icg pres cts (letter) - citibank · cyber attack is an attempt by online criminals to access or...

The Cyber Threat Landscape for Financial Institutions David Rose CitiDirect and Digital Security Product Manager EMEA Treasury and Trade Solutions, Citi

Justin Deck Vice President Strategic Intelligence Analysis Group Citi

Cybersecurity: Cyber Threat Landscape & Security Best Practices

The Changing Information Security Threat Landscape The cyber threat landscape continues to evolve as better organized and more sophisticated attackers have emerged.

Past

Non real-time theft of passwords and confidential information

Present

Evolving Threats—An Illustration of the Information Security Challenge

Real time compromises of computers, servers, mobile devices and their associated communication channels

Typically targets of opportunity Highly-targeted victims for their access to the most sensitive information

Very variable -hard to monetize without exposing the malicious actor

Readily monetized in a sophisticated , secure, and anonymous underground economy

Workforce primarily based in same geography as business and on payroll

Complex underground marketplace with sophisticated specialists; overlap of actors and infrastructure

Moderately sophisticated adversaries seeking to exploit well known vulnerabilities

Highly sophisticated supply chain to create or detect vulnerabilities and exploit tools

Custom tools created by knowledgeable individuals to perform a specific attack

Malicious tools are commodity items readily available on the black market; overlap of tool usage among actors

Individual players Opportunistic and casual Driven by desire to ‘prove they can’

Typically still individual players Premeditated and planned actions Driven by desire for financial gain

Organized collectives, criminal enterprises, and nation states Typically coordinated and well funded Driven by the opportunity for geopolitical and financial gain Adversaries increasingly focused on disruption and destruction

Incr

easi

ng

Soph

istic

atio

n

Speed of Attack

Target of Attack

Value of Information

Complexity of Business Model

Sophistication of Techniques

Availability of Tools

6

Cyber Attack is an attempt by online criminals to access or damage a computer network/system often stealing data or money, and using both technical and non-technical methods.

Cyber Attacks—Common Tactics and Impacts on Business

1. Computer Weekly; “Cyber crime is a threat to global economy, says researcher”; February 2015. 2. McAfee; “Net Losses: Estimating the Global Cost of Cybercrime”; June 2014. 3. Ponemon Institute; “2014 Global Report on the Cost of Cyber crime”; October 2014.

Social Engineering Relying on human interaction to trick people into breaking security procedures and sharing useful information for exploit efforts

$445 Billion Estimated global cost of cybercrime as of February 20151

All others $203BN

US $116BN

China $71BN

Japan $0.93BN

Germany $54BN

Average annualized cost of cybercrime to companies in 20143

United States

Germany

Russia

Common Attack Methods Impact on Business

Malware Software tools that enable an unauthorized user to gain control of a computer system and gather sensitive information

Phishing Emails or online posts that masquerade as a trustworthy party in an attempt to trick the target into divulging information or downloading malware

Cyber Masquerading Taking over executive account to conduct cyber espionage or complete financial transaction

Human Effect

Human + Technology

Technology

$242 Billion Combined cost to top four global economies2

$12.7 M

$6.8 M

$1.8 M

7

Presenter

Presentation Notes

Add statistics by attack methods for different regions as talking point --- Beth to provide

Cyber attackers are increasingly targeting financial institutions to steal money and sensitive data. The biggest threat is the combined type of attacks using various tactics.

Cyber Threat Trends Against Financial Institutions and Assets

Trends in Cyber Crime Common Manifestation against Financial Centers

Targeted victims

Sophisticated tools

Persistence and long-term outlook

New players: Organized Crime

Indirect attacks

Caller pretends to be bank’s fraud team or Microsoft Help. Victim reveals sensitive information or even allows screen sharing on their machine leading to exploitation and fraud.

New malware programmers are using sophisticated methods that evade Anti-Virus solutions. Banking malware now features file stealing capabilities.

Advanced tools are added to infected machines to steal valuable intellectual property.

Blackmail and Extortion schemes, Data stealing, and even Drug and Human Smuggling is being aided by cyber crime services.

Attacker targets third-party vendors in order to access sensitive financial center data/systems and steal data/money.

Multi-vector attacks Attacks against financial institutions are delivered in multiple phases, Using Email, Social Media, unsecure Mobile/Personal devices to log into corporate assets.

