Download

We have all seen the figures placed on the cost of fraud and cyberattacks to businesses and the economy with the projected costs to reach $2 trillion by 2019.1 Less sensational than its financial implications, though, but far more disruptive, are the reputational damage and the business impact that arise in the aftermath of successful attacks. Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organisations from such dangers, especially considering that threats and attacks are continuing unabated as the methods of fraudsters and attackers evolve and change to reach their ends. Available data indicates that instances of fraud and cybersecurity attacks are increasing not just in frequency but in severity and impact. Companies that fail to ensure that their employees are fully trained to recognise and tack action against this using adequate security processes, procedures and protocols, therefore, not only face a greater risk of financial loss, which includes loss of assets, but a greater risk of reputational damage and business disruption, which includes negative publicity. How has the fraud landscape changed? Fraud and cybersecurity threats continue to evolve as better organised and more sophisticated attackers have emerged. As illustrated in diagram 1, fraudsters and cyber attackers have become much more sophisticated in recent years. There has been a noticeable shift in the profile of those behind attacks. In the past, attackers were primarily individuals operating on an opportunistic, casual or ad hoc basis, largely driven by the desire to prove that they could successfully carry out a fraud attack. Acting alone or in collusion to commit internal or external fraud, fraudsters increasingly perpetrate acts that are focused on disruption and destruction. Today, attackers are highly organised syndicates and criminal enterprises that are managed in a similar way to businesses. These criminal enterprises are typically well organised and, importantly, well funded. Their motives are primarily for financial gain but in some instances for geopolitical gain. These fraudsters are also increasingly focused on disruption and destruction. There is also the risk of internal fraud and similarly internal fraud may be undertaken by an opportunistic individual or by an employee who operates in collusion with an organised criminal group. Diagram 2 shows the changing nature of the various aspects of a fraud or cybersecurity attack. Most notably, attacks are becoming increasingly targeted with fraudsters undertaking a large amount of research and planning prior to attempting an attack. Attempted attacks have also moved from a pattern of one-off, opportunistic attacks to targeted, planned and continuous attacks. Attackers will continue their attempts on one target if there is a chance of success. Attack methods are also continuously evolving and adapting to overcome the defences that organisations create. Unsurprisingly, there has been a growth in the use of technology by fraudsters. Attack methods tend to target weaknesses in technology and in human nature and in some instances both. It is for this reason that it is so important to frequently review internal procedures and processes and to ensure that all employees are fully trained and aware of their responsibilities in the event of an attempted attack.

We have all seen the figures placed on the cost of fraud and cyberattacks to businesses and the economy with the projected costs to reach $2 trillion by 2019.1 Less sensational than its financial implications, though, but far more disruptive, are the reputational damage and the business impact that arise in the aftermath of successful attacks.
Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organisations from such dangers, especially considering that threats and attacks are continuing unabated as the methods of fraudsters and attackers evolve and change to reach their ends. 
Available data indicates that instances of fraud and cybersecurity attacks are increasing not just in frequency but in severity and impact. Companies that fail to ensure that their employees are fully trained to recognise and tack action against this using adequate security processes, procedures and protocols, therefore, not only face a greater risk of financial loss, which includes loss of assets, but a greater risk of reputational damage and business disruption, which includes negative publicity. 
How has the fraud landscape changed? 
Fraud and cybersecurity threats continue to evolve as better organised and more sophisticated attackers have emerged. As illustrated in diagram 1, fraudsters and cyber attackers have become much more sophisticated in recent years. There has been a noticeable shift in the profile of those behind attacks. 
<blockquote>
In the past, attackers were primarily individuals operating on an opportunistic, casual or ad hoc basis, largely driven by the desire to prove that they could successfully carry out a fraud attack. 
</blockquote>
Acting alone or in collusion to commit internal or external fraud, fraudsters increasingly perpetrate acts that are focused on disruption and destruction.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618e9e392639e9726b32554a.png" />
Today, attackers are highly organised syndicates and criminal enterprises that are managed in a similar way to businesses. These criminal enterprises are typically well organised and, importantly, well funded. Their motives are primarily for financial gain but in some instances for geopolitical gain. These fraudsters are also increasingly focused on disruption and destruction. There is also the risk of internal fraud and similarly internal fraud may be undertaken by an opportunistic individual or by an employee who operates in collusion with an organised criminal group.
Diagram 2 shows the changing nature of the various aspects of a fraud or cybersecurity attack. Most notably, attacks are becoming increasingly targeted with fraudsters undertaking a large amount of research and planning prior to attempting an attack. Attempted attacks have also moved from a pattern of one-off, opportunistic attacks to targeted, planned and continuous attacks. Attackers will continue their attempts on one target if there is a chance of success.
Attack methods are also continuously evolving and adapting to overcome the defences that organisations create. Unsurprisingly, there has been a growth in the use of technology by fraudsters. Attack methods tend to target weaknesses in technology and in human nature and in some instances both. It is for this reason that it is so important to frequently review internal procedures and processes and to ensure that all employees are fully trained and aware of their responsibilities in the event of an attempted attack.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618e9e982639e9726b32554e.png" />
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organizations from such dangers.

