Download

We have all seen the figures placed on the cost of fraud and cyberattacks to businesses and the economy with the projected costs to reach $2 trillion by 2019.1 Less sensational than its financial implications, though, but far more disruptive, are the reputational damage and the business impact that arise in the aftermath of successful attacks. Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organisations from such dangers, especially considering that threats and attacks are continuing unabated as the methods of fraudsters and attackers evolve and change to reach their ends. Available data indicates that instances of fraud and cybersecurity attacks are increasing not just in frequency but in severity and impact. Companies that fail to ensure that their employees are fully trained to recognise and tack action against this using adequate security processes, procedures and protocols, therefore, not only face a greater risk of financial loss, which includes loss of assets, but a greater risk of reputational damage and business disruption, which includes negative publicity. How has the fraud landscape changed? Fraud and cybersecurity threats continue to evolve as better organised and more sophisticated attackers have emerged. As illustrated in diagram 1, fraudsters and cyber attackers have become much more sophisticated in recent years. There has been a noticeable shift in the profile of those behind attacks. In the past, attackers were primarily individuals operating on an opportunistic, casual or ad hoc basis, largely driven by the desire to prove that they could successfully carry out a fraud attack. Acting alone or in collusion to commit internal or external fraud, fraudsters increasingly perpetrate acts that are focused on disruption and destruction. Today, attackers are highly organised syndicates and criminal enterprises that are managed in a similar way to businesses. These criminal enterprises are typically well organised and, importantly, well funded. Their motives are primarily for financial gain but in some instances for geopolitical gain. These fraudsters are also increasingly focused on disruption and destruction. There is also the risk of internal fraud and similarly internal fraud may be undertaken by an opportunistic individual or by an employee who operates in collusion with an organised criminal group. Diagram 2 shows the changing nature of the various aspects of a fraud or cybersecurity attack. Most notably, attacks are becoming increasingly targeted with fraudsters undertaking a large amount of research and planning prior to attempting an attack. Attempted attacks have also moved from a pattern of one-off, opportunistic attacks to targeted, planned and continuous attacks. Attackers will continue their attempts on one target if there is a chance of success. Attack methods are also continuously evolving and adapting to overcome the defences that organisations create. Unsurprisingly, there has been a growth in the use of technology by fraudsters. Attack methods tend to target weaknesses in technology and in human nature and in some instances both. It is for this reason that it is so important to frequently review internal procedures and processes and to ensure that all employees are fully trained and aware of their responsibilities in the event of an attempted attack.

We have all seen the figures placed on the cost of fraud and cyberattacks to businesses and the economy with the projected costs to reach $2 trillion by 2019.1 Less sensational than its financial implications, though, but far more disruptive, are the reputational damage and the business impact that arise in the aftermath of successful attacks.
Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organisations from such dangers, especially considering that threats and attacks are continuing unabated as the methods of fraudsters and attackers evolve and change to reach their ends. 
Available data indicates that instances of fraud and cybersecurity attacks are increasing not just in frequency but in severity and impact. Companies that fail to ensure that their employees are fully trained to recognise and tack action against this using adequate security processes, procedures and protocols, therefore, not only face a greater risk of financial loss, which includes loss of assets, but a greater risk of reputational damage and business disruption, which includes negative publicity. 
How has the fraud landscape changed? 
Fraud and cybersecurity threats continue to evolve as better organised and more sophisticated attackers have emerged. As illustrated in diagram 1, fraudsters and cyber attackers have become much more sophisticated in recent years. There has been a noticeable shift in the profile of those behind attacks. 
<blockquote>
In the past, attackers were primarily individuals operating on an opportunistic, casual or ad hoc basis, largely driven by the desire to prove that they could successfully carry out a fraud attack. 
</blockquote>
Acting alone or in collusion to commit internal or external fraud, fraudsters increasingly perpetrate acts that are focused on disruption and destruction.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618e9e392639e9726b32554a.png" />
Today, attackers are highly organised syndicates and criminal enterprises that are managed in a similar way to businesses. These criminal enterprises are typically well organised and, importantly, well funded. Their motives are primarily for financial gain but in some instances for geopolitical gain. These fraudsters are also increasingly focused on disruption and destruction. There is also the risk of internal fraud and similarly internal fraud may be undertaken by an opportunistic individual or by an employee who operates in collusion with an organised criminal group.
Diagram 2 shows the changing nature of the various aspects of a fraud or cybersecurity attack. Most notably, attacks are becoming increasingly targeted with fraudsters undertaking a large amount of research and planning prior to attempting an attack. Attempted attacks have also moved from a pattern of one-off, opportunistic attacks to targeted, planned and continuous attacks. Attackers will continue their attempts on one target if there is a chance of success.
Attack methods are also continuously evolving and adapting to overcome the defences that organisations create. Unsurprisingly, there has been a growth in the use of technology by fraudsters. Attack methods tend to target weaknesses in technology and in human nature and in some instances both. It is for this reason that it is so important to frequently review internal procedures and processes and to ensure that all employees are fully trained and aware of their responsibilities in the event of an attempted attack.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618e9e982639e9726b32554e.png" />
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organizations from such dangers.

An Overview of Fraud and Cybersecurity

Working remotely from home offers undeniable perks — such as zero commute and a more flexible schedule. However, while every day may be casual Friday, one thing you can't take lightly is online security. If you're working from home temporarily or permanently, knowing how to protect yourself from cybercrime belongs at the top of your daily to-do list. You take steps to protect your personal information online, and your home office should be a priority, too. But first, you need to understand the most important steps to take — and the biggest security risks to watch out for — when working remotely. Working remotely can boost your fraud risk profile You may not think twice about logging on to your computer or mobile device for work, but doing so can put you at risk for fraud in more ways than one. That's because it's easier to hack people than machines, says Nic White, global fraud prevention head for Citi Commercial Bank. “Cybersecurity has improved significantly over recent years, so criminals are increasingly targeting people, tricking them into voluntarily handing over information or sending a payment to an unintended beneficiary,” White says. For example, White says one of the most popular tactics used by fraudsters is business email compromise (BEC) scams. These rely on the use of seemingly legitimate-looking emails to defraud remote workers and small business owners. BEC scam victims unknowingly send money transfers to criminals, believing the recipients are legitimate business contacts. If you find you're interfacing more with business contacts who are working out of the office, be especially watchful against BEC scams, as fraudsters might use the pretense of remote work as a reason you need to suddenly send payments or funds to a new and unfamiliar account. Click here to view the report in full.

