allows for improved detection and ultimately attack mitigation. As for customer friction, it's true. The customers typically aren't keeping security at top of mind, but you don't always have to implement technologies that generate that kind of friction. A leveraging thing like machine learning on your transaction anomaly detection platforms or simply implementing a solid anti-tension solution or social media monitoring platform, you're generating or leveraging tools that do not generate friction for the customers.
As far as legal time, you know, that's a big problem. Institutions need to have visibility not only across their organization but across tools. So, it's extremely important that not only do they leverage communication between the organizations but that they're properly integrating their tools among their organizations so that they can have visibility not only across multiple channels but across the entire fund lifecycle. Based on our results and what ways are you encouraged by institutions' expected budgets and their investments for 2019?
So, this is an interesting one for me because I was a banker for 15 years and I know how difficult they did and what are hurtles some of these individuals have to go through to get budgeting. So, I'm excited that there's actually bias. So, this at least security, you know, security division has been seen as a cost center and really it should be viewed as a loss prevention center. It seems that that is starting to resonate not only with the banks but with their leadership.
It's clear that digital transformation is occurring and it's stilling digital trust is going to be key to making sure that these financial institutions aren't losing the faith of their customers. So, company our survey, what trends do you see from fraudsters in their schemes as we enter 2019? So, there's quite a few, obviously, but I think the most interesting thing for me is the webinizing of coordination intelligence and the level of certification that some of these attacks are taking. You know, I think we're going to be seeing interesting situations in 2019 where, you know, the fraudsters are going to be leveraging artificial intelligence to improve the way that they attack and then offsetting the way that our countermeasures are able to detect those things.
The other thing that we're seeing is the level of sophistication around social media. We talked earlier, you know, the attackers are leveraging a lot of methodologies or technologies that are used by our marketing department today to target or focus them graphically, you know, who they're targeting to leverage that information to target specific VIP users and accounts. So, that to me is interesting. I think the whole world mobile app concept is going to continue to increase.
And then finally, I think we're going to see an increase in injection-based malware. I think, you know, I think the fraudsters are going to look for being able to launch more zero-day attack that will be undetectable by traditional antivirus systems. What new solutions will six-dara be bringing to the market? So, the pillar of our investment strategy in the common new time is going to be around machine learning for one and then increase automation capabilities.
We want to improve our automation abilities to reduce, obviously, the manual work that our customers have to do. The other thing that we're going to be looking at is expanding our risk-based authentication. So, the first step there for us will be bolstering our transaction anomaly detection platform by implementing new rules that are leveraging more machine learning. And the second part is we're going to be incorporating a lot more biometrics and other mobile-centric technology to help kill password data control.
Mike, to sum it all up, bottom line, how should a security leader use our survey results and analysis? The majority of the respondents stated that, you know, their fraud losses were either stable or increasing. And as we talked about this entire, you know, conversation, we're seeing that the attacks that have changed, but the attack factors and the levels of significantly have. Compoundness with the fact that there is a dependency on the manual process and traditional systems and it tells you that institutions need to move forward with additional technologies such as machine learning, analytics, and biometrics as we've been talking about.
So, effectively detect a mitigate fraud, I believe that that's the direction that they should go in. And I think that the survey is highlighting a lot of those components. Well, for a good Mike, thank you so much. Again, we've been talking about the new faces of fraud survey and I've been speaking with Mike Lopez.
His vice president, security, and fraud was six-dara technologies. For information security media group, I'm Tom Viel. Thank you very much.