An Overview of Fraud and Cybersecurity

Working remotely from home offers undeniable perks — such as zero commute and a more flexible schedule. However, while every day may be casual Friday, one thing you can't take lightly is online security. If you're working from home temporarily or permanently, knowing how to protect yourself from cybercrime belongs at the top of your daily to-do list. You take steps to protect your personal information online, and your home office should be a priority, too. But first, you need to understand the most important steps to take — and the biggest security risks to watch out for — when working remotely. Working remotely can boost your fraud risk profile You may not think twice about logging on to your computer or mobile device for work, but doing so can put you at risk for fraud in more ways than one. That's because it's easier to hack people than machines, says Nic White, global fraud prevention head for Citi Commercial Bank. “Cybersecurity has improved significantly over recent years, so criminals are increasingly targeting people, tricking them into voluntarily handing over information or sending a payment to an unintended beneficiary,” White says. For example, White says one of the most popular tactics used by fraudsters is business email compromise (BEC) scams. These rely on the use of seemingly legitimate-looking emails to defraud remote workers and small business owners. BEC scam victims unknowingly send money transfers to criminals, believing the recipients are legitimate business contacts. If you find you're interfacing more with business contacts who are working out of the office, be especially watchful against BEC scams, as fraudsters might use the pretense of remote work as a reason you need to suddenly send payments or funds to a new and unfamiliar account. Click here to view the report in full.

Working remotely from home offers undeniable perks &mdash; such as zero commute and a more flexible schedule.
<hr style="font-size: medium;" />
However, while every day may be casual Friday, one thing you can't take lightly is online security.
If you're working from home temporarily or permanently, knowing how to protect yourself from cybercrime belongs at the top of your daily to-do list. You take steps to protect your personal information online, and your home office should be a priority, too.
But first, you need to understand the most important steps to take &mdash; and the biggest security risks to watch out for &mdash; when working remotely.
Working remotely can boost your fraud risk profile
You may not think twice about logging on to your computer or mobile device for work, but doing so can put you at risk for fraud in more ways than one.
That's because it's easier to hack people than machines, says Nic White, global fraud prevention head for Citi Commercial Bank.
&ldquo;Cybersecurity has improved significantly over recent years, so criminals are increasingly targeting people, tricking them into voluntarily handing over information or sending a payment to an unintended beneficiary,&rdquo; White says.
For example, White says one of the most popular tactics used by fraudsters is business email compromise (BEC) scams. These rely on the use of seemingly legitimate-looking emails to defraud remote workers and small business owners. BEC scam victims unknowingly send money transfers to criminals, believing the recipients are legitimate business contacts.
If you find you're interfacing more with business contacts who are working out of the office, be especially watchful against BEC scams, as fraudsters might use the pretense of remote work as a reason you need to suddenly send payments or funds to a new and unfamiliar account.
<a href="https://www.lifeandmoney.citi.com/money/finance-101/home-office-business-scams" target="_blank" rel="noopener">Click here to view the report in full.</a>
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

Working from home offers undeniable perks, but it can also introduce new fraud risks. Learn about the scams targeting remote workers.

Working Remotely? Be Aware of these Home Office Scams

<a href="https://www.citibank.com/commercialbank/solutions/fraud_prevention/assets/pdf/Guidance_How_to_Combat_Fraud.pdf"><img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ec83248c69b5e11ebcb7e.png" />Click Infographic to Enlarge</a>
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

Fraudsters exploit human psychology and other social engineering tactics in an attempt to commit fraud. Be vigilant: recognizing signs of fraud is the most effective way to combat it.