Working remotely from home offers undeniable perks &mdash; such as zero commute and a more flexible schedule.
<hr style="font-size: medium;" />
However, while every day may be casual Friday, one thing you can't take lightly is online security.
If you're working from home temporarily or permanently, knowing how to protect yourself from cybercrime belongs at the top of your daily to-do list. You take steps to protect your personal information online, and your home office should be a priority, too.
But first, you need to understand the most important steps to take &mdash; and the biggest security risks to watch out for &mdash; when working remotely.
Working remotely can boost your fraud risk profile
You may not think twice about logging on to your computer or mobile device for work, but doing so can put you at risk for fraud in more ways than one.
That's because it's easier to hack people than machines, says Nic White, global fraud prevention head for Citi Commercial Bank.
&ldquo;Cybersecurity has improved significantly over recent years, so criminals are increasingly targeting people, tricking them into voluntarily handing over information or sending a payment to an unintended beneficiary,&rdquo; White says.
For example, White says one of the most popular tactics used by fraudsters is business email compromise (BEC) scams. These rely on the use of seemingly legitimate-looking emails to defraud remote workers and small business owners. BEC scam victims unknowingly send money transfers to criminals, believing the recipients are legitimate business contacts.
If you find you're interfacing more with business contacts who are working out of the office, be especially watchful against BEC scams, as fraudsters might use the pretense of remote work as a reason you need to suddenly send payments or funds to a new and unfamiliar account.
<a href="https://www.lifeandmoney.citi.com/money/finance-101/home-office-business-scams" target="_blank" rel="noopener">Click here to view the report in full.</a>
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

Working from home offers undeniable perks, but it can also introduce new fraud risks. Learn about the scams targeting remote workers.

Working Remotely? Be Aware of these Home Office Scams

<a href="https://www.citibank.com/commercialbank/solutions/fraud_prevention/assets/pdf/Guidance_How_to_Combat_Fraud.pdf"><img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ec83248c69b5e11ebcb7e.png" />Click Infographic to Enlarge</a>
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

Fraudsters exploit human psychology and other social engineering tactics in an attempt to commit fraud. Be vigilant: recognizing signs of fraud is the most effective way to combat it.

How to Combat Fraud

Look-alike and hacked emails are helping fraudsters steal billions of dollars. While awareness is growing, the scams are also evolving and there are a few common misconceptions that are leaving businesses vulnerable. Companies around the world have been suffering from a fraud scheme known as a Business Email Compromise (BEC). The scam sees a cybercriminal pose as a known business contact and send a forged email requesting their victim to make a payment to a new beneficiary. While the attacks may sound simplistic, $1.9 billion of fraud losses have been attributed to this type of fraud in 2020*. During a typical BEC attack, a cybercriminal will use a hacked or look-alike email account to impersonate an Executive within your company or one of your existing suppliers. Before they send the email, the attacker will spend many months studying your business, so the timing, content and tone of the message will often appear normal. Because these types of attacks have been around for a few years, awareness of the scam has increased, and businesses have started to strengthen their defences. But as businesses have evolved, the scam has too, and fraudsters are changing their tactics to try to avoid detection. Here are three of the most common misconceptions about BEC, which are based upon earlier versions of the scam: Executive impersonation is the primary risk During the early years, most BEC cases involved the attacker impersonating a CEO, CFO or another internal Executive. While this threat has not completely gone away, the overwhelming majority of BEC cases now see the attacker pose as one of your existing suppliers. As you already make regular payments to your vendors, the attacker no longer has to convince their victim of the need for the payment, they simply need to create a good reason for the payment to be sent to a new bank account. The emails will be unsolicited and easy to spot Many people assume that a BEC attempt will arrive via a new email request, much like cold calling over the telephone. While this may previously have been true, the attackers now try to intercept and manipulate an existing email conversation, rather than initiating a fresh request. In the supply chain scenario, the attackers will hijack an email about an existing order (regularly after the down-payment has already been made) and then ask that their payment details be updated. The attackers will try to avoid prolonged dialogue In the Executive scenario, the fraudsters would often send a single payment request, together with a reason why they couldn’t be contacted – such as being in an important meeting or about to board a flight. These standalone (and normally ad-hoc) requests often looked suspicious and so the fraudsters have started to refine their approach. It is now common to see numerous emails between the fraudster and victim, which are designed to build rapport, develop the cover story and even create the opportunity for a second or third attempt. In the supplier scenario, we have even seen cases where the fraudster is having simultaneous conversations with both the supplier and buyer (in both cases impersonating the other party), which allows them to gather additional information, answer any questions and improve the credibility of the request. While the attacks have continued to evolve, the most effective controls to combat BEC have remained consistent. If you want to protect your business, there are three simple steps which will help reduce your susceptibility to an attack: Call Backs - If you ever receive an email requesting a payment to be sent to a new beneficiary, pick up the telephone and call the sender back to confirm the request. It’s important to use a previously known telephone number, rather than using any numbers that are given in the body/signature of the email. Dual Approval- Whenever you need to add a new payee, or change existing payment details, configure your systems to require an approver/checker. An extra set of eyes significantly improves your chances of spotting anything untoward. Training - Ensure your staff is aware of risk. Most people have naturally good instincts, but need to understand what BEC is, before they are able to look out for it. If you suspect you have fallen victim to BEC, contact your Citi Service Representative as quickly as possible so we can help to protect your account and attempt to recover any lost funds. Your security is our priority.

