Horror Stories: hybrid bots attacking financial institutions
CHEQ
|Cyber Risks & Threats | July 18, 2022
Cost: early $3 billion in fraudulent transfers in a year.
Date: ongoing.
Industry affected: for now, mostly financial institutions
Threat Type: hybrid bots
What is it?
Bots are computer scripts designed to simulate human behavior. But as they have been increasingly used to commit fraud and other malicious activities, companies started to implement security measures to identify bot behavior and block them.
To overcome this, while attacking businesses, hybrid bots are being used by attackers to enable some parts of the application to be filled in by humans. For example, they allow human intervention in key PII (Personal Identifiable Information) fields, like name and social security number, and, with that, expect to deceive bot detection capabilities.
That’s why this type of threat has been called hybrid bots: by having the capability to allow human intervention, these bots are “part bot, part human.”
Long story short, what happened?
According to the FDIC, there is a rise in mule accounts across financial institutions in the U.S.
One of the reasons for this is the use of hybrid bots. With them, fraudsters can open accounts on a large scale and overcome different types of bot detection.
It is important to notice that mule accounts are not a U.S. problem only. In the UK, there are reported 468,000 mule accounts responsible for $702 million (or £550 million) in transfers. To add, according to Europol, more than 90 percent of money mule transactions are linked directly to cybercrime.
Why should you care?
Bots are one of the many fake web threats. But they are not the only “actors” that put institutions at risk. In fact, fake traffic is composed of:
Bot Traffic: Botnets, scrapers, crawlers, and automation tools.
Malicious Traffic: Click farms, hackers, fraudsters, and fake accounts.
Suspicious Traffic: Proxies (VPN), data centers, and excessive rate limits.
All of these can create problems and put businesses at risk. In this sense, having a solution that is capable of detecting any type of malicious activity and not just bots is mission-critical. To achieve that, search for Go-To-Market Security solutions that can determine each user’s authenticity and identify not only bots but also suspicious and malicious human activity.
P.S.
Want to protect your sites and ads? Click here to Request a Demo.