How to Combat Fraud

Look-alike and hacked emails are helping fraudsters steal billions of dollars. While awareness is growing, the scams are also evolving and there are a few common misconceptions that are leaving businesses vulnerable. Companies around the world have been suffering from a fraud scheme known as a Business Email Compromise (BEC). The scam sees a cybercriminal pose as a known business contact and send a forged email requesting their victim to make a payment to a new beneficiary. While the attacks may sound simplistic, $1.9 billion of fraud losses have been attributed to this type of fraud in 2020*. During a typical BEC attack, a cybercriminal will use a hacked or look-alike email account to impersonate an Executive within your company or one of your existing suppliers. Before they send the email, the attacker will spend many months studying your business, so the timing, content and tone of the message will often appear normal. Because these types of attacks have been around for a few years, awareness of the scam has increased, and businesses have started to strengthen their defences. But as businesses have evolved, the scam has too, and fraudsters are changing their tactics to try to avoid detection. Here are three of the most common misconceptions about BEC, which are based upon earlier versions of the scam: Executive impersonation is the primary risk During the early years, most BEC cases involved the attacker impersonating a CEO, CFO or another internal Executive. While this threat has not completely gone away, the overwhelming majority of BEC cases now see the attacker pose as one of your existing suppliers. As you already make regular payments to your vendors, the attacker no longer has to convince their victim of the need for the payment, they simply need to create a good reason for the payment to be sent to a new bank account. The emails will be unsolicited and easy to spot Many people assume that a BEC attempt will arrive via a new email request, much like cold calling over the telephone. While this may previously have been true, the attackers now try to intercept and manipulate an existing email conversation, rather than initiating a fresh request. In the supply chain scenario, the attackers will hijack an email about an existing order (regularly after the down-payment has already been made) and then ask that their payment details be updated. The attackers will try to avoid prolonged dialogue In the Executive scenario, the fraudsters would often send a single payment request, together with a reason why they couldn’t be contacted – such as being in an important meeting or about to board a flight. These standalone (and normally ad-hoc) requests often looked suspicious and so the fraudsters have started to refine their approach. It is now common to see numerous emails between the fraudster and victim, which are designed to build rapport, develop the cover story and even create the opportunity for a second or third attempt. In the supplier scenario, we have even seen cases where the fraudster is having simultaneous conversations with both the supplier and buyer (in both cases impersonating the other party), which allows them to gather additional information, answer any questions and improve the credibility of the request. While the attacks have continued to evolve, the most effective controls to combat BEC have remained consistent. If you want to protect your business, there are three simple steps which will help reduce your susceptibility to an attack: Call Backs - If you ever receive an email requesting a payment to be sent to a new beneficiary, pick up the telephone and call the sender back to confirm the request. It’s important to use a previously known telephone number, rather than using any numbers that are given in the body/signature of the email. Dual Approval- Whenever you need to add a new payee, or change existing payment details, configure your systems to require an approver/checker. An extra set of eyes significantly improves your chances of spotting anything untoward. Training - Ensure your staff is aware of risk. Most people have naturally good instincts, but need to understand what BEC is, before they are able to look out for it. If you suspect you have fallen victim to BEC, contact your Citi Service Representative as quickly as possible so we can help to protect your account and attempt to recover any lost funds. Your security is our priority.

