Tag Archive for: banks

Right time, right place: opportunities for banks and credit unions with Buy Now, Pay Later

/in


Since the birth of currency, the use of credit has been essential to empowering consumers to obtain goods and services immediately while delaying their financial obligation to pay that debt back.

In the mid-20th century, with the advent of national and global payment card brands, more consumers could access greater lines of credit more quickly and spend on those balances in more places. Today, the connectivity of consumers, via mobile devices, has enabled the meteoric growth of Buy Now, Pay Later (BNPL) as one of the fastest growing methods for payment at checkouts online and in store.

Consumers have numerous options when it comes to selecting a BNPL service provider. Many of the largest banks offer BNPL-style payment methods, as well as American Express, PayPal, and Apple. There are also quite a few pure players to choose from, including the likes of Klarna, Affirm, and Afterpay.

Essentially, these services are offering zero-percent interest, short-term loans to their customers with an installments-based payback period of several weeks or months. Typically, the BNPL provider will charge a service fee to the merchant, and late fees and/or interest for late payment. Offering this type of payment method gives merchants that ability to offer a low-friction, delayed payback option to people who may or may not have a credit card, which can grow ticket value and volumes.

BNPL payment methods are most common when purchasing big ticket items; however, as more and more e-commerce and retail stores onboard BNPL providers and capabilities, the transaction volume will continue to broaden. It’s possible that the dramatic growth of BNPL as a payment method is in part driven by how the types of products consumers purchasing through the pandemic have shifted to categories more apt for a short-term lending contract — home goods (furniture, air purifiers, appliances) and home office items (laptops, desks, monitors). With more money being spent online, where BNPL found the earliest traction, the numbers of consumers they were able to serve grew. Conversely, credit cards may have suffered disproportionately given travel, dining, and big events were severely curtailed.

All of this is to say,…

Source…

Why Banks Are Slow to Embrace Cloud Computing

/in


Wells Fargo plans to move to data centers owned by Microsoft and Google over several years; Morgan Stanley is also working with Microsoft. Bank of America has saved $2 billion a year in part by building its own cloud. Goldman said in November that it would team up with Amazon Web Services to give clients access to mountains of financial data and analytical tools.

Cloud services enable banks to rent data storage and processing power from providers including Amazon, Google or Microsoft, which have their own data centers dotted around the globe. After moving to the cloud, banks can access their data on the internet and use the tech companies’ computing capacity when needed, instead of running their own servers year-round.

Seeing a big opportunity to sell cloud-computing services to Wall Street, some tech giants have hired former bankers who can use their knowledge of the rules and constraints under which banks operate to pitch the industry.

Scott Mullins, AWS’s head of business development for financial services, previously worked at JPMorgan and Nasdaq. Yolande Piazza, vice president for financial services at Google Cloud, is the former chief executive of Citi FinTech, an innovation unit at Citigroup. Bill Borden at Microsoft and Howard Boville at IBM are Bank of America alumni.

Cloud providers are “moving at a much faster development pace when you think of security, compliance and control structures,” compared with individual banks, said Mr. Borden, a corporate vice president for worldwide financial services at Microsoft. The cloud, Mr. Borden and the other executives said, enables companies to increase their computer processing capabilities when they need it, which is much cheaper than running servers on their own premises.

But glitches do occur. One week after Goldman teamed up with Amazon, an AWS outage halted webcasts from a conference hosted by the bank that convened chief executives from the biggest U.S. financial firms. The glitch also caused problems for Amazon’s Alexa voice assistant, Disney’s streaming service and Ticketmaster. AWS and its competitor, Microsoft Azure, both had outages recently.

Banking regulators in the United States, including the Federal…

Source…

Picus Threat Library Is Updated for Trojans Targeting Banks in Latin America

/in


Picus Threat Library Is Updated for Trojans Targeting Banks in Latin America

Picus Labs has updated the Picus Threat Library with new attack methods for Krachulka, Lokorrito, Zumanek Trojans that are targeting banks in Brazil, Mexico, and Spain. In this blog, techniques used by these malware families will be explored.

Banking trojans have a significant role in the cybercrime scene in Latin America. According to Eset, 11 different malware families that target banks in Spanish and Portuguese-speaking countries share TTPs, indicating that threat actors are cooperating on some level. For example, the same or similar custom encryption schemes are used by these malware families. In this blog, we will be focusing on 3 malware families called Krachulka, Lokorrito, and Zumanek.

Let’s start with Krachulka. As a spyware, it gathers classified information from infected systems without the consent of the user and sends gathered information to remote threat actors.

Lokkorito and Zumanek act like a classic Remote Access Trojan (RAT). They go one step further than Krachulka and not only collect information from infected systems but also perform malicious operations such as infecting the target with other malware and performing denial-of-service (DoS) attacks.

Test your security controls now: Prevent Log4Shell Exploits with Picus

Techniques used by Krachulka, Lokkorito and Zumanek

Krachulka, Lokkorito, and Zumanek malware families utilize 26 techniques and sub-techniques under 10 tactics in the MITRE ATT&CK framework. This section lists malicious behaviors of these malware families by categorizing them using the MITRE ATT&CK v10.0 framework.

1. Initial Access

  • T1566.01 Phishing: Spearphishing Attachment
  • T1566.02 Phishing: Spearphishing Link

2. Execution

  • T1059 Command and Scripting Interpreter
  • T1059.003 Command and Scripting Interpreter: Windows Command Shell  
  • T1059.005 Command and Scripting Interpreter: Visual Basic 
  • T1059.007 Command and Scripting Interpreter: JavaScript/JScript

3. Persistence

  • T1547.001 Boot or Logon Autostart execution: Registry Run Keys/Startup Folder
  • T1574.002 Hijack Execution Flow: DLL Side-Loading

4.Defense Evasion

  • T1140 Deobfuscate/Decode Files or Information
  • T1220 XSL Script Processing
  • T1497.001 Virtualization/Sandbox Evasion: System…

Source…

Rule requires banks report significant ‘computer-security incidents’ within 36 hours | Article

/in


The Office of the Comptroller of the Currency (OCC), Federal Reserve, and Federal Deposit Insurance Corp. (FDIC) approved the policy, which also requires service providers for financial institutions to notify affected bank customers of any service outage caused by a computer-security incident that lasts longer than four hours.

The rule is effective April 1, 2022, and compliance is required by May 1, 2022.

A computer-security incident is described in the rule as an “occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.” Such incidents can be caused by a variety of factors, including cyberattacks launched by hackers with “destructive malware or malicious software” as well as “non-malicious failure of hardware and software, personnel errors, and other causes.”

A “notification incident” is defined in the rule as a computer-security incident “that disrupts or degrades, or is reasonably likely to disrupt or degrade, the viability of the banking organization’s operations; result[s] in customers being unable to access their deposit and other accounts; or impact[s] the stability of the financial sector.”

The rule requires any bank services provider subject to the Bank Service Company Act (BSCA) to notify at least two individuals within the affected banking organization of a computer-security incident that it “believes in good faith could disrupt, degrade, or impair services provided subject to the BSCA for four or more hours.” The bank organization would then determine if the incident rises to the level of a notification incident and inform its regulators if that is the case.

“The notification requirement for bank service providers is important because banking organizations have become increasingly reliant on third parties to provide essential services,” the rule said. “… [A] banking organization needs to receive prompt notification of computer-security incidents that materially disrupt or degrade, or are reasonably likely to materially disrupt or degrade, these services because prompt notification will allow the banking…

Source…