Independent Banker - May 2023 - 27

Next: SBA 7(a) pools 
Robert Johnston, CEO and cofounder
of Washington D.C.-based Adlumin,
a cloud-native security operations
platform provider that also offers
managed detection and response
services. This manifests in the forms
of password theft, identity theft and
social engineering.
" To minimize these threats,
community banks need to ensure
identity verification is implemented
at every aspect of their information
technology infrastructure, especially
business email compromise, where
an attacker is able to hijack an email
account and use that email account
to commit fraud, " Johnston says.
Establish a plan for fighting
business payments fraud
Exacerbating the problem is
the growing use of advanced
technology to implement these
scams, particularly those powered
by artificial intelligence, which
enables fraudsters to appear " more
convincing than ever, " says Steven
Estep, ICBA's assistant vice president
of operational risk.
" One example is deep fake audio
technology, which enables fraudsters
to mimic the voice of executives or
other public figures, " Estep says.
" With the newer chat AIs coming
online, I would suspect that the
Fraud can start on social media
When trying to minimize opportunities for business payments
fraud, community banks should educate both their employees
and commercial customers to think very carefully about what
they post on social media, says Steven Estep, ICBA's assistant vice
president of operational risk.
" Education for both consumers and employees is key to
catching and stopping fraud, " he says.
Estep recommends these best practices to minimize threats:
 Only post about travel, including conferences you're attending,
after you have returned.
 Be sure you really know the person you are connecting with on
LinkedIn or other social media.
 Verify any request for funds or change in payment method via a
trusted and confirmed communications channel.
emails fraudsters use will be harder
than ever to detect. "
Quarles recommends that banks
QUICK STAT
$2.4
billion
The amount of global cyber
losses in 2021
Source: FBI
have documented procedures for
requesting and executing fund
transfers. They should be wary of
urgent requests to act quickly or
changes to established payment
instructions and procedures.
If business payments fraud is
suspected, banks should already have
an incident response plan in place,
he says. The playbook should include
having a contact at the bank with the
authority to recall a wire transfer;
procedures for reporting and taking
down fraudulent email domains;
contacting the bank associated with
the threat actor's account to report
the fraud; and reporting the incident
to the FBI.
Banks should also maintain
adequate cyber liability insurance
that covers BEC, Quarles says.
" Sophisticated technology on
behalf of scammers often isn't the
culprit when it comes to stealing
data. Employees can be the weakest
link if they are too trusting, "
Olejnik notes, adding that an
uninformed employee can be more
easily manipulated. " Therefore,
make sure you have trained your
employees thoroughly to prepare for
cybersecurity threats. "
In addition, it's important for
community banks to educate
their commercial customers
about business payments fraud,
encouraging them to protect
themselves through training and
controls, Olejnik says. Banks should
also encourage their customers to
use advanced cash management
services offered by the bank,
including positive pay, and enabling
advanced security controls like
multifactor authentication and
payment notifications.
" Community banks can
differentiate themselves by taking
a leadership role with their clients
and in their communities to heighten
awareness of good cybersecurity
practices, " he says.
Katie Kuehner-Hebert is a writer
in California.
independentbanker.org // 27
http://www.independentbanker.org
Independent Banker - May 2023

Table of Contents for the Digital Edition of Independent Banker - May 2023