Look-alike and hacked emails are helping fraudsters steal billions of dollars. While awareness is growing, the scams are also evolving and there are a few common misconceptions that are leaving businesses vulnerable.
Companies around the world have been suffering from a fraud scheme known as a Business Email Compromise (BEC). The scam sees a cybercriminal pose as a known business contact and send a forged email requesting their victim to make a payment to a new beneficiary. While the attacks may sound simplistic, $1.9 billion of fraud losses have been attributed to this type of fraud in 2020*.
 During a typical BEC attack, a cybercriminal will use a hacked or look-alike email account to impersonate an Executive within your company or one of your existing suppliers. Before they send the email, the attacker will spend many months studying your business, so the timing, content and tone of the message will often appear normal.
 Because these types of attacks have been around for a few years, awareness of the scam has increased, and businesses have started to strengthen their defences. But as businesses have evolved, the scam has too, and fraudsters are changing their tactics to try to avoid detection. Here are three of the most common misconceptions about BEC, which are based upon earlier versions of the scam:
Executive impersonation is the primary risk During the early years, most BEC cases involved the attacker impersonating a CEO, CFO or another internal Executive. While this threat has not completely gone away, the overwhelming majority of BEC cases now see the attacker pose as one of your existing suppliers. As you already make regular payments to your vendors, the attacker no longer has to convince their victim of the need for the payment, they simply need to create a good reason for the payment to be sent to a new bank account.
The emails will be unsolicited and easy to spot Many people assume that a BEC attempt will arrive via a new email request, much like cold calling over the telephone. While this may previously have been true, the attackers now try to intercept and manipulate an existing email conversation, rather than initiating a fresh request. In the supply chain scenario, the attackers will hijack an email about an existing order (regularly after the down-payment has already been made) and then ask that their payment details be updated.
The attackers will try to avoid prolonged dialogue In the Executive scenario, the fraudsters would often send a single payment request, together with a reason why they couldn&rsquo;t be contacted &ndash; such as being in an important meeting or about to board a flight. These standalone (and normally ad-hoc) requests often looked suspicious and so the fraudsters have started to refine their approach. It is now common to see numerous emails between the fraudster and victim, which are designed to build rapport, develop the cover story and even create the opportunity for a second or third attempt. In the supplier scenario, we have even seen cases where the fraudster is having simultaneous conversations with both the supplier and buyer (in both cases impersonating the other party), which allows them to gather additional information, answer any questions and improve the credibility of the request.
<blockquote style="box-sizing: border-box; margin: 0px 0px 1em; font-size: 14px; text-align: left; background-color: #ffffff;">
While the attacks have continued to evolve, the most effective controls to combat BEC have remained consistent. If you want to protect your business, there are three simple steps which will help reduce your susceptibility to an attack:
</blockquote>
Call Backs -&nbsp;If you ever receive an email requesting a payment to be sent to a new beneficiary, pick up the telephone and call the sender back to confirm the request. It&rsquo;s important to use a previously known telephone number, rather than using any numbers that are given in the body/signature of the email.
Dual Approval- &nbsp;Whenever you need to add a new payee, or change existing payment details, configure your systems to require an approver/checker. An extra set of eyes significantly improves your chances of spotting anything untoward. 
Training -&nbsp;Ensure your staff is aware of risk. Most people have naturally good instincts, but need to understand what BEC is, before they are able to look out for it.
If you suspect you have fallen victim to BEC, contact your Citi Service Representative as quickly as possible so we can help to protect your account and attempt to recover any lost funds. Your security is our priority.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/61855b1d8125120a26c03b27.png" alt="image_40428465531636129563528.png/" />
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/" /></a>

Awareness of Business Email Compromise is growing, but the scams are also evolving, leaving businesses vulnerable to attack. Learn more about some of the common misconceptions.

