This increase in attacks may impact more than one-quarter of executives in the year ahead, as those polled report that their organisations experienced at least one (15.1%) or multiple (10.8%) deepfake financial fraud incidents during 2023.

Deepfake financial frauds have become a new threat now, as the pattern in these incidents are leveraging deepfake technology (images, videos, or audio which are edited or generated using AI tools, and may depict real or non-existent people) with the intent of defrauding organisations/individuals of cash assets or otherwise causing financial losses.

As per the United States-based business advisory firm HUB International, in one instance, fraudsters used AI to create fake virtual images of finance leaders during a video conference call, leading an employee to transfer USD 25 million to the scammers.

In 2023, funds transfer fraud (FTF) and business email compromise (BEC) accounted for 56% of all cyber claims, with FTF increasing by 15% and claim severity rising by 24% from 2022. The average loss per claim was USD 275,000, with total reported losses reaching USD 2.9 billion.

Deepfake scams are quickly leaving devastating impacts on individuals, as most of the surveys indicate that the victims are not able to distinguish a real person from a deepfake one. Scams are causing significant financial losses, fines for releasing sensitive information, and potential damage to a company’s brand and reputation.

In response to the growing threat, organisations are being urged to evaluate their exposures and develop risk management plans. However, there is some good news, as a new start-up has emerged to combat the scourge of deepfakes and spoofed evidence. ForceField is building a set of “patent-pending” APIs dubbed MARQ, the first of which is designed to authenticate content.

In this episode of the “Start-up of the Week,” International Finance will talk in detail about the venture.

A Timely Emergence

A 2022 report from Europol predicted that 90% of all online content will be AI-generated by 2026. The internet is getting flooded with manipulated content (either machine-generated or made with the help of AI), forcing big tech companies to develop new tools to address the problem. Google in September 2024 announced flagging AI-generated images in its search engine, following in the footsteps of Meta, which was already doing so on Facebook and Instagram. YouTube, on the other hand, now enables people to request the removal of content that simulates their face/voice.

Along with the big tech, start-ups like Clarity, Reality Defender, and Truepic have entered the battlefield, and have raised sizeable sums from big-name backers in recent years.

“ForceField, for its part, is focusing on the device level rather than the content-this means any data stream, on any device, where the start-up’s technology is present. This could be a mobile app with ForceField’s API integrated, or a surveillance camera’s video-management system or drone’s hardware-it can sign and hash for verification in real-time,” TechCrunch reported recently.

Since data and reporting are the key elements in regulated industries, ForceField sees its applications helping businesses to remain compliant (with data security norms), apart from defending against online deception and fraud.

“That’s not the only place our technology is needed, as demonstrated in our founding story; digital evidence can easily be manipulated and accused of forgery, even when it didn’t happen if there are no guardrails in place. Our courts are not yet prepared for the influx of deepfaked evidence and people have even started using the deepfake defense,” the start-up stated.

ForceField sees threats of fraud, data breaches, and deepfakes increasing tenfold in arenas like insurance, infrastructure, mission-critical areas, and defense/Homeland security. To answer this, the start-up has developed its MARQ Technology, a well-researched set of solutions in today’s digital landscape, that takes the human out of the loop to protect chain-of-custody.

The start-up is creating solutions to enhance online security by “solving first-mile problems, notoriously hard and complex, in nascent solution categories.”

“In cyber, we are a proactive technology that protects your data and ensures submissions or content has traceable provenance, and avoids fraud, loss, data breaches, deepfake scams, and insider threats,” ForceField commented.

Meet The Technology

ForceField’s flagship product, called HashMarq (also awaiting its patent), verifies content submissions and labels it as authentic. Instead of using methods of adversarial AI (fighting AI with AI) or watermarking, Forcefield’s technology establishes a “chain of custody” to establish provenance by identifying whether a specific piece of content has been altered. HashMarq generally looks at metadata from data streams and connected devices.

