Movie fans may think of bank robbers as men on horseback wearing bandanas over their faces or even 1920s gangsters brandishing Tommy Guns, but today’s bank robbers have no need for such stunts.
“Threats to financial institutions have been around since the dawn of time, but the sophistication of those threats has increased exponentially where they’re not physically walking into a bank branch to conduct fraudulent activity or … physically rob that facility,” said Susannah Marshall, Arkansas state bank commissioner and securities commissioner. “They are robbing them and harming them through a computer screen.”
Susannah Marshall
Criminals can accomplish their goals by using a skimming machine on an ATM, taking over a bank’s website or hijacking banking apps, she said. Hackers could work individually or in groups, she said, and they could be in the United States or on the other side of the world.
Often, it is not just a single bank that is at risk, she added; cybercriminals may also attack third-party providers, individual consumers or interconnected groups of financial institutions. It is a far-reaching criminal endeavor that’s equally complicated to combat, Marshall said.
“I mean, how would you ever engage law enforcement and other authorities to help you track [criminals] down?” she said. “Unlike traditional robbery thefts where you, maybe, stand a chance to identify the perpetrator, so many times in this day and age, once that button’s been pushed, the money’s gone.”
Not only has the nature of criminals and the means by which they attack banks changed; the impact on financial institutions has changed, as well.
“When there was the individual, lone-wolf criminal that attempted to harm or rob an institution, the business recovery and business continuity for that bank was pretty short,” she said. “The facility would close down, they would take care of their employees that were impacted, they would ensure that the physical space was secure, and their resumption of business was pretty short in the grand scheme of things. Nowadays, when a criminal or a bad actor commits a fraud against an institution, it can disrupt their operations for a significant period of time.”
While there has been increasing awareness of cybersecurity in recent years, Marshall said her department still sees simple safety measures being neglected. A lack of multi-factor authentication, outdated task management programs, an absence of audits and independent reviews, and improperly vetted third-party relationships can all put banks at risk, she said.
New technology can be used to counter all kinds of cyber attacks, ransomware and malware, she said, but for every new product that is developed, new threats emerge. She likened the process of responding to cyberthreats as they arise to “blocking and tackling” on a football field.
Scams that use deepfakes — artificially generated audio and video — are a “real and present danger” to the banking industry, she added.
While Arkansas banks are taking a conservative approach to adopting emerging technologies such as artificial intelligence and machine learning, Marshall said such technologies have the potential to enhance the delivery of products and services, boost existing risk-management practices, and reach additional customers.
“There is a significant amount of innovation and emerging technologies in the marketplace, whether that’s in banking or in other businesses,” she said. “The challenge is to identify where those emerging technologies and developments can add benefits but also to ensure there’s awareness around what additional and potential risks come with that.”
Marshall said digital wallets such as Cash App and Venmo present another avenue for fraud and another layer of challenges for financial institutions.
“The breadth and depth of those mobile-application customers, it’s such a significant business line,” she said. “We work collectively with our state counterparts across the country to manage that money-transmission activity.”
Working with other state and federal regulators, the Arkansas State Bank Department develops policies to mitigate cyberthreats and examines banks’ information technology practices, as well as those of third-party IT service providers, which Marshall said are becoming more common as banks struggle to find skilled IT professionals. Cost is another major challenge for banks looking to ensure robust IT security, she added.
It is important that banks have an IT culture embedded from the C-suite to the consumer, she said, adding that several Arkansas banks have had success bringing in retired IT specialists at the board level to provide organizations with strategic guidance. Banks are also working to provide IT training to staff throughout their organizations, she said.
“The health of an institution’s information technology program is incumbent upon everybody in the organization, and it also brings into play the customer,” she said, adding that customers frequently and unintentionally bring their personal cybersecurity exposures into banking systems.
Marshall said her department and others across the country are focused on ensuring financial institutions are working to inform the public that scams are a real, daily threat with the potential to upend financial lives.
“They need to be aware and be mindful at every turn that, quite frankly, unfortunately, all of us are one click away from being impacted by a fraud or a scam,” she said. “It’s imperative that we all develop a stronger personal IT and security mindset.”
At Generations Bank, educating staff and customers is key to ensuring cybersecurity, said Alana Girard, chief operations officer.
Alana Girard
“We recognized that the human element is crucial, so we have implemented comprehensive cybersecurity training to raise awareness about common fraud methods and prevention strategies,” she said. “Since people can be the weakest link in the security chain, our focus is on empowering everyone to be vigilant and security conscious.”
From cybercriminals who hack into computer systems to fraudsters who operate through mail scams and fraud rings that exploit people from vulnerable populations by outfitting them with disguises and sending them to cash fraudulent checks, she said staying on top of the myriad schemes employed by criminals is key to banking security.
Scams that utilize deepfakes are on the rise, she said, and although her bank does not deal extensively with cryptocurrency, she said crypto provides yet another dark alley in which consumers can be digitally robbed.
“One of the biggest issues we encounter is people giving out their information to fraudsters who then use that information to purchase cryptocurrency,” she said. “Unfortunately, it’s incredibly difficult to recover the funds lost in this type of situation.”