Business Email Compromise

Contributor: Elif Kayhan (Global Fraud Risk Management Senior Vice President)
What is Dual Approval?
As the name implies, Dual Approval is a control that requires two separate individuals to authorize a transaction. The first person is responsible for creating the request (known as the &lsquo;maker&rsquo;), while the second checks and approves the activity (known as the &lsquo;checker&rsquo;).
Why is Dual Approval important?
Humans are not perfect. It does not matter how clever, trusted, or trained we are&mdash; sooner or later everybody will make a mistake. A maker-checker process introduces a second pair of eyes and helps to spot things that appear suspicious, strange, or otherwise incorrect. Dual Approval helps protect your business, but it also helps safeguard your employees from making unintended errors or deviating from approved process.
How does it work?
Dual Approval is quick and easy to set up, and it is offered at no additional cost on all of Citi Commercial Bank&rsquo;s online platforms. The functionality is fully customizable, giving you the ability to configure the process flow, assign approvers, and approval limits to meet the individual needs of your business.
Once Dual Approval has been enabled, any eligible transactions will be transferred to a pre-selected pool of checkers for authorization. The process is secure, and the approver can simply verify the request on an independent device (desktop, tablet or phone) and releases the transaction.
<img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ec2bf9236c83314de0203.png">
What are the benefits of Dual Approval?
Adding Dual Approval can help strengthen your online controls and protect your business from several different types of operational risk:
<ul type="disc">
<li>Payment Scams:&nbsp;Payment fraud is a growing risk, and criminals continue to deploy increasingly clever scams. While a fraudster may be able to trick an individual (with an email, phone or text message scam), a system-enforced checker ensures that a second person reviews the transaction and can help capture the attempt before any money leaves your account.</li>
</ul>
<ul type="disc">
<li>Compromised Credentials:&nbsp;Fraudsters are using advanced techniques to steal people&rsquo;s usernames and passwords, before logging into their victims&rsquo; accounts and diverting funds. Even if a criminal was able to compromise one of your online user&rsquo;s credentials, Dual Approval would help stop the attacker from being able to make a withdrawal.</li>
</ul>
<ul type="disc">
<li>Processing Errors:&nbsp;A checker can help spot a variety of mistakes, from breaches of internal procedure to typing errors on the account number or the value of a transfer.</li>
</ul>
<ul type="disc">
<li>Internal Fraud:&nbsp;While all businesses want to be able to trust their staff, the reality is that a significant number of companies have been defrauded by an employee. External pressures and/ or unexpected opportunities can lead a previously trusted staff member into making a poor ethical decision. Dual Approval helps mitigate this risk by acting as an effective deterrent while also providing an opportunity for any wrongdoing to be identified early in the process.</li>
</ul>
Common Questions
If I have full confidence in my team, do I really need Dual Approval?
Even the most diligent of employees can make a mistake or be tricked by a fraudster. The majority of payments fraud is now completed by large, professional criminal organisations that use advanced tactics to deceive honest and trustworthy employees.
I don&rsquo;t have enough staff to check everything.
Dual Approval is fully customizable, so you can choose exactly what transactions you want to send for authorization. You have the ability to design the control to fit your business and balance the volume of approval requests by restricting the types of transactions and/or values that require checking.
What happens if an approver is busy, on holiday or off sick?
As with any business process, contingency planning is critical. When you set up Dual Approval, you can nominate a pool of checkers. It is recommended to try to nominate a minimum of three approvers for each eligible transaction.
&nbsp;
<a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights" data-link-source="tiny"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/618ed7a99236c83314de0211.png" alt="image_5231382051636751273307.png/"></a>

Dual Approval is one of the most important online controls, yet the concept remains foreign to many businesses. Learn more about why it matters.

Why Dual Approval Matters

Companies worldwide rely on technology and connectivity to engage with customers and suppliers, process payments, and conduct daily operations. While innovation has revolutionized business practices, it also introduces significant risks, such as cyberattacks.&nbsp;

Be Prepared for the Unexpected

As digital technology continues to transform the world around us, fraudsters are becoming braver, more creative and increasingly sophisticated. At Citi, we understand the challenges you face and are passionate about sharing knowledge and best practices to help protect your business.

Cybersecurity and Fraud Prevention

DOWNLOAD

Nic White

As businesses around the world have invested in cybersecurity, we have seen a shift in the way that fraudsters attack their victims. Scams have now emerged as the primary fraud risk for businesses, with criminals increasingly attempting to ‘hack’ people rather than machines. Here are three of the most common forms of scams that businesses need to be aware of:

<div>As businesses around the world have invested in cybersecurity, we have seen a shift in the</div>
<div>way that fraudsters attack their victims. Scams have now emerged as the primary fraud</div>
<div>risk for businesses, with criminals increasingly attempting to &lsquo;hack&rsquo; people rather than</div>
<div>machines. Here are three of the most common forms of scams that businesses need to</div>
<div>be aware of:</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div><img style="display: block; margin-left: auto; margin-right: auto;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/634709ec1634ba12bb51e2b5.png" alt="image_87408255031665599979802.png/" /></div>
<div>&nbsp;</div>
<div><a title="VIEW ALL INSIGHTS" href="https://www.citigroup.com/global/insights/commercial-bank?pk_campaign=view_all_insights"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/62cdb786cbd420718de2e713.png" alt="VIEW" /></a></div>

As businesses around the world have invested in cybersecurity, we have seen a shift in the way that fraudsters attack their victims. Scams have now emerged as the primary fraud risk for businesses, with criminals increasingly attempting to ‘hack’ people rather than machines. Here are three of the most common forms of scams that businesses need to be aware of.