8

Attackers use a wide variety of tactics, techniques, and procedures to facilitate cyber attacks.

Understanding the Anatomy of a Cyber Attack

Targeting and Compromise

Lateral Movements Persistence Exploration Exfiltration Cover Tracks

Hacker targets financial institution based on the LinkedIn update and then compromises the LinkedIn account via password guessing

Hacker conducts reconnaissance and makes connections with all associates holding an employee’s title linked to that account

By using malware to compromise e-mail accounts, the Hacker ensures that they have a foothold into the victim, even if the LinkedIn compromise is discovered

Attacker conducts lengthy research of the victim network, including decryption of data throughout the compromised networks

Attacker removes data from the victim network (e.g. using of encryption) to make it difficult for stolen data to be identified

Attacker destroys artifacts and evidence of their intrusion

Examples

All cyber actors do not fully complete the full Anatomy of a Cyber Attack, as their objective may be achieved early in the attack process.

9

Case Studies – Fraud Management

Presenter

Presentation Notes

CSIS is an independent function within Citi responsible for investigations of employeee wrongdoing and conduct risk related events

Fraud Attempt – Beneficiary Change The following scenario demonstrates the tactic of the Hacker to fabricate a change of beneficiary to steal money.

Red flags

• Account Payable staff (Mike) notices an email requesting change of bank account details from his supplier (Hacker), and is surprised that the tone is more formal than usual

• Mike replies requiring signature verification call-back

• Supplier replies that he is currently traveling and not available via usual contact number and to work with his trusted colleague Johan

• Two weeks later, Sam (actual supplier) calls noticing a large overdue payment

• Mike remembers the invoice due to its unusual size as he needed management approval and it was received on the same day as the request to change bank details

• Sam says that they did not change their bank account

• Mike escalates for investigation and finds that payment was effected 4 weeks earlier, soon after the holidays

• Soon after Johan calls (in-bound call) to complete the transaction

• Johan becomes anxious, aggressive, and responds that his colleague had previously provided dual authorisation by email and instructed him to contact them.

• Mike quickly takes Johan through the security process given the urgency, and upon his answering of a few questions correctly, confirmed the change of bank details

• Mike explains to Sam that soon after the email request and Johan’s call, an invoice from “ABC Technology” was received and paid to the new bank account held with Lucky bank

• Sam confirms that they have never banked with Lucky Bank, and did not request a bank account change

• Mike realises that he acted on a fraudulent request to change account details

8 Fraud Landscape and Case Studies

Key learnings

The Ways to Reduce Risk of Fraud is to . . .

1. Create your own customer/supplier/payee profiles

2. Independently validate all change requests that you receive

3. Confirm agreements in writing with known contacts

4. Never deal with agreements from unknown requesters

5. Validate only via approved channels and contacts

6. Ensure beneficiary payment processes are robust

7. Always be vigilant to unusual or requests that contain red flags

12

Fraud Attempt – Screen Sharing This is a social engineering illustration where the fraudster impersonates a bank helpdesk staff member, requesting a client to screen share to facilitate fraud.

Red flags

• Joe (2nd authoriser) receives a call from Mr Green (fraudster) asking to speak with Ann (1st authoriser)

• Joe re-directs the call to Ann • Green explains to Ann that

he is calling from XYZ Bank Helpdesk regarding a Java software update for the XYZ-Online banking application

• Ann asks Green to send her an email to confirm he is from XYZ Bank, providing Green her email and phone number

• Green promptly sends an email that “appears” to be from xyz-online.com. Ann overlooks the fact that XYZ Bank staff email addresses normally end in xyz.com

• Green finally announces that the ‘updates’ have completed and requests Ann and Joe not to use XYZ-Online until Jan 5 to avoid disrupting the ‘server migration’

• On Dec 31, Bob noticed that US$800,000 had been debited from their accounts

• Bob and Joe simultaneously try to contact XYZ Bank and Green to understand why there was a debit on the account

• XYZ Bank confirms there had been no scheduled ‘software updates’ and that the circumstances are suspicious

• Green asks Ann to leave the XYZ-Online session open for 10 minutes and re-direct the call to a transaction maker

• Ann redirects Green to Bob, who was then asked to follow the exact same screen sharing process

• Green asks Bob to leave the session open and re-direct his call to Joe, which he did