Look-alike and hacked emails are helping fraudsters steal billions of dollars. While awareness is growing, the scams are also evolving and there are a few common misconceptions that are leaving businesses vulnerable.
Companies around the world have been suffering from a fraud scheme known as a Business Email Compromise (BEC). The scam sees a cybercriminal pose as a known business contact and send a forged email requesting their victim to make a payment to a new beneficiary. While the attacks may sound simplistic, $1.9 billion of fraud losses have been attributed to this type of fraud in 2020*.
 During a typical BEC attack, a cybercriminal will use a hacked or look-alike email account to impersonate an Executive within your company or one of your existing suppliers. Before they send the email, the attacker will spend many months studying your business, so the timing, content and tone of the message will often appear normal.
 Because these types of attacks have been around for a few years, awareness of the scam has increased, and businesses have started to strengthen their defences. But as businesses have evolved, the scam has too, and fraudsters are changing their tactics to try to avoid detection. Here are three of the most common misconceptions about BEC, which are based upon earlier versions of the scam:
Executive impersonation is the primary risk During the early years, most BEC cases involved the attacker impersonating a CEO, CFO or another internal Executive. While this threat has not completely gone away, the overwhelming majority of BEC cases now see the attacker pose as one of your existing suppliers. As you already make regular payments to your vendors, the attacker no longer has to convince their victim of the need for the payment, they simply need to create a good reason for the payment to be sent to a new bank account.
The emails will be unsolicited and easy to spot Many people assume that a BEC attempt will arrive via a new email request, much like cold calling over the telephone. While this may previously have been true, the attackers now try to intercept and manipulate an existing email conversation, rather than initiating a fresh request. In the supply chain scenario, the attackers will hijack an email about an existing order (regularly after the down-payment has already been made) and then ask that their payment details be updated.
The attackers will try to avoid prolonged dialogue In the Executive scenario, the fraudsters would often send a single payment request, together with a reason why they couldn&rsquo;t be contacted &ndash; such as being in an important meeting or about to board a flight. These standalone (and normally ad-hoc) requests often looked suspicious and so the fraudsters have started to refine their approach. It is now common to see numerous emails between the fraudster and victim, which are designed to build rapport, develop the cover story and even create the opportunity for a second or third attempt. In the supplier scenario, we have even seen cases where the fraudster is having simultaneous conversations with both the supplier and buyer (in both cases impersonating the other party), which allows them to gather additional information, answer any questions and improve the credibility of the request.
<blockquote style="box-sizing: border-box; margin: 0px 0px 1em; font-size: 14px; text-align: left; background-color: #ffffff;">
While the attacks have continued to evolve, the most effective controls to combat BEC have remained consistent. If you want to protect your business, there are three simple steps which will help reduce your susceptibility to an attack:
</blockquote>
Call Backs -&nbsp;If you ever receive an email requesting a payment to be sent to a new beneficiary, pick up the telephone and call the sender back to confirm the request. It&rsquo;s important to use a previously known telephone number, rather than using any numbers that are given in the body/signature of the email.
Dual Approval- &nbsp;Whenever you need to add a new payee, or change existing payment details, configure your systems to require an approver/checker. An extra set of eyes significantly improves your chances of spotting anything untoward. 
Training -&nbsp;Ensure your staff is aware of risk. Most people have naturally good instincts, but need to understand what BEC is, before they are able to look out for it.
If you suspect you have fallen victim to BEC, contact your Citi Service Representative as quickly as possible so we can help to protect your account and attempt to recover any lost funds. Your security is our priority.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/61855b1d8125120a26c03b27.png" alt="image_40428465531636129563528.png/" />
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

Awareness of Business Email Compromise is growing, but the scams are also evolving, leaving businesses vulnerable to attack. Learn more about some of the common misconceptions.

Business Email Compromise

Contributor: Elif Kayhan (Global Fraud Risk Management Senior Vice President)
What is Dual Approval?
As the name implies, Dual Approval is a control that requires two separate individuals to authorize a transaction. The first person is responsible for creating the request (known as the &lsquo;maker&rsquo;), while the second checks and approves the activity (known as the &lsquo;checker&rsquo;).
Why is Dual Approval important?
Humans are not perfect. It does not matter how clever, trusted, or trained we are&mdash; sooner or later everybody will make a mistake. A maker-checker process introduces a second pair of eyes and helps to spot things that appear suspicious, strange, or otherwise incorrect. Dual Approval helps protect your business, but it also helps safeguard your employees from making unintended errors or deviating from approved process.
How does it work?
Dual Approval is quick and easy to set up, and it is offered at no additional cost on all of Citi Commercial Bank&rsquo;s online platforms. The functionality is fully customizable, giving you the ability to configure the process flow, assign approvers, and approval limits to meet the individual needs of your business.
Once Dual Approval has been enabled, any eligible transactions will be transferred to a pre-selected pool of checkers for authorization. The process is secure, and the approver can simply verify the request on an independent device (desktop, tablet or phone) and releases the transaction.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ec2bf9236c83314de0203.png">
What are the benefits of Dual Approval?
Adding Dual Approval can help strengthen your online controls and protect your business from several different types of operational risk:
<ul type="disc">
<li>Payment Scams:&nbsp;Payment fraud is a growing risk, and criminals continue to deploy increasingly clever scams. While a fraudster may be able to trick an individual (with an email, phone or text message scam), a system-enforced checker ensures that a second person reviews the transaction and can help capture the attempt before any money leaves your account.</li>
</ul>
<ul type="disc">
<li>Compromised Credentials:&nbsp;Fraudsters are using advanced techniques to steal people&rsquo;s usernames and passwords, before logging into their victims&rsquo; accounts and diverting funds. Even if a criminal was able to compromise one of your online user&rsquo;s credentials, Dual Approval would help stop the attacker from being able to make a withdrawal.</li>
</ul>
<ul type="disc">
<li>Processing Errors:&nbsp;A checker can help spot a variety of mistakes, from breaches of internal procedure to typing errors on the account number or the value of a transfer.</li>
</ul>
<ul type="disc">
<li>Internal Fraud:&nbsp;While all businesses want to be able to trust their staff, the reality is that a significant number of companies have been defrauded by an employee. External pressures and/ or unexpected opportunities can lead a previously trusted staff member into making a poor ethical decision. Dual Approval helps mitigate this risk by acting as an effective deterrent while also providing an opportunity for any wrongdoing to be identified early in the process.</li>
</ul>
Common Questions
If I have full confidence in my team, do I really need Dual Approval?
Even the most diligent of employees can make a mistake or be tricked by a fraudster. The majority of payments fraud is now completed by large, professional criminal organisations that use advanced tactics to deceive honest and trustworthy employees.
I don&rsquo;t have enough staff to check everything.
Dual Approval is fully customizable, so you can choose exactly what transactions you want to send for authorization. You have the ability to design the control to fit your business and balance the volume of approval requests by restricting the types of transactions and/or values that require checking.
What happens if an approver is busy, on holiday or off sick?
As with any business process, contingency planning is critical. When you set up Dual Approval, you can nominate a pool of checkers. It is recommended to try to nominate a minimum of three approvers for each eligible transaction.
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights" data-link-source="tiny"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/"></a>