Understanding Fraud Scams Infographic

Cybercrime continues to be a primary concern for businesses and individuals across the globe. This is no surprise given the ever-increasing estimated costs and sophistication of cyber-attacks, from which no industry sector is immune.&nbsp;
Common attack methods include social engineering (where bad actors attempt to trick their victims by impersonating a trusted source such as a bank and request confidential information including passwords and login details) and email compromise&nbsp;(where bad actors attempt to trick victims into making payments to new accounts by impersonating a supplier), and destructive malware that is used to steal data (which might then be sold on the dark web), or to solicit a ransom. Criminals often demand payment in cryptocurrency to safeguard their anonymity.
 As technology evolves, so does cybercrime. Today&rsquo;s hottest tech innovation, generative artificial intelligence (AI), represents a new battleground. Companies are eager to use its new capabilities - but so too are cybercriminals.&nbsp; &nbsp; &nbsp;
Generative AI Changes Everything
Generative AI has recently brought the technology into the mainstream and is expected to transform businesses, boosting productivity and efficiency. It may also be able to play a role in cyber defense.&nbsp;
However, as with other technologies, generative AI is dual purpose - it can also serve as a tool that cybercriminals use to attack companies. Generative AI&rsquo;s ability to create realistic content makes it difficult to distinguish between human and machine-generated information. Generative AI can easily produce credible text instantly, meaning the days of spotting potential scams with poorly spelled emails or SMS asking recipients to transfer funds look set to end.&nbsp;
Similarly, some newer generative AI platforms can clone a natural-sounding voice from a short audio clip, making phishing attacks (which exploit human error to harvest credentials or spread malware) more effective. Moreover, generative AI could potentially conduct dozens of simultaneous impersonations: cybercriminals&rsquo; capacity to act has been multiplied at a keystroke.
Generative AI will boost cybercriminals&rsquo; ability to rapidly collect information from social media, the web, and other sources - making email compromise or social engineering attempts more convincing. Generative AI also makes it easier to gain valuable insights into opportunities, such as an M&amp;A transaction or even an individual&rsquo;s vacation, that could serve as a chance to access systems or divert funds.

<table style="border-collapse: collapse; width: 99.9724%; height: 446.336px; border-width: 1px; background-color: rgb(240, 243, 247); border-color: rgb(240, 243, 247);" border="1"><colgroup><col style="width: 11.1601%;"><col style="width: 88.8533%;"></colgroup>
<tbody>
<tr style="height: 57.2917px;">
<td style="padding: 0px; height: 57.2917px; border-color: rgb(240, 243, 247); vertical-align: top;" colspan="2">
Better education is crucial to identify and mitigate&nbsp;evolving cyber threats, especially as generative AI&nbsp;enables more sophisticated and personalized attacks,&nbsp;including voice mimicry, enhanced data trawling, and&nbsp;improved language generation. Remember: 
&nbsp;
</td>
</tr>
<tr style="height: 88.6285px;">
<td style="height: 88.6285px; padding: 0px; vertical-align: top; border-color: rgb(240, 243, 247);"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fdadc6519e1e17183291d6" width="79" height="79"></td>
<td style="height: 88.6285px; padding: 0px; border-color: rgb(240, 243, 247);">Always call back: Never trust an incoming email or phone call, even if they appear familiar or if they say they are from your bank, particularly when a payment is being requested to a new bank account or you are being asked to share confidential details. Call back on a verified number and never share your confidential details.</td>
</tr>
<tr style="height: 77.7778px;">
<td style="height: 77.7778px; padding: 0px; border-color: rgb(240, 243, 247); vertical-align: top;" scope="col">&nbsp; &nbsp; <img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fdb6e4ca93067fe39cbff5"></td>
<td style="height: 77.7778px; padding: 0px; border-color: rgb(240, 243, 247);">Keep your data safe: In the future, generative AI&nbsp;could be deployed on biometrics, enabling criminals&nbsp;to mimic fingerprints and eye scans; however, if&nbsp;biometric data is properly safeguarded, generative AI&nbsp;models have no data to source.</td>
</tr>
<tr style="height: 87.3264px;">
<td style="height: 87.3264px; padding: 0px; border-color: rgb(240, 243, 247);"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fdaf72074270118acf09d6"></td>
<td style="height: 87.3264px; padding: 0px; border-color: rgb(240, 243, 247);">Tell your bank immediately: Reconcile your&nbsp;account(s) frequently to identify potential&nbsp;discrepancies and quickly inform your bank. After&nbsp;72 hours, it is often impossible to recover funds.</td>
</tr>
<tr style="height: 135.312px;">
<td style="height: 135.312px; padding: 0px; border-color: rgb(240, 243, 247); vertical-align: top;" scope="col"><img style="margin-top: 0px; margin-bottom: 0px;" src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fdaf785ed337150d479ba6" width="84" height="84"></td>
<td style="height: 135.312px; padding: 0px; border-color: rgb(240, 243, 247);">
Plan for the worst:&nbsp;Assume you will be compromised and take appropriate measures.
<ul>
<li>Create an action plan and exercise it regularly.</li>
<li>Encrypt databases so stolen data can&rsquo;t be used.</li>
<li>Ensure a tested cyber plan is in place that has been developed across departments including IT, HR, Communications that lists the key contact points should there be a breach.</li>
<li>Educate your organization about Scams and Social Engineering so they know what to look out for.</li>
</ul>
</td>
</tr>
</tbody>
</table>

