Why banks are concerned about cybercrime increase

 Commercial banks have identified cybercrime as a major threat to innovation and launch of new products across the financial sector. A Central Bank of Kenya (CBK) survey found 92 per cent of lenders interviewed said cyber security is among the top three risks they face in their bid to come up with new products.

“Cyber risk turned out to be the key risk for institutions in their innovation endeavours, similar to the findings of the survey for 2020,” it said. Ninety-two per cent of banks and 86 per cent of microfinance banks (MFBs) identified it as one of the top three innovation-related risks,” the survey added.

Cyber risks in banks target data privacy and threaten data security  for the bank customers and the safety of their funds.

Germany’s financial regulator BaFin warned Tuesday of the “very big” risk of cyberattacks targetting the financial sector, a threat it said had become “more likely” since Russia’s war on Ukraine.

“The risk that companies in the financial sector will fall victim to cyberattacks or that internal IT security incidents will occur is very big and very present,” BaFin president Mark Branson told a press conference. In extreme cases, “such incidents could damage the stability of the financial system”, he said. “Are we prepared for a really serious security incident? If we are honest, we don’t know,” Branson added.

Hacking attempts

Ukraine and its Western allies have been on heightened alert for potential Russian hacking attempts since Moscow invaded its neighbour on February 24.

The “Five Eyes” intelligence sharing network -- consisting of the United States, Britain, Canada, Australia and New Zealand -- warned in April that “evolving intelligence” indicated Russia was planning massive cyberattacks against rivals supporting Ukraine. 

The war in Ukraine “has made cyberattacks on the German financial sector more likely,” Branson told reporters in Frankfurt. The Bafin watchdog is monitoring the situation closely, he said, in cooperation with Germany’s National Cyber Defence Centre. Bafin was also keeping financial firms updated on potential attack patterns, he said.

Last month’s “Five Eyes” alert said Russian state-sponsored cyber actors have the ability to compromise IT networks, to steal large amounts of data from them while remaining hidden, to deploy destructive malware and to lock down networks with “distributed denial of service” attacks. Locally, Kenyan banks continue to lose billions of shillings to cybercrime every year, meaning that new digital projects are a potential avenue for exploitation by hackers.

KCB Group reported that it managed to stop a Sh2 billion attempted fraud on its banking system last year, underscoring the increase in online attacks during the Covid-19 pandemic. The bank made public the attempted fraud without giving details on whether the attack was from foreign hackers or local techies. Kenya loses an estimated $295 million (Sh34.17 billion) to cybercriminals annually, but there is a surge every year, experts say with a recent survey by Ponemon Institute showing 56 per cent of organisations have had a breach that was caused by one of their suppliers.

Sensitive information

The survey also indicated that the average number of third parties with access to sensitive information at each organisation has increased from 378 to 471 which makes it easier to even target those in the supply chain to attack lenders.

Cyber attacks in Kenya recorded a significant increase in the banking and financial sector in the second quarter of 2021 compared to the first quarter of 2021, at 60 per cent. 

However, banks have established innovation teams and framework that guides the decision-making process of innovating a product and a committee that reviews innovative product proposals before seeking board approval.

Some lenders like Equity Bank have even started a hacking competition dubbed Equity Hackathon which combines data, technology, creativity, and talent to shape solutions. This year the lender targetted students from The University of Nairobi and Meru University of Science and Technology.