According to Accenture’s Cost of Cyber Crime study, scams using malware are the most frequent — and the costliest to resolve. 1
Malware (or malicious software) is specifically designed to steal information, cause damage or interfere with the normal function of networks and mobile devices using various forms of software programmes. The most popular is malware embedded in an email as an attachment or link. Once the malware is downloaded, it could damage systems, and steal confidential banking information.
With a greater reliance on computers and mobile devices for online banking, the ways of distributing malware are getting more sophisticated, from phishing emails by unknown senders, to cloned advertising sites, infected applications and public unsecured Wi-Fi networks.
Criminals can defraud businesses through different forms of malware. These include worms, which have the ability to copy themselves through a poorly secured network and trojans, which once downloaded, can attack the user’s system and steal data.2 One example: the Remote Access Trojan (RAT) logs keys and passwords and can share screens (and control both keyboard and mouse) with parties beyond the organisation.
Mobile banking use has increased in the pandemic and, as a result, the number of malicious apps is expected to rise. With an increased demand for contactless payments, 2021 is likely to see a comeback of QR code scams where victims are lured into clicking on a fake website or downloading a malicious app . This gives scammers the opportunity to steal the victim’s money and sensitive data. Find out more about other fraud trends to look out for in 2021 here.
Holding companies to ransom
Criminals are capitalising on our online reliance, using malware to commit fraud by damaging systems or spying on operations.
They often start by mimicking legitimate service providers, buyers, suppliers or the company’s lawyers to earn a victim’s trust through phishing emails, malicious advertising, fake software, messaging and infected apps to introduce their programs into a network.3
Once the ransomware is downloaded onto devices, fraudsters use it to encrypt company data and demand payment, often in the form of cryptocurrency in exchange for regaining control of the victim’s system, data or files.
There is also an emerging trend of fraudsters creating data leak sites to further extort victims. Instead of just encrypting information to hold companies to ransom, fraudsters extend their schemes by threatening to post stolen data onto public servers. The risk of exposing sensitive data to the public puts increased pressure on victims to pay the ransom.
The cost of falling prey to malware
In a recent report by software provider Malwarebytes, about 24 per cent of companies reported incurring additional expenses because of a breach or malware attack after lockdown measures were imposed. Another 20 per cent reported suffering a security breach due to remote working.4
Apart from ransom demands, malware attacks can also lead to data breaches, a loss of trust from customers and even massive regulatory fines. Many companies that are caught off guard do not have an updated incident response plan.
Other risks include:
- Loss of revenue and disruption in operations
- Loss of intellectual property
- Loss of strategic information
- Damage to reputation
- Additional expenditure to enhance cyber security
Analysis by cloud solutions company iomart found that large companies typically lose between 10 and 99 million records in every data breach. This translates to an average drop in company value of 7.27 per cent.
To further complicate matters, businesses facilitating the payment of a ransom on behalf of the victims may also be implicated. An advisory issued by the Office of Foreign Assets Control (OFAC) in October 2020 warns that companies facilitating in ransom payments may risk violating OFAC regulations especially if the ransomware operator has been sanctioned or have a sanctions nexus.5
Don't fall for malware fraud
Businesses and individuals need to be constantly alert to prevent falling victim to malware fraud schemes.
Here are some steps companies can take to avoid falling prey to malware fraud:
- Have an updated incident response plan
- Ensure that your anti-malware and cyber security software is updated
- Install the latest security patches
- Connect only to secured or trusted Wi-Fi networks
- Encrypt your data to protect it in case of a security breach
- Increase staff awareness about fraud and social engineering
Since 90 per cent of cyber-attacks enter through opening emails, being alert to this early threat and training the workforce remains key to avoiding becoming a target.6
Technology such as AI and metrics combined with training programmes that highlight the range of cybercrime threats and how to respond to them, can all be used to increase employee knowledge and response protocols.
Banks and financial institutions also have a role to play in helping clients fight fraud. At Standard Chartered, we are committed to becoming a leader in fighting financial crime.7
We are one of the only banks to use a combination of AI, big data and other tools including regtech solutions, on a global scale. These are paving the way for further enhancements in surveillance systems and processes to help support our clients in their fight against cybercrime.8
Three steps to fighting malware fraud
Spot the warning signs of being infected by malware, which include your computer slowing down and pop up ads.
Stop your company falling prey to scammers by ensuring your system has adequate anti-malware and cyber security installed. Always connect to trusted Wi-Fi networks and ensure your data is encrypted.
Report the incident to your bank immediately. The quicker the fraud is reported, the higher the chances of recovery. If you suspect your company has fallen victim to a malware scam, notify your bank right away or contact your local Standard Chartered office.