How to Combat New Threats

&copy; 2024 Citigroup Inc. Citi, Citi and Arc Design and other marks used herein are service marks of Citigroup Inc. or its affiliates, used and registered throughout the world. 2260404&emsp;03/24
<a href="https://www.citigroup.com/global/insights/commercial-bank" target="_blank" rel="noopener" data-link-source="tiny"><img src="/rcs/v1/media/citigpa/akpublic/storage/retrieveMediaFile/65fd89625ed337150d479b29.JPG" alt="view all insights button" width="254" height="50"></a> &nbsp;

Cybercrime continues to be a primary concern for businesses and individuals across the globe. This is no surprise given the ever-increasing estimated costs and sophistication of cyber-attacks, from which no industry sector is immune.&nbsp;

Cybersecurity: Tackling the Threat from Artificial Intelligence

Watch this video to understand the different ways fraudsters are using email to target businesses and ways you can protect yourself from common scams.&nbsp;

Video: understanding email scams

Cybersecurity

Commercial Banking

Commercial Bank

Banking & International

We provide global banking solutions to mid-sized companies that are looking to grow rapidly and expand internationally. 

Commercial Bank 

Companies worldwide rely on technology and connectivity to engage with customers and suppliers, process payments, and conduct daily operations. While innovation has revolutionized business practices, it also introduces significant risks, such as cyberattacks.&nbsp;Threats such as the rise of AI allow threat actors to deploy more sophisticated attacks faster and more widely.&nbsp;Continuity of business (COB) or business continuity plans (BCPs) are often associated with physical disruptions such as natural disasters. But given the critical threats presented by cyberattacks, which can interrupt business, facilitate fraud, lead to regulatory fines, and tarnish a company’s reputation, cyber must be a key part of COB plans.&nbsp;Whether hurricanes, human error, supply chain breakdown or cyberattacks disrupt business, it is important to have a business continuity team in place that has an (offline) list of contacts (including banks, suppliers and other stakeholders) with clear escalation plans, and a strategy for communications and regulatory advisories.&nbsp;However, the cyber threats are both rapidly-evolving and constant; they therefore necessitate a distinct approach compared to other risks in a COB plan.

<h4>Preparing for Cyberattacks</h4>It is a business reality that most companies will suffer a cyberattack at some point. Adequate preparation can make a big difference to a company’s ability to respond to an attack, contain the threat and recover. Basic cyber hygiene measures, must be practiced throughout the organization and closely integrated with the COB plan. In practice, this means being aware of risks such as:&nbsp;<h6>What is Business email compromise (BEC)&nbsp;</h6><ul style="list-style-type:disc;"><li>What is it? BEC is an attack method where the fraudster uses email to trick an employee into sending money, changing account numbers or divulging confidential information. </li><li>What are the red flags? Watch for small discrepancies in a sender’s email address (e.g., similar-looking characters, additional characters or email domain changes). </li><li>What are the best practices? Verify payment detail changes by contacting vendors directly using known phone numbers. Confirm any requested changes received via email such as switching banks or changing account numbers. </li><li>What preventative measures should you build into your security program? <ul><li>Establish a culture of vigilance (e.g., questioning unusual emails, verifying the sender’s email address etc). </li><li>Use a maker-checker approach for payment approvals. </li><li>Perform regular reconciliation, ideally on a daily basis. </li><li>Ensure employees understand relevant risks and know correct escalation processes for concerns or suspicions.</li></ul></li></ul><h6>&nbsp;</h6><h6>Credential phishing</h6><ul style="list-style-type:disc;"><li>What is it? Credential phishing is where a fraudster attempts to gain access to, and steal, login credentials or other sensitive information. It primarily aims to gain access to accounts by stealing usernames and passwords, which can then be used for various malicious activities. </li><li>What are the red flags? Fake emails, websites, messages or calls that appear to be from legitimate sources to trick recipients into providing their information. </li><li>What are the best practices? Employee training must be up to date as phishing approaches evolve over time. </li><li>What preventative measures should you build into your security program? </li><li>Multi-Factor Authentication makes it harder for attackers to gain access even if credentials are compromised. </li><li>Advanced email filtering can reduce the number of phishing emails reaching employees. </li><li>Regular password expiry should be built in to all systems that require login.</li></ul>