Dual Approval is one of the most important online controls, yet the concept remains foreign to many businesses. Learn more about why it matters.

Why Dual Approval Matters

Estelle Shaw-Latimer

Nic White

About three-quarters of organizations were targets of a payments fraud attack in 2020.3 And the number of zero days, or previously unknown security vulnerabilities, in 2021 was almost double the total in 2020.4 Cybercrime is now truly global: many U.S attacks are actioned from the other side of the globe, making prosecution difficult. “While the shift to remote working during COVID-19 increased the world’s vulnerability, the volume of cyberattacks has grown steadily for many years,” explains Ann Barron-DiCamillo, Global Head of Cyber Operations at Citi. “One reason is that there is greater information sharing among cyber criminals than in the past, when sophisticated techniques were only available to nation state actors; now they are available as a service on the dark web. As importantly, the cost of infrastructure is now so low that it can simply be abandoned once a threat has been identified and made non-malicious” A recent poll of almost 200 Citi Commercial Bank clients conducted during a webinar showed that cybercrime is a major concern for companies: 56% of respondents said they were very concerned while 40% were reasonably concerned. Given the changes in the threat landscape and the increasing number of businesses targeted by cybercrime – PwC’s Global Economic Crime and Fraud Survey showed that 47% of businesses globally (and 56% in the U.S.) have lost money to fraud in the last two years5 – the level of awareness among companies and the importance they ascribe to cybersecurity, is reassuring. What are the threats – and how are they changing? Although the cyber threat landscape continually evolves, many of the types of techniques deployed by fraudsters have now been used for many years. For instance, business email compromise (where a criminal attempts to trick someone into transferring funds) is a long-standing favorite of cyber criminals. “What has changed is the scale of the information available on the dark web, which gives criminals a greater ability to deploy such practices,” says John Brosnan, Director of Investigations, Citi Security and Investigative Services, North America. The Citi webinar client poll showed that companies are most worried about business email compromise (77%) and phishing/social engineering (65%)*. Phishing exploits human error to harvest credentials or spread malware, usually via infected email attachments; social engineering is where a criminal impersonates a supplier or executive in order to have funds transferred to their account. What is notable about these two top threats is that they ‘hack’ people rather than technology. Cyber criminals understandably focus on the easiest available target. As companies have invested more in cyber protection, human targets have become relatively more vulnerable and therefore attractive. Activity such as business email compromise and social engineering have become prevalent because of their profitability and the ability of threat actors to cover their tracks. “An individual can send a fictitious email changing invoice instructions, quickly convert it to cryptocurrency and put it into an offline cold storage wallet: it is extremely difficult to trace and investigate such a theft,” explains Brosnan. Given its relative anonymity, crypto now plays a major role in cybercrime. Data breaches, selected by 57% of poll respondents as a key concern, can cause serious reputational damage to companies. One reason for the growing prevalence of data breaches and leakage is increased use of the cloud. However, it is not cloud technology that is most often at fault: about 70% of cases are due to misconfigurations and the failure to implement controls, such as multifactor authentication (MFA) or restrict administration privileges. Companies need to ensure that they design robust controls to manage their data, and implement them in a uniform way regardless of whether they are storing on site, in the cloud, or utilizing a third party. Ransomware attacks, such as the Colonial pipeline operation, which resulted in disrupted fuel supplies in parts of the U.S. after the firm opted to shut down the system following a cyberattack, were cited as the greatest cybercrime concern by 41% of poll respondents. Average ransom payments have doubled in 2021 – the returns available are prompting more threat actors to use ransomware. Moreover, ransomware is now available as a service on the dark web, lowering costs for criminals and making attacks relatively straightforward to implement. Increasingly, cyber criminals are threatening immediate action if companies engage with law enforcement or employ professional negotiators. Large companies are obviously an attractive target given the potential rewards on offer. But small and medium-size enterprises – such as healthcare providers – tend to be more vulnerable and are therefore more frequently targeted. Cyber criminals often do reconnaissance that allows them to establish vulnerabilities and companies with inadequate backups and therefore be more willing to pay out when their data is compromised). Similarly, cyber criminals often research companies’ cyber insurance (possibly by compromising an insider’s credentials), to establish credible ransom demands. Companies need to assess the vulnerability of their applications and, crucially, establish comprehensive training for employees so that they do not click on suspicious links or download questionable files. Are companies doing enough? The webinar poll of Citi Commercial Bank clients showed that companies have implemented a range of measures to protect them against fraud and cybercrime, including internal procedures and policies (86%), dual approvals and controls (75%), staff training and education (73%), and segregation of duties (72%). Other options, such as account reconciliation, employee entitlements, and security and verification calls scored less highly. Certainly, internal procedures and policies are crucial in the fight against cybercrime. Dual approval is also critically important; everyone is capable of making a mistake and a quick check by a second pair of eyes can eliminate many errors. Equally, training about risks is essential. People can often intuitively detect when something is right or wrong but without sufficient education, they may not act on the warning signs and threats can be overlooked. However, it is important to match controls to specific threats. For example, with regards to business email compromise, which is perceived by Citi clients to be the number one risk, the most effective control is a telephone call-back to verify the request. But this was not seen by poll respondents as a priority. Callback verification is quick and straightforward but extremely effective. Despite this, one survey of small and medium-size enterprises in the U.K. showed that five in every 10 businesses did not call back while two in 10 called the (potentially false) number supplied in the email. Just three businesses in 10 bothered to call a known and verified telephone number – sourced independently on the internet, for instance – before authorizing a payee change request. In the poll, Citi clients said that increased staffing needs (42%) and increased time or delay (39%) were the main reasons why they have not implemented additional controls; other factors such as costs or customer experience were perceived to be of lower importance, while 35% of respondents said they were happy with their current arrangements. “Implementing cybersecurity measures always has to be balanced against internal challenges,” says Barron-DiCamillo. “That’s why prioritization and partnerships across the organization, between technology and the business for instance, are so important.” New controls can create noise in a company’s system without necessarily improving its ability to respond to cyber threats; it is important to ensure that when more sophisticated controls such as threat intelligence data are deployed, processes are put in place to analyze and utilize the information they generate. Equally, companies need to consider whether it could be more efficient, and cost effective, to use a managed service provider rather than doing everything internally. How Citi is responding to cyber threats Getting the basics right is a key priority for Citi in order to protect its network and clients. Significant attention is paid to restricting administrator credentials, leveraging Multi-Factor Authentication (MFA), deploying content management tools, ensuring segmentation across networks, imposing restrictions on USBs, and sharing information about internet threats across the organization. Citi also partners with other financial institutions and the wider ecosystem to share information. Citi has a team of investigators in North America that work around the clock – and coordinate with teams around the world, given the global nature of cybercrime – to identify and eliminate cyber threats to the bank and clients. “In 2020 alone, these investigators were responsible for recovering $100 million in assets for clients,” says Brosnan. “At the same time, a key part of the team’s role is to educate clients about the nature of the tactics being utilized by criminals.” Citi invests heavily in a wide range of new technology, developing numerous cyber security solutions that leverage artificial intelligence, machine learning and even quantum computing, in its global Innovation Labs and through investments in start-ups via Citi Ventures. Recent innovations include endpoint detection and response, which monitors data in real time and automatically analyzes and responds, and data loss protection solutions. Another important focus in recent years has been behavioral biometrics software, which not only improves security but can enhance client experience. For many years, Citi has deployed technology that can check whether a client is using their regular device to logon and whether their IP address is familiar. Key takeaways Develop an appropriate control strategy: Appropriate controls and capabilities for each of the many cyberthreats faced by companies not only help to avoid risk, but should an attack be successful will ensure that cyber insurance pays out. Education and training about risks and how to respond are especially important as employees are a company’s first line of defense; companies also need to encourage a culture where employees know they will be supported when they raise a concern. Planning and preparation are crucial: If something goes wrong, companies need to know in advance who they should engage with internally and externally, and what information they will need to share with them. It is critical that companies do not find themselves making decisions after an attack. Take a holistic view of costs: Preparation, planning, controls, training and the many other components of a robust cyber security strategy necessarily requires investment. But a single ransomware attack, for instance, can be devastating to a company financially due to loss of business and reputational risk. In the long-term, prevention is always better than cure. 1 https://www.mcafee.com/enterprise/en-us/assets/reports/rp-hidden-costs-of-cybercrime.pdf 2 https://www.fbi.gov/news/stories/ic3-logs-6-million-complaints-051721 3 https://www.jpmorgan.com/content/dam/jpm/commercial-banking/documents/fraud-protection/2021-afp-payments-fraud-and-control-survey-report-highlights.pdf 4 https://www.technologyreview.com/2021/09/23/1036140/2021-record-zero-day-hacks-reasons/ 5 https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crime-and-fraud-survey-2020.pdf *Some polls allowed respondents to choose more than one answer

