How criminals recruit bank employees
Elangovan, October 2, 2019The world is getting darker on a daily basis and many unimaginable frauds are being perpetrated by people that are ordinarily supposed to be the arbiter of the banking sector. Bank employees across board have now made themselves willing tools in the hands of criminals.
According to security monitoring and ethical hacking experts from the International Institute of Cyber Security, in darknet you can find malicious software, cyberattack services against companies or individuals, even buying confidential information sales, such as credit card numbers or identity details. A new trend in cybercrime is the recruitment of professionals in different areas to collaborate with networks of malicious hackers from within an organization. An investigation discovered job offers in darknet for employees of banking institutions in Russia offering average wages of 4000 euros for one hour of work per day, salary much higher than the monthly average in Russia of 500 euros, so many Bank employees are attracted by this kind of offers (ISN, 2019). The offer is mouth-watering and there is hardly anyone who will not be tempted to give in the towel. Even those who are conscious of their integrity might soon forget about it. This becomes more real when the person is passing through financial difficulties. So, the first method employed by criminals is to lure bank employees with huge compensation that the sector cannot afford to pay them.
According to the ISN, in 2016, security monitoring experts analyzed about 100 million of sites in the superficial network and dark web, finding that some gangs of cybercrime resort to traditional recruitment methods; ads are published, interviews are made (by videocall in many cases), and even hired for trial periods. So, that is to the extent they can go in fulfilling their aspirations.
Internal fraud is what many banks battle with because their gain is being affected in all fronts. Specific was the case of Halifax Bank of Scotland (HBoS). The police investigated this case for over a period of six years.
On 30 January 2017, a UK senior banker and a handful of conspirators were found guilty by the Southwark Crown Court of conspiracy to corrupt, conspiracy to launder the proceeds of crime, and fraudulent trading between 2003 and 2007. In total, the six persons were imprisoned for 47 years. The banker alone was sentenced to more than 11 years in prison. The banker headed a high-risk assets office in HBoS, where he managed the portfolios of customers with businesses in financial difficulties, many of which were at risk of defaulting on their loans. As part of the banker’s position, he approved loans to the customers in order to restore solvency in the businesses (Folker & Hansen, 2017).
However, some loans were only approved if the customer agreed to purchase consultancy advice from an outside turn-around consultancy company, Quayside Corporate Services. In return for sending business to the consultancy company, the banker received gifts and hospitality at an unprecedented extent. Moreover, the consultancy company, which was supposed to help the businesses regain profitability, did the exact opposite or nothing at all. Its only achievement was to charge high fees for worthless consultancy services. The banker – motivated by private gains – continued to approve loans to customers, well beyond the point where there was any chance of them paying back the loans with interest, thereby prolonging the flow of income to the consultancy company. The banker – as the judge remarked – wallowed in luxury provided for by his friends and was simply “motivated by greed”, as he exploited the weaknesses in the bank’s systems and the lack of supervision, falsified documents, removed or avoided protections that the bank should rightly have had (Folker & Hansen, 2017).
The foregoing also shows another means that criminals use in engaging bank employees in their despicable acts. They collaborate with the friends in the system all in the name of consultancy or other fraudulent set up just to defraud the financial institutions and their customers of huge amount of money.
Thames Valley Police that was saddled with the case said this concerning the matter: “The sum of money lost by HBoS as a result of the actions of a corrupt senior employee and others was at the very least £250M. [The banker] and his fellow conspirators embarked on a spending spree involving yachts in the Mediterranean, villas in Barbados and Majorca, prostitutes, overseas bank accounts, and a general high life. This has been at the expense of the shareholders of the bank, and many medium and small companies which have been bankrupted and ruined. Little will be recovered.”
Should banks now sit back and watch helplessly? Definitely no! Banks can engage in data theft prevention through Monitoring solutions like Business Control Systems (BCS). Companies cannot control the activities of users on their PCs or personal mobile devices, although there is the option to control and monitor the corporate environment to prevent employees from working as infiltrators in an organization.
The company’s visibility into employee activities is essential for detecting access or anomalous searches. By performing adequate monitoring; it is at this point that the visibility of the company in the user’s activity becomes essential. Regularly, employees who use credential access to privileged levels are monitored, although security monitoring specialists believe that monitoring is always useful regardless of employee level; in other words, any employee who works with company information should be monitored. The monitoring of the user’s activities can be done without intervening with the user’s privacy, implementing solutions that provide a complete visibility of the employee’s actions, but limiting a potentially invasive use. The implementation of these solutions must be accompanied by a reasonable data revision policy, which does not interfere with the privacy of employees, as considered by security monitoring specialists from the International Institute of Cyber Security (ISN, 2019).
The use of infiltrated employees in organizations is a serious security threat. Companies must work to understand this problem and develop the best possible preventions; employee behavior patterns, visibility into their online activities and the ability to detect anomalous incidents will help prevent a large number of security incidents stemming from the activity of criminals on dark web. Detection is crucial for organizations to protect their most valuable assets and to prevent the loss of sensitive data before the worst possible scenarios happen (ISN, 2019).
References
Ajaja, T (2018). Fraudulent Conspiracy: How Banks Protect Staff Guilty Of Stealing Customers’ Money. Retrieved from https://punchng.com/fraudulent-conspiracy-how-banks-protect-staff-guilty-of-stealing-customers-money/
Folker, H & Hansen, A (2017). Internal Fraud: How To Detect Criminal Employees. Retrieved from https://www.kromannreumert.com/Insights/2017/Internal-fraud-How-to-deter-criminal-employees
ISN (2019).Criminals In Darknet Seek To Recruit Business Employees: How To Prevent. Retrieved from https://www.securitynewspaper.com/2019/02/09/criminals-in-darknet-seek-to-recruit-business-employees-how-to-prevent/
© 2019 LPS Training Services All Rights Reserved.