Explaining this further, ForceField founder and CEO MC Spano told TechCrunch, “We’re leveraging blockchain, we’re not using coins or crypto — we’re not a web3 company. We’re using blockchain most innately and purposefully, which is smart contracting. We authenticate anything collected, like a video, photo, an audio file, a screenshot on a mobile device — but we also secure and authenticate any multimedia collected on any IoT, which means anything from a BlackBerry to a robot. But any streaming data as it’s collected, we’re signing it, we’re hashing it, and then we’re using ledger technology.”

The “smart contracts,” as mentioned by Spano, live on the blockchain to ensure their security, transparency, and immutability. Enterprise customers, including anyone from chief information officers to trust and safety teams, can access the technology through an API or SDK which they integrate into their own applications. In simple terms, HashMarq serves as a digital certificate for content that has passed its proof checks.

MARQ is a patent-pending set of APIs that accomplish two important tasks in the cyber trust and safety space: Authenticating content based on the start-up’s proprietary algorithm and protecting content in real-time against breaches or succumbing to cyber vulnerabilities.

MARQ has established its chain of custody and protecting provenance. Its blackbox is a protected space where metadata from IoT (Internet of Things) and data streams are protected and stored in real-time, off cloud and inexpensively. Depending on which IoT MARQ’s APIs are plugged into, ForceField’s tech can help accelerate investigations. While cloud and related platforms are not immune from cyber vulnerabilities, MARQ has been specially built to protect these data streams in real-time.

So how does ForceField’s technology assess the veracity of a given asset?

“We’re looking at about 90 proof points, but I can’t share all of them. The notion is that we’re looking at the geospatial intelligence around that device, what was around at the time, what signals, what other devices, and the time. What time was this device, specifically, collecting this video? And how long was it from the collection to the submission? Those points alone can tell journalists or news organisations or law enforcement so much more than what they would originally have, and it also can pinpoint a geographic location,” Spano said.

Though ForceField was established in 2021, Spano got her innovation idea in 2018 when she was reportedly assaulted in New York City, and subsequently faced major obstacles both in gathering and submitting the evidence required by law enforcement.

“I knew that there were cameras, I knew that the evidence was able to be gathered. But when I dealt with the NYPD to get the evidence, they wouldn’t get a subpoena — so I had to go to the owner of the camera myself to request the footage. I recorded it with my phone, and when I turned that recording into the NYPD, they said it wasn’t admissible. And that’s when I realised the justice system starts way earlier than in the courts,” she remarked.

Spano and ForceField have now put up a battle against the dark side of generative AI, where anyone with a laptop can create “plausible, but entirely fake, evidence.”

The “Erie” Experiment

As of October 2024, ForceField is developing a proof-of-concept (PoC) with insurance giant Erie. The start-up has also signed letters of intent with three additional customers, with plans to finalise the PoC and launch it commercially in the first half of 2025.

ForceField, as of now, is eyeing to protect the insurance market from the bad side of AI, Spano believes that with the advent of AI and the ability for even a layperson to create authentic-looking assets, no industry is immune from the phenomenon.

“A citizen journalist, for example, who has captured a video on their mobile device, could submit it to a news station, which would integrate with ForceField’s API to determine the authenticity of the source data. Law enforcement, too, could use the technology to verify witness or victim submissions,” she commented.

The start-up has so far been funded via a mixture of bootstrapping (with Spano selling her previous company) and capital provided by angels, including actor Debra Messing, Wilfredo Fernandez, X’s head of government affairs and a scout at VC firm Lightspeed. In 2023, ForceField received money through its participation in “Techstars Global Start-up Network.” The venture has recently taken its first institutional funding via a strategic investment from its customer, Erie Insurance.

The post Start-up of the Week: ForceField’s API-dubbed solution emerges as handy weapon against deepfakes appeared first on International Finance.

To better determine how cybercriminals are hiding behind invisibility cloaks to remain undetected, Carbon Black conducted a survey, comprising input from chief information security officers (CISOs) at 40 major financial institutions. The purpose of the survey is to improve telemetry for threat hunting teams and defenders.