About three-quarters of organizations were targets of a payments fraud attack in 2020.3&nbsp;And the number of zero days, or previously unknown security vulnerabilities, in 2021 was almost double the total in 2020.4&nbsp;Cybercrime is now truly global: many U.S attacks are actioned from the other side of the globe, making prosecution difficult.
&ldquo;While the shift to remote working during COVID-19 increased the world&rsquo;s vulnerability, the volume of cyberattacks has grown steadily for many years,&rdquo; explains Ann Barron-DiCamillo, Global Head of Cyber Operations at Citi. &ldquo;One reason is that there is greater information sharing among cyber criminals than in the past, when sophisticated techniques were only available to nation state actors; now they are available as a service on the dark web. As importantly, the cost of infrastructure is now so low that it can simply be abandoned once a threat has been identified and made non-malicious&rdquo;
A recent poll of almost 200 Citi Commercial Bank clients conducted during a webinar showed that cybercrime is a major concern for companies: 56% of respondents said they were very concerned while 40% were reasonably concerned. Given the changes in the threat landscape and the increasing number of businesses targeted by cybercrime &ndash; PwC&rsquo;s Global Economic Crime and Fraud Survey showed that 47% of businesses globally (and 56% in the U.S.) have lost money to fraud in the last two years5&nbsp;&ndash; the level of awareness among companies and the importance they ascribe to cybersecurity, is reassuring.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/61a5074c97209b4bf9852223.png" />
What are the threats &ndash; and how are they changing?
Although the cyber threat landscape continually evolves, many of the types of techniques deployed by fraudsters have now been used for many years. For instance, business email compromise (where a criminal attempts to trick someone into transferring funds) is a long-standing favorite of cyber criminals. &ldquo;What has changed is the scale of the information available on the dark web, which gives criminals a greater ability to deploy such practices,&rdquo; says John Brosnan, Director of Investigations, Citi Security and Investigative Services, North America.
The Citi webinar client poll showed that companies are most worried about business email compromise (77%) and phishing/social engineering (65%)*. Phishing exploits human error to harvest credentials or spread malware, usually via infected email attachments; social engineering is where a criminal impersonates a supplier or executive in order to have funds transferred to their account.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/61a50793b20a74094cc46220.png" />
What is notable about these two top threats is that they &lsquo;hack&rsquo; people rather than technology. Cyber criminals understandably focus on the easiest available target. As companies have invested more in cyber protection, human targets have become relatively more vulnerable and therefore attractive. Activity such as business email compromise and social engineering have become prevalent because of their profitability and the ability of threat actors to cover their tracks. &ldquo;An individual can send a fictitious email changing invoice instructions, quickly convert it to cryptocurrency and put it into an offline cold storage wallet: it is extremely difficult to trace and investigate such a theft,&rdquo; explains Brosnan. Given its relative anonymity, crypto now plays a major role in cybercrime.
Data breaches, selected by 57% of poll respondents as a key concern, can cause serious reputational damage to companies. One reason for the growing prevalence of data breaches and leakage is increased use of the cloud. However, it is not cloud technology that is most often at fault: about 70% of cases are due to misconfigurations and the failure to implement controls, such as multifactor authentication (MFA) or restrict administration privileges. Companies need to ensure that they design robust controls to manage their data, and implement them in a uniform way regardless of whether they are storing on site, in the cloud, or utilizing a third party.
Ransomware attacks, such as the Colonial pipeline operation, which resulted in disrupted fuel supplies in parts of the U.S. after the firm opted to shut down the system following a cyberattack, were cited as the greatest cybercrime concern by 41% of poll respondents. Average ransom payments have doubled in 2021 &ndash; the returns available are prompting more threat actors to use ransomware. Moreover, ransomware is now available as a service on the dark web, lowering costs for criminals and making attacks relatively straightforward to implement. Increasingly, cyber criminals are threatening immediate action if companies engage with law enforcement or employ professional negotiators.
Large companies are obviously an attractive target given the potential rewards on offer. But small and medium-size enterprises &ndash; such as healthcare providers &ndash; tend to be more vulnerable and are therefore more frequently targeted. Cyber criminals often do reconnaissance that allows them to establish vulnerabilities and companies with inadequate backups and therefore be more willing to pay out when their data is compromised). Similarly, cyber criminals often research companies&rsquo; cyber insurance (possibly by compromising an insider&rsquo;s credentials), to establish credible ransom demands. Companies need to assess the vulnerability of their applications and, crucially, establish comprehensive training for employees so that they do not click on suspicious links or download questionable files.
&nbsp;
Are companies doing enough?
The webinar poll of Citi Commercial Bank clients showed that companies have implemented a range of measures to protect them against fraud and cybercrime, including internal procedures and policies (86%), dual approvals and controls (75%), staff training and education (73%), and segregation of duties (72%). Other options, such as account reconciliation, employee entitlements, and security and verification calls scored less highly.
Certainly, internal procedures and policies are crucial in the fight against cybercrime. Dual approval is also critically important; everyone is capable of making a mistake and a quick check by a second pair of eyes can eliminate many errors. Equally, training about risks is essential. People can often intuitively detect when something is right or wrong but without sufficient education, they may not act on the warning signs and threats can be overlooked.