• Joe was then asked to log in to an active screen sharing session using Ann’s laptop

• Green calls Ann again once the email had been received, asking her to open the XYZ-Online banking application

• Green then provides an alternative internet address which redirects Ann to a legitimate online screen sharing service provider

• Green asks Ann to return to the XYZ-Online login page and sign in using her credentials

• Green then spends 5 minutes with Ann ‘testing’, but does not ask her to authorise a transaction


Key learnings

Do

• Be suspicious of unsolicited phone calls from any individuals you do not know

• Be aware of appropriate privacy settings on social networking sites

Do not…

• Share your challenge response with anyone (Citi will not ask you to share this information)

• Click on any unexpected email links

• Share PC screens with any unauthorised person

14

Fraud Attempt – Impersonation This is a general example of how cyber-attacks may target and compromise a senior executive’s account to conduct fraud.

• Employee updates Social Networking Site account that he will be speaking at an annual international conference in China

• Because of the malware infection, the Hacker compromises the credentials for the associate’s e-mail account and sends directions to the employee’s Account Payable colleague to change vendor bank details and transfer funds

• All associates are infected unknowingly by malware when they click on the link

• Hacker sends a Social Networking Site message to all associates asking them to click on the link to the upcoming conference that the employee is speaking at

• Hacker makes connections with all associates (e.g. key supplier) holding a similar job title linked to that account

• The Social Networking Site Account is opened by Hacker using online brute force attack to guess the employee’s login ID and password


Key learnings

Are You Being Asked to?

1. Receive unsolicited calls from unknown contacts (or unusual source – CEO?)

2. Receive or act on unsolicited instructions

3. Click on unexpected, unfamiliar or fake links

4. Circumvent procedures with plausible reasons a. i.e. request to transfer funds via Manually Initiated Funds Transfer (MIFT)

5. Deal with a first-time or unknown beneficiary

6. Make immediate ‘Confidential’ or urgent payments

7. Approve an unknown or unfamiliar transaction

8. Transfer funds by or before an extended holiday

9. Transfer funds to a known secrecy haven

10.Transfer funds to an alternative jurisdiction

16

Profile of a Fraudster

Profile of a Fraudster ... KPMG 2011 – Global Survey – 348 cases of “white collar” crime.

The typical fraudster is…

• Male • 36 to 45 years old • Holds a senior management position • Works in the finance function or in a finance-related

role/Operations • Employed by the company for more than 10 years • Works in collusion with another perpetrator

18

Presenter

Presentation Notes

The survey’s finding that men commit more fraud than women seems a reflection on the gender make-up of companies generally. The gender gap in fraud perpetration may reflect women’s under-representation in senior management positions at the time of the survey and, as a consequence, fewer opportunities to commit fraud. Changes in personal circumstances or pressures to meet aggressive work targets may influence the onset of fraudulent activity. They may then commit fraud once they have worked for a company for an extended period, when they have gained the trust and respect of colleagues and have identified absent or poorly designed controls providing the opportunity to exploit a business. Source: KPMG 2011 Fraud Survey

Profile of a Fraudster ... (Cont’d)

Based on Analysis of 596 Fraudsters Member Firms Investigated Between 2011–2013

• The typical fraudster is aged between 36 and 55 (70)%, as per 2013 survey

• Historically Male – evolving gender variances in senior corporate positions

• Employed by the company for more than 6 years

• Commits fraud against his own employer (61)%

• Works in the Finance function / Operations or senior management position

• 72% of all frauds were perpetrated over 1 to 5 years

• In 70% of the frauds the perpetrator worked in collusion over a period of 1 to 5 years

– 43% had a value in excess of US$500,000, exceeding US$5,000,000 in16% of these cases

• When fraudsters act alone a large majority of frauds were still protracted over 1 to 5 years

– 32% had a value in excess of US$500,000, exceeding US$5,000,000 in 9% of the cases

KPMG 2013 – Global Survey – 596 cases of “white collar” crime.