With an emphasis on building relationships with customers, small, local banks are uniquely positioned to gain deep insights into their customers’ behavior, allowing them to quickly identify unusual activities that might spell fraud, she said.
“We want to reassure everyone that being a smaller bank does not mean being unsafe,” she added. “In fact, Generations Bank is dedicated to regularly training our employees and diligently monitoring and updating our systems to ensure the highest level of security and protection for our customers.”
Joshua Wheatley, senior vice president of technology and information security officer at Signature Bank, reiterated that one of a bank’s greatest vulnerabilities is its customers.
Joshua Wheatley
“We do a great job of putting security at every level, from the user to the network, through our data, so internally with the bank, I’m confident that we’re doing the right things and performing the right steps,” he said, “but when it comes to the individual customer, there are certain things that they need to do that is outside the reach of what I can provide or what human action they need to perform to secure themselves.”
He encouraged consumers to use strong passwords and biometric access tools, utilize multi-factor authentication, monitor accounts, avoid clicking on suspicious email links, familiarize themselves with stolen device settings, and contact their financial institutions immediately if they suspect fraud.
Never give credentials out via phone, text or email, he said, and watch out for phishing, in which attackers try to steal information, smishing — phishing via text — and spoofing, in which attackers pretend to be a legitimate person or business.
Furthermore, be wary of public Wi-Fi.
“If you go into a coffee shop, and you’re on your laptop, and you’re just doing your day-to-day work, and then you hop in to look at your bank account, there is no telling what kind of rogue devices are connected to that, as well,” he said. “Just be mindful of that.”
The same security measures apply to digital wallets, he said, adding that banks have mechanisms in place that can protect consumers whose digital wallets have been compromised.
From educating users and staff members about internet safety to thoroughly vetting third-party providers and monitoring the activity of new customers to ensure they are legitimate, Wheatley said Signature uses various techniques to keep customers’ funds secure.
“Anything that we bring in new or some of our existing services, we completely wrap security around it,” he said. “It’s the main topic in every discussion we have.”
He said the bank has taken numerous steps to beef up cybersecurity measures in recent years by upgrading its core platform, adopting a cloud-first initiative that provides easier deployment of security infrastructure and integrating software-defined wide-area network, or SD-WAN, technology.
“We kind of framed a term, ‘a branch in a box,’ which isolates each and every branch to be independent of itself,” he said. “That way, it’s not relying on a hub/spoke-type architecture, and it adds more security to each and every branch.”
The bank also uses enterprise fraud detection software that protects users across various banking activities.
“If a user has some type of anomaly that they are not accustomed to, it locks down their financial footprint within the banking system,” he said. “If they’re outside of a region or there’s different transactions that they haven’t performed ever or over time, it’s able to detect that.”
Although his bank has not yet adopted artificial intelligence tools, he said it is “on the road map” and could be used to monitor day-to-day operations and detect fraudulent activity.
Since outsourcing can reduce the need for manpower and downtime, employing managed service providers can be key to ensuring small, local banks leverage technology to its full advantage, he added.
“Smaller banks often face unique cybersecurity challenges due to limited resources,” said Scott Anderson, chief external affairs officer at Forge Institute, a Little Rock organization that works to eliminate cyber threats. “To address these, they can benefit from employee training programs and customer education initiatives.”
Scott Anderson
The Forge Institute’s Arkansas Cyber Defense Center can provide banks with free cybersecurity assessments, employee training and incident-response assistance, he added.
He said new technology can drastically improve banking security. The Advanced Encryption Standard algorithm can keep data safe from unauthorized access, he said, blockchain technology provides a secure way to record transactions, and AI can be used to detect and respond to threats in real time.
“AI is crucial for banking security, using predictive analytics and automated threat detection,” he added. “It can spot unusual activities and potential threats quickly, helping banks take proactive measures. AI also aids in detecting fraud, verifying customer identities and managing risks.”
However, AI also creates new risks as cybercriminals use it for sophisticated attacks, he said.
“A major challenge is how fast technology changes, often outpacing traditional security measures,” he said. “Cybercriminals are getting smarter, using AI for attacks, and new tech doesn’t always mix well with old systems. Balancing the need for innovation while following regulations is also complex.”
In addition to deepfake scams, AI-powered bots can launch large-scale assaults such as distributed denial-of-service, or DDoS, attacks, in which a system is bombarded with login requests, or credential stuffing, by which hackers try to access websites using stolen usernames and passwords.
“Be aware of social-engineering attacks where criminals trick people into giving up sensitive information,” he said.
Business email compromise, or BEC, scams, ransomware and SIM swaps, which hijack victims’ cellphones, are also on the rise, he added. Consumers should also protect themselves against man-in-the-middle attacks when using digital wallets.
Bank robbers may have changed, but banks have, too, and Anderson said emerging technology will continue to play an integral part in the evolving game of cops and robbers.
“The future will see more reliance on AI and machine learning, greater use of blockchain for transaction security and widespread biometric authentication,” he said. “Enhanced collaboration among financial institutions, regulators and tech providers will be crucial in creating a resilient and secure banking environment.”
READ ALSO: Tiny Homes, Big Impact: Fighting Homelessness in Arkansas