However, it is important to match controls to specific threats. For example, with regards to business email compromise, which is perceived by Citi clients to be the number one risk, the most effective control is a telephone call-back to verify the request. But this was not seen by poll respondents as a priority. Callback verification is quick and straightforward but extremely effective. Despite this, one survey of small and medium-size enterprises in the U.K. showed that five in every 10 businesses did not call back while two in 10 called the (potentially false) number supplied in the email. Just three businesses in 10 bothered to call a known and verified telephone number &ndash; sourced independently on the internet, for instance &ndash; before authorizing a payee change request.
In the poll, Citi clients said that increased staffing needs (42%) and increased time or delay (39%) were the main reasons why they have not implemented additional controls; other factors such as costs or customer experience were perceived to be of lower importance, while 35% of respondents said they were happy with their current arrangements. &ldquo;Implementing cybersecurity measures always has to be balanced against internal challenges,&rdquo; says Barron-DiCamillo. &ldquo;That&rsquo;s why prioritization and partnerships across the organization, between technology and the business for instance, are so important.&rdquo;
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/61a50776b20a74094cc4621c.png" />
New controls can create noise in a company&rsquo;s system without necessarily improving its ability to respond to cyber threats; it is important to ensure that when more sophisticated controls such as threat intelligence data are deployed, processes are put in place to analyze and utilize the information they generate. Equally, companies need to consider whether it could be more efficient, and cost effective, to use a managed service provider rather than doing everything internally.
&nbsp;
How Citi is responding to cyber threats
Getting the basics right is a key priority for Citi in order to protect its network and clients. Significant attention is paid to restricting administrator credentials, leveraging Multi-Factor Authentication (MFA), deploying content management tools, ensuring segmentation across networks, imposing restrictions on USBs, and sharing information about internet threats across the organization. Citi also partners with other financial institutions and the wider ecosystem to share information.
Citi has a team of investigators in North America that work around the clock &ndash; and coordinate with teams around the world, given the global nature of cybercrime &ndash; to identify and eliminate cyber threats to the bank and clients. &ldquo;In 2020 alone, these investigators were responsible for recovering $100 million in assets for clients,&rdquo; says Brosnan. &ldquo;At the same time, a key part of the team&rsquo;s role is to educate clients about the nature of the tactics being utilized by criminals.&rdquo;
Citi invests heavily in a wide range of new technology, developing numerous cyber security solutions that leverage artificial intelligence, machine learning and even quantum computing, in its global Innovation Labs and through investments in start-ups via Citi Ventures. Recent innovations include endpoint detection and response, which monitors data in real time and automatically analyzes and responds, and data loss protection solutions.
Another important focus in recent years has been behavioral biometrics software, which not only improves security but can enhance client experience. For many years, Citi has deployed technology that can check whether a client is using their regular device to logon and whether their IP address is familiar.
&nbsp;
Key takeaways
<ul type="disc">
<li>Develop an appropriate control strategy: Appropriate controls and capabilities for each of the many cyberthreats faced by companies not only help to avoid risk, but should an attack be successful will ensure that cyber insurance pays out. Education and training about risks and how to respond are especially important as employees are a company&rsquo;s first line of defense; companies also need to encourage a culture where employees know they will be supported when they raise a concern.</li>
<li>Planning and preparation are crucial: If something goes wrong, companies need to know in advance who they should engage with internally and externally, and what information they will need to share with them. It is critical that companies do not find themselves making decisions after an attack.</li>
<li>Take a holistic view of costs: Preparation, planning, controls, training and the many other components of a robust cyber security strategy necessarily requires investment. But a single ransomware attack, for instance, can be devastating to a company financially due to loss of business and reputational risk. In the long-term, prevention is always better than cure.</li>
</ul>
1 <ins cite="mailto:Chadha,%20Shivani%20[ICG-CCB]" datetime="2021-11-09T00:25"><a style="text-decoration: underline;" href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-hidden-costs-of-cybercrime.pdf" target="_blank" rel="noopener">https://www.mcafee.com/enterprise/en-us/assets/reports/rp-hidden-costs-of-cybercrime.pdf</a> </ins>
2 <ins cite="mailto:Chadha,%20Shivani%20[ICG-CCB]" datetime="2021-11-09T00:25"><a style="text-decoration: underline;" href="https://www.fbi.gov/news/stories/ic3-logs-6-million-complaints-051721" target="_blank" rel="noopener">https://www.fbi.gov/news/stories/ic3-logs-6-million-complaints-051721</a> </ins>
3 <ins cite="mailto:Chadha,%20Shivani%20[ICG-CCB]" datetime="2021-11-09T00:25"><a style="text-decoration: underline;" href="https://www.jpmorgan.com/content/dam/jpm/commercial-banking/documents/fraud-protection/2021-afp-payments-fraud-and-control-survey-report-highlights.pdf" target="_blank" rel="noopener">https://www.jpmorgan.com/content/dam/jpm/commercial-banking/documents/fraud-protection/2021-afp-payments-fraud-and-control-survey-report-highlights.pdf</a> </ins>
4 <ins cite="mailto:Chadha,%20Shivani%20[ICG-CCB]" datetime="2021-11-09T00:25"><a style="text-decoration: underline;" href="https://www.technologyreview.com/2021/09/23/1036140/2021-record-zero-day-hacks-reasons/" target="_blank" rel="noopener">https://www.technologyreview.com/2021/09/23/1036140/2021-record-zero-day-hacks-reasons/</a> </ins>
5 <a style="text-decoration: underline;" href="https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crime-and-fraud-survey-2020.pdf" target="_blank" rel="noopener">https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crime-and-fraud-survey-2020.pdf</a>
*Some polls allowed respondents to choose more than one answer
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