19

Presenter

Presentation Notes

The 2013 survey findings were similar to those of the 2011 survey. It found that the approximate maximum age of fraudsters increased from 45 to 55 years perhaps highlighting the capability of senior management to more easily override existing controls or conceal their actions simply because of their seniority. Further, employment tenure has reduced from 10+ to 6+ years, perhaps indicating there are more industry opportunities to commit fraud through poorly designed or absent control environments. This may further be driven by the economic downturn of recent years providing both the ‘pressure’ or ‘motivation’ to commit fraud. The 2013 survey also highlights the fact that frauds are becoming more protracted, again potentially indicating the existence of absent; poorly designed control environments or controls (which may have otherwise prevented or detected the fraud) poorly executed. Also of note, is an increase in the overall potential financial exposure to businesses through protracted fraud (1-5 years) with fraudsters working alone accounting for 9% of losses in excess of $5,000,000 and those perpetrators working in collusion accounting for 16% of losses in excess of $5,000,000. This suggests that fraud through collusion has a higher success rate indicating the importance of a layered control environment ensuring we do not provide a single point of failure e.g. risked based multiple levels of approval and timely reconciliation and proofing of accounts supported by segregation of duties to avoid any overlapping (toxic) entitlement. Source: KPMG 2013 Fraud Survey

Fraud Management – Basic Controls

Presenter

Presentation Notes

When managing your company financial flows, industry experience has established the following as some of the main controls that can determine the effectiveness of a company’s ability to counter fraud attempts.

Fraud Awareness: Basic Controls Main controls that can determine the effectiveness of a company’s ability to counter fraud attempts.

Trust v. Process

Know Your Employee

Know Your customer/supplier

Understand the risk (internal/external)

Training

21

Presenter

Presentation Notes

In our experience the following factors often pay a role in the commission of a successful fraud: Banking is about processes and supporting controls, not trust. We would all like to be able to trust our colleagues but that is not what we rely on to prevent losses. In banking we have a principle of segregation of duties – when a banker has to authorise a transaction that was processed by a colleague, he/she must perform all the required checks and balances before signing off on the transaction. You simply cannot do it merely because you trust the person. Always keep in mind that …………’Trust is not a Control’ Know your employee, this starts with pre-employment screening and continues throughout the person’s career. Know your customer/supplier. If you regularly deal with a counterparty and make payments to that counterparty set up a standard settlement instruction which is properly authenticated and then make payments only to that account, do not accept amendments without further authentication. There should be a process to evaluate your product offerings and supporting processes/controls to identify fraud risks and ensure that you have mitigating controls in place. A Fraud Risk Assessment should be signed off by the relevant business heads prior to launch. Once you have done this ensure that your staff are periodically trained in the supporting processes/controls and provide them with fraud awareness training. When executing operational processes/controls it is vital for employees to understand the difference between processes and controls (put in place to mitigate both inherent and residual fraud risk) and the potential financial/reputational impact to your company following non-adherence.

Basic Controls – Multi-layered Controls Environment

Fraud Risk Assessment

Accounts Reconciliation

Audit Trail Physical Security

Staff Training & Awareness

Mandatory Absence

Maker Checker

Network, Servers and PCs Security

Segregation of Duties

Escalation & Referral Policy

Fraud Management

Policy

Entitlements Management

Information Security Policy

Independent Investigation

22

Presenter

Presentation Notes

Banks apply general controls to prevent or detect fraud, the same principles should apply to every corporate entity: Segregation of duties - best practice supports the principle that no single person should ever be able to execute a transaction throughout the lifecycle of the financial flow. No one person should be able to command/dominate the end to end financial flow. This includes transaction initiation, approval, repair and reconciliation. Dual custody - e.g. when a bank appoints custodians to a vault one person will have the upper combination and another person will have the lower combination. One person should never have both combinations/keys. The same principle would apply to a company cheque inventory or any instrument used to initiated and/or authorise a companies financial flow. Audit trail - Every transaction, even enquiries must be traceable to a specific user – this acts as an effective deterrent / preventative measure. Ideally audit trails should be independently monitored to identify what may be considered anomalous suspicious activity / behaviour. Password sharing - under no circumstances should passwords be shared for any reason, this encourages a lack of control and ultimately provides the opportunity for internal fraud / employee wrongdoing. Safeword Cards/Passwords/PINs should be kept SAFE and never shared. Timely Reconciliation of Accounts is key to an effective control environment. Suspense accounts should be reconciled daily and exception items captured and escalated to senior management. Items should be resolved in a timely fashion. Ideally, accounts should be reconciled daily and proofed monthly. Timely reconciliation and proofing of accounts will ensure that any potential fraud anomalies are identified as soon as is possible and escalated to enhance the likelihood of a successful recovery. Entitlement Management - entitlement should only be granted to employees sufficient to perform the required functions of their job profile. Employees should be mandated with appropriate authorisation levels commensurate with their role. Periodic reviews should be conducted at an appropriate frequency and testing should form part of a businesses self assessment. Effective entitlement review by management will prevent unnecessary or overlapping (Toxic) entitlement which may provide the opportunity for fraud.

