To put oneself in an active position and to become able to control the risk of fraud attacks, one has to understand how fraudsters behave. The invoice redirect technique – also called supplier fraud – is taken as an example to comprehend a fraudster’s actions step by step.

 As outlined below in Figure 1, invoice redirect involves a company receiving an e-mail or another type of communication, purporting to come from a regular supplier and requesting that the company update their bank details. Often times, employees fail to recognise that it isn’t legitimate e-mail from their supplier because the e-mail closely resembles those regularly received from the supplier. Fraudsters usually observe their victim for a longer period of time and exploit their knowledge; for example by attacking when the boss is on holiday. This increases the challenge of recognising a fraud case and checking back with a trusted colleague. Often the incident is only detected weeks later when the supplier reveals that payment is still outstanding. Attempts for funds recovery place the onus on employees and financial institutions to enquire where the fraudulent payment went and if there are chances to recover the funds.

Figure 1

Source: Deutsche Bank

Given the tremendous global losses due to business e-mail compromise, prevention and detection have to go hand in hand and must also be a joint effort of financial institutions and corporations. Figure 1 outlines actions for corporates, which include well-known and very important basics like e-mail encryption and staff training. These two actions can prevent many cases of fraud attacks. E-mail encryption – knowing with whom you communicate by recognising their certificate – is an extremely helpful means for avoiding unwanted contacts from fraudsters. Similarly, given the high percentage of human involvement in fraud attacks, staff training is a key means in the fight against fraud. Lastly, applying technical controls like 4-eye-principle, 2-Factor authentication or call-back solutions for ensuring identity can strengthen these actions further.

The other side of the coin is financial institutions that process payment transactions. They are the last resort before a payment gets released and they have client-specific data at hand to apply automatic checks. While corporates can prevent fraud, financial institutions can detect it after a fraudulent payment was initiated but before the respective payment gets executed. This means that besides existing technical measures like secure communication and strong customer authentication, in future banks should take the next step and complement their services with intelligent payment fraud detection. Such detection should aim to assess not only payment details and individual payment history, but also device and behavioural irregularities via online channels, such as changes of geo location or browser version. A state-of-the-art customer service would enable corporates to get informed about such changes real-time or request for a hold or restriction of payments according to individual preferences and needs.

Such an extra layer of security offered by the banks, jointly with the effort within an organisation’s treasury and information security department, can create an encompassing protective shield going forward. Nonetheless it is important to understand there is no full protection against fraud attacks.

In addition to offering fraud prevention and detection services to their clients, banks should also step up their game in the protection of customer data. Deutsche Bank has established a comprehensive information and cyber security programme and organisation to implement controls and adhere to security policies and standards in accordance with evolving business requirements, regulatory guidance, and an emerging threat landscape.

Figure 2: Top six recommendations to clients on cybersecurity

 Source: Deutsche Bank

While addressing current challenges, companies must also consider what risks might potentially become major ones in the future. The main threats can change very quickly as bad actors adapt their tactics in response to new preventive measures.

Current trends indicate a decoupling of business and technology to some extent. The outsourcing of some business processes is inevitably accompanied by a degree of risk. So ask yourself what intellectual property are you giving away? Remember that treasurers are often privy to information that should remain confidential. All of the traditional threats – including identity theft, ransomware attack and denial of service– will continue. And given that scenario, every employee’s new best friend is their company’s chief information security officer (CISO).

Wade Bicknell is Deutsche Bank’s chief information security officer for the Americas and Vanessa Riemer is product manager for cash transaction surveillance