The scale of cybercrime is astonishing. Global losses in 2020 topped $1 trillion – a 50% increase since 2018. (1) The FBI received 1 million complaints about cybercrime from March 2020 to May 2021, a level previously recorded over three years.(2)

Tackling Fraud and Cybercrime

Fraudsters are using email to target businesses. Watch this video to understand the different ways you can protect yourself from common scams.&nbsp;

Understanding email scams

As digital technology continues to transform the world around us, fraudsters are becoming braver, more creative and increasingly sophisticated. At Citi, we understand the challenges you face and are passionate about sharing knowledge and best practices to help protect your business.

Cybersecurity and Fraud Prevention

DOWNLOAD

As businesses around the world have invested in cybersecurity, we have seen a shift in the way that fraudsters attack their victims. Scams have now emerged as the primary fraud risk for businesses, with criminals increasingly attempting to ‘hack’ people rather than machines. Here are three of the most common forms of scams that businesses need to be aware of:

<div>As businesses around the world have invested in cybersecurity, we have seen a shift in the</div>
<div>way that fraudsters attack their victims. Scams have now emerged as the primary fraud</div>
<div>risk for businesses, with criminals increasingly attempting to &lsquo;hack&rsquo; people rather than</div>
<div>machines. Here are three of the most common forms of scams that businesses need to</div>
<div>be aware of:</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div><img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/634709ec1634ba12bb51e2b5.png" alt="image_87408255031665599979802.png/" /></div>
<div>&nbsp;</div>
<div><a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/62cdb786cbd420718de2e713.png" alt="VIEW" /></a></div>

As businesses around the world have invested in cybersecurity, we have seen a shift in the way that fraudsters attack their victims. Scams have now emerged as the primary fraud risk for businesses, with criminals increasingly attempting to ‘hack’ people rather than machines. Here are three of the most common forms of scams that businesses need to be aware of.

Understanding Fraud Scams Infographic

Cybercrime continues to be a primary concern for businesses and individuals across the globe. This is no surprise given the ever-increasing estimated costs and sophistication of cyber-attacks, from which no industry sector is immune.&nbsp;
Common attack methods include social engineering (where bad actors attempt to trick their victims by impersonating a trusted source such as a bank and request confidential information including passwords and login details) and email compromise&nbsp;(where bad actors attempt to trick victims into making payments to new accounts by impersonating a supplier), and destructive malware that is used to steal data (which might then be sold on the dark web), or to solicit a ransom. Criminals often demand payment in cryptocurrency to safeguard their anonymity.
 As technology evolves, so does cybercrime. Today&rsquo;s hottest tech innovation, generative artificial intelligence (AI), represents a new battleground. Companies are eager to use its new capabilities - but so too are cybercriminals.&nbsp; &nbsp; &nbsp;
Generative AI Changes Everything
Generative AI has recently brought the technology into the mainstream and is expected to transform businesses, boosting productivity and efficiency. It may also be able to play a role in cyber defense.&nbsp;
However, as with other technologies, generative AI is dual purpose - it can also serve as a tool that cybercriminals use to attack companies. Generative AI&rsquo;s ability to create realistic content makes it difficult to distinguish between human and machine-generated information. Generative AI can easily produce credible text instantly, meaning the days of spotting potential scams with poorly spelled emails or SMS asking recipients to transfer funds look set to end.&nbsp;
Similarly, some newer generative AI platforms can clone a natural-sounding voice from a short audio clip, making phishing attacks (which exploit human error to harvest credentials or spread malware) more effective. Moreover, generative AI could potentially conduct dozens of simultaneous impersonations: cybercriminals&rsquo; capacity to act has been multiplied at a keystroke.
Generative AI will boost cybercriminals&rsquo; ability to rapidly collect information from social media, the web, and other sources - making email compromise or social engineering attempts more convincing. Generative AI also makes it easier to gain valuable insights into opportunities, such as an M&amp;A transaction or even an individual&rsquo;s vacation, that could serve as a chance to access systems or divert funds.