Case Study – Payment Operations Employee Wrongdoing

This is a the general case of how cyber-attacks may target and compromise a senior executive’s account to conduct fraud.

• In Nov 2012 The Fraud investigation team are alerted to a client side Fraud of US$6.1 Mil. involving an Employee in Kazakhstan.

• The employee has used his colleagues token to approve two fraudulent transactions and absconded the following day

• The beneficiary bank advised that the funds have been converted to USD, layered into 12 transactions and transferred to accounts in 6 different countries

• Despite being hampered by secrecy laws recall messages are sent to the correspondent banks via SWIFT

• All but US$250,000 recovered due to rapid response by client and fraud investigations team

• Funds sent to Malaysia/Switzerland had been accepted in good faith where unwittingly goods and services were dispatched

• Investigation reveals that the token was reassigned to a new user rather than a new token being issued

• The perpetrator “borrowed” two tokens without the users consent

• Pins were left in the cards and were not secured

• Payments were initiated out of office hours

• Both approvers including the CFO were no longer in the company’s employment

• USD payments are subject to currency control regulations in Kazakhstan

• All 12 payments were made to first time beneficiaries

Lessons Learnt:

• Password sharing prevalent

• No proper Segregation of duties

• Poor management oversight

• No fraud training

• Suspect had links to organised crime gangs

18 Case Study – Electronic Banking Employee Wrongdoing

Case Study: Payment Operations Employee Wrongdoing

Inve

stig

atio

n

All payments were initiated during out of (normal) office hours on the evening of 31 October

Case Study: Payment Operations Employee Wrongdoing (Cont’d)

Time Date Amount (US$) Action User ID User Name Beneficiary Name

1

20:10:44 31-Oct-12 US$3.65 million Initiate Payment 3957527 Employee 1 Primary Beneficiary

20:20:06 31-Oct-12 US$3.65 million Level 1 Authorisation 3269215 Employee 2 Primary Beneficiary

07:33:14 01-Nov-12 US$3.65 million Level 2 Authorisation 6912813 Employee 3 Primary Beneficiary

2

20:15:41 31-Oct-12 US$2.46 million Initiate Payment 3957527 Employee 1 Primary Beneficiary

20:20:38 31-Oct-12 US$2.46 million Level 1 Authorisation 3269215 Employee 2 Primary Beneficiary

07:33:20 01-Nov-12 US$2.46 million Level 2 Authorisation 6912813 Employee 3 Primary Beneficiary

25

Presenter

Presentation Notes

This highlights the importance of having a robust control/information security environment (restrict when users can access the system). This should include regular user and entitlement reviews to ensure that entitlement is commensurate with the employees job profile and that segregation of duties is in place i.e. Security Administration/ID management, transaction initiation, authorisation, repair or control activities should not be performed by the same person. Never share your Safeword card or PIN as this increases the risk of fraud by providing the opportunity should an individual be pressured or motivated by external/internal forces such as financial debts; gambling addiction etc. and is able to rationalise their actions i.e. ‘I was passed up for promotion’ or ‘the company owes it to me’. Hard tokens such as Safeword should always be stored securely and PINs treated the same as you would your own ATM bank card PIN. Also emphasises the importance of timely (intraday/daily) proofing and reconciliation of accounts. Any exceptions should be immediately escalated and investigated through to resolution to enhance the recovery potential in the event of fraud.


The graphic depicts how funds are layered across multiple banks and jurisdictions to complicate recovery efforts.

