The document discusses internet banking security challenges and the need for cooperation. It notes that while internet banking is popular and growing, it also presents risks as an attractive target for cybercrime. The document outlines how banks cooperate with each other and authorities to combat fraud and cybercrime through security systems, monitoring, intelligence sharing, and communication. It also emphasizes the need for customer education on maintaining computer security and being wary of potential scams. Overall, the summary emphasizes that internet banking security is a concern that requires cooperation between banks, government, and customers.

1. Internetbanking security
challenges and co-operation
Patrick Wynant
Manager Banking Operations (Febelfin)
BISC | 6 December 2012

2. AGENDA
I. Evolution internetbanking
II. Co-operation:
• between banks
• with authorities
III. Communication towards customers
BISC | 6 December 2012

3. Internetbanking popular and growing
Simple – quick – comfort - cheap
• Attractive target for cybercrime
• Risks: financial, reputation, continuity…
• Maintain trust in this distribution channel
Subscriptions (in mio) Sessions (in mio)
500 460
9,0 8,1 425 432
450 401
8,0 7,4 383
6,6 400
7,0 350 309
5,7
6,0 300
4,6 221
5,0 250
3,8 179
4,0 3,0 200
3,0 2,4 150 108
1,8
2,0 100
1,0 50
0,0 0
2003 2004 2005 2006 2007 2008 2009 2010 2011 2003 2004 2005 2006 2007 2008 2009 2010 2011
BISC | 6 December 2012

4. Fraud evolution
Internetbanking remains very secure: 2 frauds / 1 million sessions
Re-imbursement
BISC | 6 December 2012

5. Internetbanking fraud in other countries
Belgium Netherlands UK
Year
(million EUR) (million EUR) (millon GBP)
2007 0,5 NA 22,6
2008 0,2 NA 52,5
2009 0,008 1,9 59,7
2010 0 9,8 46,7
2011 0,2 35 35,4
2012
0,7 27,3 21,6
(first semester)
BISC | 6 December 2012

6. Internetbanking fraud typology
Malware
• Malware infection on customer PC Fraudulous
• Man in the middle/browser “intermediates” credit
between customer & bank transfer
Money mules
Phishing
• Security email from “bank” requesting personal
information (eg phone nr.)
• Phone from “bank” requesting response codes Final beneficiary
or e-signatures
BISC | 6 December 2012

7. 6/10 citizens not concerned with computer security
BISC | 6 December 2012
Source: Unisys Security Index

8. 6/10 citizens: banks and government must protect
my personal data, not me
Source: Unisys Security Index
BISC | 6 December 2012

9. Combat cybercrime – sector co-operation
Banks
• Security systems (upgrading)
• Monitoring of higher risks
• Processing complaints
Febelfin
• Working groups
• Early warning system
• Intelligence sharing
• Sector communication
• Dialogue with external stakeholders
BISC | 6 December 2012

10. Combat cybercrime – external co-operation - Belgium
NBB > supervisor
Police – Federal Computer Crime Unit & Centrale dienst voor bestrijding van georganiseerde
economische & finaciële delinquentie > Complaints , Forensic analysis….
Parquet > prosecution
CERT.be > Federal cyber emergency team
Government > Consumer protection, combat fraud
Belgian CyberCrime Centre of Excellence for Training, Research & Education
BISC | 6 December 2012

11. Combat cybercrime – external co-operation - Europe
EPC - CISEG European Payment Council - Cybercrime Information
Sharing Expert Group
EPC - ISSG European Payment Council - Information Security
Support Group
EU FI-ISAC EU Financial Institutions – Information Sharing
Analysis Centre
EBF IT Fraud European Banking Federation – IT Fraud
ENISA European Network and Information Security Agency
EC3 European Cybercrime Centre
BISC | 6 December 2012

12. Clients
Banks
Internetbanking security is
a concern of all parties
BISC | 6 December 2012

13. BISC | 6 December 2012

14. The fraudster at work
5 fraud vectors
BISC | 6 December 2012

15. Security, an issue for my bank?
Veiligheid, een zaak van mijn bank ?
Wat de bank zoal doet om zowel internetbankieren als betalen via het internet
zo veilig mogelijk te laten verlopen is terug te vinden onder de rubriek
“veiligheid, een zaak van mijn bank”.
Beveiligde website
Gecodeerde informatie
Persoonlijke toegang
Elektronische handtekening
Automatische onderbreking van internetsessie
Automatische verbetering van de systemen voor internetbankieren
BISC | 6 December 2012

16. Security, also my business/concern?
Veiligheid, ook mijn zaak ?
De site zet bovendien alle tips op een rijtje waarmee de consument zelf kan
bijdragen aan de veiligheid van zijn online transacties. Deze tips & tricks zijn
terug te vinden onder de rubriek “veiligheid, ook mijn zaak”.
Beveiig je pc
Geef nooit telefonisch persoonlijke codes (geheime code & response code)
Geef enkel elektronische handtekening voor opdracht die u verwacht of zelf
hebt gevraagd
Zet bij twijfel de transactie onmiddellijk stop en contacteer de bank, zeker
wanneer het scenario om te ondertekenen afwijkt van het normale scenario
Controleer regelmatig je rekeninguitreksels
BISC | 6 December 2012

17. Veilig internetbankieren:
Febelfin lanceert YouTube film
www.safeinternetbanking.be Hogeschool Gent | 15 oktober 2012 17

18. The campaign: ask Dave!
• How the information on the internet paves the way for abuses
• Have you ever shared bank card code number by e-mail?
• Or maybe discussed the balance of your current account over Twitter?
• If so, you make an easy prey for internet fraudsters.
• Febelfin hired the services of Dave to do the test.
http://www.febelfin.be/en/campaign-ask-dave
http://dvlgll.me/PB5dZw
BISC | 6 December 2012

19. YouTube Film veilig internetbankieren
Hogeschool Gent | 15 oktober 2012 19

20. YouTube Film veilig internetbankieren
Ruim
5 miljoen
kijkers op
Twee dagen
twee weken
lang de
tijd
meest
gesharede
video ter
wereld
Hogeschool Gent | 15 oktober 2012 20

21. Continuous awareness
communication
- by banks
- by Febelfin
- testimonial launch today
- Private-Public-Partnership (PPP) ?
…..
BISC | 6 December 2012

22. www.febelfin.be