Key Findings:

Cybercriminals are continuing to hide in plain sight and move laterally leveraging nonmalware attack methods. PowerShell (89%), Windows Management Instrumentation – WMI (59%) and Secure File Transfer Protocol – SSH (28%) were the top three “good tools” attackers leveraged nefariously to target financial institutions, according to our survey.

These “non-malware” (or fileless) attacks now account for more than 50% of successful breaches. With non-malware attacks, attackers use existing software, allowed applications and authorized protocols to carry out malicious activities. Non-malware attacks are capable of gaining control of computers without downloading any malicious files, hence the name. Non-malware attacks are also referred to as fileless, memory-based or “living-off-the-land” attacks.

There is a common theme why cybercriminals are increasingly leveraging non-malware attacks: they are following the path of least resistance. Financial institutions are not immune. The silver lining here is that awareness of malicious usage for tools such as PowerShell has never been higher. The fact that 90% of CISOs reported seeing an attempted attack leveraging PowerShell is a good thing. Not seeing such attempted attacks means the attacker has remained hidden.

90% of financial institutions reported being targeted by a ransomware attack during the past year

CryptoLocker. GoldenEye. Locky. WannaCry. 2017 was, perhaps, the most notorious year on record for ransomware. Even a casual news consumer can identify the menacing ransomware attacks that have cost worldwide businesses as much as $1 billion in 2017, according to FBI data. Financial institutions are clearly not immune. The overwhelming majority of CISOs in our survey reported seeing some kind of attempted ransomware attack during the past year. This is not surprising. Last year, Carbon Black researchers monitored 21 of the largest dark web marketplaces for new, virtual offerings related to ransomware. Our research found a 2,502% increase in the sale of ransomware on the dark web. This increase is largely due to a simple economic principle – supply and demand. Cybercriminals are increasingly seeing opportunities to enter the market and looking to make a quick buck via one of the many ransomware offerings available via illicit economies. In addition, a basic appeal of ransomware is simple: it’s turnkey. Unlike many other forms of cyberattacks, ransomware can be quickly and brainlessly deployed with a high probability of profit. In our previous report, we found more than 6,300 estimated dark web marketplaces selling ransomware, with more than 45,000 current listings.

Only 37% of financial organizations have established threat hunting teams

Active threat hunting is an important step for organizations with mature security programs. It puts defenders “on the offensive” rather than simply reacting to the deluge of daily alerts. Threat hunting aims to find abnormal activity on servers and endpoints that may be signs of compromise, intrusion or exfiltration of data. Though the concept of threat hunting isn’t new, for many organizations the very idea of threat hunting is. The common mindset regarding intrusions is to simply wait until you know they’re there. Typically, though, this approach means that an organization will be waiting an average of 220 days between the intrusion and the first time they hear about it. And even then, it’s typically an external party such as law enforcement or a credit card company that’s telling you. With threat hunting, defenders are deployed to go out and “find the bad” versus waiting for technology to alert you. Successful threat hunting teams proactively chase down signs that intruders are present or were present in the recent past. They look for anomalies – things that don’t usually happen

1 in 4 financial institution CISOs reported experiencing counter incident response

This figure is concerning. It means cybercriminals are increasingly reacting and adapting to defenders’ response efforts. Cybercriminals realize there are humans on the other end actively countering their techniques. They realize that teams are, in some cases, instrumented to detect and respond to their activities. They also realize that teams have specific IR playbooks for these types of scenarios. Attackers are able to go off their scripts while defenders are sticking to manual and automated playbooks. These playbooks are generally based off simple indicators of compromise (IoCs). As a result, security teams are often left thinking they have disrupted the attacker, but with counter incident response, attackers maintain the upper hand. This problem is compounded with secondary command and control (C2) present in several victims (1 in 10, according to our survey). We forecast this will become a more prevalent tactical shift in the coming months. As SOC and IR teams begin to react, attackers are doing a number of things to counter the defenders such as changing code to evade new technology, targeting security analysts and engineers in separate but coordinated attacks, deleting logs from endpoints to hide nefarious behavior and executing DDoS attacks on applications and systems critical for defenders and/or the business.