26

Presenter

Presentation Notes

Layering of funds across multiple banks and jurisdictions to complicate joint restitution and recovery efforts

Investigation Lessons Learned Conjecture

• USD payments are subject to local currency control regulations in Kazakhstan – OCG

• First Time Beneficiary – checks across the correspondent bank payment network identified no other payments made to/from this beneficiary

• Open source media investigations into the ultimate beneficiaries found little information on their business activities

• Company beneficiaries were linked to Money Laundering networks in Kazakhstan

• All registered under the same accommodation address in the UK and were not physically present at this address

• Segregation of Duties (Entitlement Management)

• Information Security Controls (Password Sharing)

• Poor Management Oversight

• Periodic Fraud Awareness Training

• To understand the mindset of this individual, the following motif was added to his social networking site on 2 September 2012…

• “In order to earn, one has to work. But in order to become rich, one has to come up with something different”

• Review of the suspects profile on a Russian language social networking site

• Suspect did not act single-handedly with possible multiple connections to organised crime

27


Presenter

Presentation Notes

Outgoing USD payments are subject to local currency control regulations in Kazakhstan and, in respect of these transactions, it is understood from the remitting bank that the necessary documentation was in place well in advance. This suggests the likelihood that the fraud was orchestrated by Organised Criminal Groups Checks across the industry payment networks identified no other payments made to/from this beneficiary. This was the first time that the company had made payments to this beneficiary. Had the company set up a systemic list of previously authenticated known payees (such as the CitiDirect ‘Preformat’ functionality which restricts payments only to known or pre-approved beneficiaries), the fraud may have been prevented. Open source media investigations into the ultimate beneficiaries found little information on their business activities with links to money laundering networks with a nexus in Kazakhstan all registered under the same accommodation address in the UK and were not physically present at the registered address Lessons learnt Segregation of duties - best practice supports the principle that no sole person should ever be able to execute a transaction throughout the lifecycle of the financial flow. No one person should be able to command/dominate the end to end financial flow. Password sharing - under no circumstances should passwords be shared for any reason, this encourages a lack of control and ultimately provides the opportunity for internal fraud/employee wrongdoing. Safeword Cards/Passwords/PINs should be kept SAFE and never shared. Effective Management oversight will ensure a robust operating control environment and a deterrent to employee wrongdoing Employees should be periodically trained in the supporting processes/controls and provide them with fraud awareness training. When executing operational processes/controls it is vital for employees to understand the difference between processes and controls (put in place to mitigate both inherent and residual fraud risk) and the potential financial/reputational impact to your company following non-adherence. Conjecture: A review of the suspects profile on a Russian language social networking site indicated that he is currently missing with seemingly desperate posts since 31 Oct from friends and family asking him to contact them and informing him that his father had since died. On 24 Nov 2012, a missing person’s webpage was created stating that the suspects whereabouts was still unknown; that his mobile phone was now disconnected; and that the reasons for his disappearance are unknown asking for help in finding him. Further checks against the social networking site in June 2014 indicated that the suspects whereabouts was still unknown and the ‘Group Missing Persons’ page had been taken down giving the impression that all hope of finding him was lost. Purely speculative although emphasises the risks of colluding with organised criminals.

Response and Recovery

The following is recommended Citi Security and Investigative Services advice on steps to take in the event of suspected or actual fraud involving bank payments.

What to do in the Event of Fraud

First Response … – Act Quickly

• Review and urgently confirm fraud, every minute may count

– Use the ‘F’ Word • Be prepared to state “fraud” and confirm this in writing/ email (not “potential fraud” or similar, banks

will not act on “potential” issues)

– Alert Citi Immediately • Citi will initiate recall actions (this may include SWIFT recall and/ or direct contact)

• The shorter the time between fraudulent transaction and detection, the greater the chance of recovery (ideally 24-48 hours, thereafter the prospect of recovery drops off dramatically)

– Provide the Details • Beneficiary banks and others will need clear background information before they will act

• Some jurisdictions are more difficult than others so clients may need to consider further action to secure their position (There may be legal restrictions on freezing/returning funds locally, or providing information on the identity of the beneficiary client or remaining balance without a court/ Police order. There may also be certain processes that the client may need to follow.)

• Where a beneficiary bank requests an indemnity from Citi to return funds (protecting that bank from any claims from their account holder), Citi will request an indemnity from the client

29

Presenter

Presentation Notes

Post an attack, it is important to have a management and recovery plan in place… Many clients we have spoken to recently only create a plan AFTER an event or near miss We advise clients that: It is important for staff to know what to do and who to notify Issue alerts and reminders for staff to know exactly what to do in the event of an actual or potential compromise Notify your security officer and your usual bank contact to investigate any suspicious activity Act quickly to recover lost funds (your bank can work with you to investigate and attempt recovery of funds)

The following is recommended Citi Security and Investigative Services advice on steps to take in the event of suspected or actual fraud involving bank payments.