<table style="border-collapse: collapse; width: 99.9724%; height: 446.336px; border-width: 1px; background-color: rgb(240, 243, 247); border-color: rgb(240, 243, 247);" border="1"><colgroup><col style="width: 11.1601%;"><col style="width: 88.8533%;"></colgroup>
<tbody>
<tr style="height: 57.2917px;">
<td style="padding: 0px; height: 57.2917px; border-color: rgb(240, 243, 247); vertical-align: top;" colspan="2">
Better education is crucial to identify and mitigate&nbsp;evolving cyber threats, especially as generative AI&nbsp;enables more sophisticated and personalized attacks,&nbsp;including voice mimicry, enhanced data trawling, and&nbsp;improved language generation. Remember: 
&nbsp;
</td>
</tr>
<tr style="height: 88.6285px;">
<td style="height: 88.6285px; padding: 0px; vertical-align: top; border-color: rgb(240, 243, 247);"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fdadc6519e1e17183291d6" width="79" height="79"></td>
<td style="height: 88.6285px; padding: 0px; border-color: rgb(240, 243, 247);">Always call back: Never trust an incoming email or phone call, even if they appear familiar or if they say they are from your bank, particularly when a payment is being requested to a new bank account or you are being asked to share confidential details. Call back on a verified number and never share your confidential details.</td>
</tr>
<tr style="height: 77.7778px;">
<td style="height: 77.7778px; padding: 0px; border-color: rgb(240, 243, 247); vertical-align: top;" scope="col">&nbsp; &nbsp; <img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fdb6e4ca93067fe39cbff5"></td>
<td style="height: 77.7778px; padding: 0px; border-color: rgb(240, 243, 247);">Keep your data safe: In the future, generative AI&nbsp;could be deployed on biometrics, enabling criminals&nbsp;to mimic fingerprints and eye scans; however, if&nbsp;biometric data is properly safeguarded, generative AI&nbsp;models have no data to source.</td>
</tr>
<tr style="height: 87.3264px;">
<td style="height: 87.3264px; padding: 0px; border-color: rgb(240, 243, 247);"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fdaf72074270118acf09d6"></td>
<td style="height: 87.3264px; padding: 0px; border-color: rgb(240, 243, 247);">Tell your bank immediately: Reconcile your&nbsp;account(s) frequently to identify potential&nbsp;discrepancies and quickly inform your bank. After&nbsp;72 hours, it is often impossible to recover funds.</td>
</tr>
<tr style="height: 135.312px;">
<td style="height: 135.312px; padding: 0px; border-color: rgb(240, 243, 247); vertical-align: top;" scope="col"><img style="margin-top: 0px; margin-bottom: 0px;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fdaf785ed337150d479ba6" width="84" height="84"></td>
<td style="height: 135.312px; padding: 0px; border-color: rgb(240, 243, 247);">
Plan for the worst:&nbsp;Assume you will be compromised and take appropriate measures.
<ul>
<li>Create an action plan and exercise it regularly.</li>
<li>Encrypt databases so stolen data can&rsquo;t be used.</li>
<li>Ensure a tested cyber plan is in place that has been developed across departments including IT, HR, Communications that lists the key contact points should there be a breach.</li>
<li>Educate your organization about Scams and Social Engineering so they know what to look out for.</li>
</ul>
</td>
</tr>
</tbody>
</table>

How to Combat New Threats

&copy; 2024 Citigroup Inc. Citi, Citi and Arc Design and other marks used herein are service marks of Citigroup Inc. or its affiliates, used and registered throughout the world. 2260404&emsp;03/24
<a href="https://www.citigroup.com/global/insights/commercial-bank" target="_blank" rel="noopener" data-link-source="tiny"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fd89625ed337150d479b29.JPG" alt="view all insights button" width="254" height="50"></a> &nbsp;

Cybercrime continues to be a primary concern for businesses and individuals across the globe. This is no surprise given the ever-increasing estimated costs and sophistication of cyber-attacks, from which no industry sector is immune.&nbsp;

Cybersecurity: Tackling the Threat from Artificial Intelligence

Banking, Capital Markets & Advisory

Securities Services

Commercial Bank

Citi Global Perspectives & Solutions

Global Insights

Leadership

Private Bank

Treasury & Trade Solutions

Markets

Issuer Services

Citi Digital Assets

Citi Research

Wealth

News

SEC Filings

Perspectives

ICG Insight Detail Template

As our premier thought leadership product, Citi Global Perspectives & Solutions (Citi GPS) is designed to help our clients navigate the global economy’s most demanding challenges, identify future themes and trends, and prosper in a fast-changing and interconnected world. 

Keep Exploring CITI GPS Content

Keep up to date with our latest insights.

Subscribe to Citi GPS

gpa-footer

gpa-menu

Citi, the leading global bank, serves more than 200 million customer accounts and does business in more than 160 countries and jurisdictions. Learn more today.

Cybersecurity and Fraud Prevention

Understanding email scams

Cybersecurity: Tackling the Threat from Artificial Intelligence

Why Dual Approval Matters

Working Remotely? Be Aware of these Home Office Scams

How to Combat Fraud

Tackling Fraud and Cybercrime

Business Email Compromise

An Overview of Fraud and Cybersecurity

Understanding Fraud Scams Infographic

Subscribe

Sign up to receive the latest news from Citi.

About Us

Businesses

Our Impact

Investors

News

Careers, Contact Us, and Regulatory Disclosures