Cyber defense is evolving into a high-stakes game of digital chess where opponents are responding to every move made on the board. Teams should be prepared to throw out the IR playbook when necessary.

Nearly half (44%) of financial institution CISOs said they are concerned with the security posture of their Technology Service Providers (TSPs)

These TSPs are regularly targeted by cybercriminals. As evidenced by the FDIC’s own inspector general: “The FDIC’s oversight process used for identifying, monitoring, and prioritizing TSPs for examination coverage needs improvement.” Island hopping via information supply chains is growing. Our recommendation is for threat hunt teams and defenders to closely assess TSP security posture. Given that 63% of financial institutions have yet to establish threat hunting teams, there should be concern regarding limited visibility into exposure created by TSPs. Cyberspace is fluid and exposure may become systemic.

Russia (59%), China (23%) and North Korea (16%) are the most concerning nation-state actors associated with cyberattacks, according to financial institution CISOs in our survey

Geopolitical tension serves as a harbinger for cyberattacks. There’s perhaps no surprise with the results to this question with Russia leading the way, given the country’s continued efforts to attack and influence the West, including the United States’ 2016 presidential election.

The “Silicon Valley of the Dark Web” lies in St. Petersburg, Russia. Russian cybercriminals have demonstrated advanced sophistication among hacking groups. Russia’s motivation for targeting financial institutions appears to go beyond financial gain or countering economic sanctions. Since 2014, many of the best cybercriminals have acted patriotically on accession to support Russia’s strategic goals. Corporate espionage, sensitive data, trade secrets and personal information for executives, partners and customers all seem to be in play when it comes to Russia’s cyberattack efforts.

Recommendations:

Given these trends, modernizing defense in depth is imperative to preserve a high-functioning cybersecurity posture. The technological dependency of financial institutions to internet-based platforms has dramatically increased the industry’s exposure to reputation, market and operational risks. The major gaps for many of these institutions revolve around visibility and time to detection. This is particularly troubling as it pertains to deterring an attacker’s ability to move laterally within an enterprise post breach.

Financial institutions should aim to improve situational awareness and visibility into the more advanced attacker movements post breach. This must be accompanied with a tactical paradigm shift from prevention to detection. The increasing attack surface, coupled with the utilization of advanced tactics, has allowed attackers to become invisible. Decreasing dwell time is the true return on investment for any cybersecurity program.

The post Cyberattacks in finance, and how to tackle them appeared first on International Finance.

How did it come to this – especially since less than two decades back, most popular references of artificial intelligence were in sci-fi movies? Will AI revolutionise the world of financial services? And more specifically, what does it bring to the party with regards to fraud detection? Let’s separate fact from fiction and explore what lies beyond the inflated expectations.

Why now?

Many practical ideas involving AI have been developed since the late 90s and early 00s but we’re only now seeing a surge in implementation of AI-driven use-cases. There are two main drivers behind this: new data assets and increased computational power. As the industry embraced big data, the breadth and depth of data within financial institutions has grown exponentially, powered by low-cost and distributed systems such as Hadoop. Computing power is also heavily commoditised, evidenced by modern smartphones now as powerful as many legacy business servers. The time for AI has started, but it will certainly require a journey for organisations to reach operational maturity rather than being a binary switch.

Don’t run before you can walk

The Gartner Hype Cycle for Emerging Technologies infers that there is a disconnect between the reality today and the vision for AI, an observation shared by many industry analysts. The research suggests that machine learning and deep learning could take between two-to-five years to meet market expectations, while artificial general intelligence (commonly referred to as strong AI, i.e. automation that could successfully perform any intellectual task in the same capacity as a human) could take up to 10 years for mainstream adoption.