More information

Further Steps • Engage internal fraud/security resources

• Report to local law enforcement as soon as possible – obtain a copy of the report or take a crime reference number

• Independently review all recent transactions and logs for other suspect payments or unusual activity

• Independently secure your bank accounts to prevent further misuse

• Alert any other banks you may hold accounts with

• Send an internal alert to increase awareness and vigilance

• Retain and hold any potential evidence for investigation

• Consider appointing legal counsel, forensic consultants or private investigators to represent/ assist you if necessary

• Question employees carefully, seek verification of activity and keep written records

Reason/Example Bring in subject matter experts

Beneficiary banks may expect/request this)

Look for other potentially fraudulent transactions

Example: Disable system users, implement payment exception approval process, etc.)

In case fraudsters attack other bank accounts

In case of further contact/ attempts, unless there is a concern of internal compromise

Examples of evidence include email correspondence, audio logs, desktop PCs)

Some jurisdictions can be more difficult to navigate then others

Ensure your employee’s recollection of events is accurate.

30

Some recommended reading.

More information

• FBI Information http://www.ic3.gov/media/default.aspx

• Cyber Masquerading https://www.citibank.com/tts/sa/emea_marketing/docs/cyber_masquerading.pdf

• Combatting Fraud placemat https://www.citibank.com/tts/sa/emea_marketing/docs/combat_fraud.pdf

• Cyber Security Webinar https://www.citibank.com/tts/about_us/online_academy/videos/digisec_060115.html

• PWC - The Global State of Information Security® Survey 2015 http://www.pwchk.com/home/eng/rcs_info_security_2015.html

31

http://www.ic3.gov/media/default.aspx

https://www.citibank.com/tts/sa/emea_marketing/docs/cyber_masquerading.pdf

https://www.citibank.com/tts/sa/emea_marketing/docs/combat_fraud.pdf

https://www.citibank.com/tts/about_us/online_academy/videos/digisec_060115.html

http://www.pwchk.com/home/eng/rcs_info_security_2015.html

IRS Circular 230 Disclosure: Citigroup Inc. and its affiliates do not provide tax or legal advice. Any discussion of tax matters in these materials (i) is not intended or written to be used, and cannot be used orrelied upon, by you for the purpose of avoiding any tax penalties and (ii) may have been written in connection with the "promotion or marketing" of any transaction contemplated hereby ("Transaction").Accordingly, you should seek advice based on your particular circumstances from an independent tax advisor.

Any terms set forth herein are intended for discussion purposes only and are subject to the final terms as set forth in separate definitive written agreements. This presentation is not a commitment or firm offer and does notobligate us to enter into such a commitment, nor are we acting as a fiduciary to you. By accepting this presentation, subject to applicable law or regulation, you agree to keep confidential the information contained herein andthe existence of and proposed terms for any Transaction.

We are required to obtain, verify and record certain information that identifies each entity that enters into a formal business relationship with us. We will ask for your complete name, street address, and taxpayer ID number.We may also request corporate formation documents, or other forms of identification, to verify information provided.[TRADEMARK SIGNOFF: add the appropriate signoff for the relevant legal vehicle]

© 2015 Citibank, N.A. All rights reserved. Citi and Citi and Arc Design are trademarks and service marks of Citigroup Inc. or its affiliates and are used and registered throughout the world.

© 2015 Citibank, N.A. London. Authorised and regulated by the Office of the Comptroller of the Currency (USA) and authorised by the Prudential Regulation Authority. Subject to regulation by the Financial Conduct Authority and limited regulation by the Prudential Regulation Authority. Details about the extent of our regulation by the Prudential Regulation Authority are available from us on request. All rights reserved. Citi and Citi and Arc Design are trademarks and service marks of Citigroup Inc. or its affiliates and are used and registered throughout the world

These materials are for information purposes only and do not constitute legal or other advice. These materials are intended as an aid in improving cyber security and fraud awareness and are not a substitute for your own programme in this regard. We have no responsibility or liability for any consequences of any entity relying on any information in these materials.

icg pres cts (letter) - citibank · cyber attack is an attempt by online criminals to access or...

Documents