Other publications predict that the pace could be much faster. The IDC FutureScape report suggests that “cognitive computing, artificial intelligence and machine learning will become the fastest growing segments of software development by the end of 2018; by 2021, 90% of organizations will be incorporating cognitive/AI and machine learning into new enterprise apps.” 

AI adoption may still be in its infancy, but new implementations have gained significant momentum and early results show huge promise. For most financial organisations faced with rising fraud losses and the prohibitive costs linked to investigations, AI is increasingly positioned as a key technology to help automate instant fraud decisions, maximise the detection performance as well as streamlining alert volumes in the near future.

Data is the rocket fuel

Whilst AI certainly has the potential to add significant value in the detection of fraud, deploying a successful model is no simple feat. For every successful AI model, there are many more failed attempts than many would care to admit, and the root cause is often data. Data is the fuel for an operational risk engine: Poor input will lead to sub-optimal results, no matter how good the detection algorithms are. This means more noise in the fraud alerts with false positives as well as undetected cases.

On top of generic data concerns, there are additional, often overlooked factors which directly impact the effectiveness of data used for fraud management:

• Geographical variances in data.
• Varying risk appetites across products and channels.
• Accuracy of fraud classification (i.e. which proportion of the alerts marked as fraud are effectively confirmed ones).
• Relatively rare occurance of fraud compared to the huge bulk of transactions; having a suitable sample to train a model isn’t always guaranteed.

Ensuring that data meets minimum benchmarks is therefore critical, especially with ongoing digitalisation programmes which will subject banks to an avalanche of new data assets. These can certainly help augment fraud detection capabilities but need to be balanced with increased data protection and privacy regulations.

A hybrid ecosystem for fraud detection

Techniques available under the banner of artificial intelligence such as machine learning, deep learning, etc. are powerful assets but all seasoned counter-fraud professionals know the adage: Don’t put all your eggs in one basket.

Relying solely on predictive analytics to guard against fraud would be a naïve decision. In the context of the PSD2 (payment services directive) regulation in EU member states, a new payment channel is being introduced along with new payments actors and services, which will in turn drive new customer behaviour. Without historical data, predictive techniques such as AI will be starved of a valid training sample and therefore be rendered ineffective in the short term. Instead, the new risk factors can be mitigated through business scenarios and anomaly detection using peer group analysis, as part of a hybrid detection approach.

Yet another challenge is the ability to digest the output of some AI models into meaningful outcomes. Techniques such as neural networks or deep learning offer great accuracy and statistical fit but can also be opaque, delivering limited insight for interpretability and tuning. A “computer says no” response with no alternative workflows or complementary investigation tools creates friction in the transactional journey in cases of false positives, and may lead to customer attrition and reputational damage – a costly outcome in a digital era where customers can easily switch banks from the comfort of their homes.

Holistic view

For effective detection and deterrence, fraud strategists must gain a holistic view over their threat landscape. To achieve this, financial organisations should adopt multi-layered defences – but to ensure success, they need to aim for balance in their strategy. Balance between robust counter-fraud measures and positive customer experience. Balance between rigid internal controls and customer-centricity. And balance between curbing fraud losses and meeting revenue targets. Analytics is the fulcrum that can provide this necessary balance.

AI is a huge cog in the fraud operations machinery but one must not lose sight of the bigger picture. Real value lies in translating ‘artificial intelligence’ into ‘actionable intelligence’. In doing so, remember that your organisation does not need an AI strategy; instead let AI help drive your business strategy.

About Sundeep Tengur:

Sundeep Tengur is a banking fraud and financial crime specialist within the Global Fraud and Security Intelligence Practice at SAS. He provides guidance on industry best practice, educating prospective clients on various fraud modus operandi and designing end to end solutions to mitigate fraud risks. He is a Certified Financial Crime Specialist (CFCS), with many years of experience in mitigating fraud in retail banking and financial services.

The post AI for fraud detection: beyond the hype appeared first on International Finance.