<h4>Designing a Cyber COB Plan</h4>A COB plan should contain a set of actions and procedures, generally contained in a playbook, that is regularly tested and maintained, and a copy stored offline in the event that an attack shuts down all systems, that will ensure stability and continuity of business should operational disruptions occur.&nbsp;The nature of a cyber-COB necessarily depends on the company and its requirements. Continuity must be assessed in relation to the company’s size, structure, and technology capabilities. In addition, the number and complexity of vendors and the sophistication of their systems should be considered.&nbsp;Mid-sized companies can face greater challenges and these should be reflected in both regular cybersecurity measures and COB plans. For instance, there may be greater reliance on third-party suppliers, which can increase risk exposure.&nbsp;Similarly, mid-sized companies may also have fewer controls like maker/checker processes, making them more vulnerable to fraud; if one account is compromised, it may be possible to easily manipulate payments.

<h4>A Tale of Two COB Plans</h4>Many companies, across multiple sectors, rely heavily on the ability to digitally send wires and make payments. Cyberattacks can often force a shutdown of operations. Drafting a COB plan without consulting your bank can be costly. It is important for all companies, irrespective of size, to consider how they would operate during and following a cyberattack and devise a plan accordingly, discussing their plan with their banks.&nbsp;Comparing two companies who recently experienced cyberattacks, both companies had to shut down their systems as a preventative measure and to safeguard their reputation. One company remained shuttered for over a week. In contrast, the other company activated its COB plan that had been drafted with input from Citi; payment volumes were gradually increased, and 70% operational capacity was achieved by the end of the day of the attack.&nbsp;Key components of the successful COB plan included:&nbsp;<ul style="list-style-type:disc;"><li>Prioritization of larger transactions to maintain critical client services. </li><li>A contingency bank account, not linked to the company’s accounting software and known only to a few senior team members, for use in the event of system compromise. </li><li>Regular cyber drills to ensure those aware of the backup system can access it and verify its readiness. Periodic transactions are also conducted to ensure functionality. </li><li>Undertake a ‘look back’ review of all recent transactions for suspect payments or unusual activity. It is important to identify any other potentially fraudulent activity that may have occurred.</li></ul>

From a cyber risk perspective, a COB plan should be designed to ensure the ability to continue business operations. Data backups and failovers (where a system automatically switches to a backup) are typical components of any plan. Ensure that escalation points are identified, along with a list of emergency contacts, both internal and external. Seemingly mundane matters, such as having a printed list of phone contacts for contingency situations, are vital when all networks (and stored telephone numbers) are inaccessible; they can make the difference between resilience and catastrophe in the event of a cyberattack.&nbsp;Plans should also address payments infrastructure; contingency arrangements should reflect the business or reputational risk that would result from an inability to make payments.&nbsp;Planning should identify critical functions and data, not just within the organization but also where there are vendor or supplier dependencies. For example, it is important to have emergency contacts for your banking partners, vendors and others that you may need to contact in the event of any disruption.&nbsp;Questions to be considered in a COB plan include:&nbsp;<ul style="list-style-type:disc;"><li>Who is empowered to make decisions?</li><li>What are the priorities in terms of action?</li><li>What alternative forms of communications should be used if there is no network or email?</li><li>Who should be contacted at the bank or vendor?</li><li>Should access to all bank services be restricted or should visibility be prioritized?</li><li>Should clients or counterparties be contacted, and if so, by whom?&nbsp;</li></ul>&nbsp;The COB plan should also ensure that the right tools are in place and appropriate subject matter expertise would work together in case of any disruption including technology, legal and others as appropriate from inside and/or outside the organization.&nbsp;Companies should start by assessing the suitability and availability of alternative payment types. Wires, for example, are always accessible and require no additional implementation. For high-volume ACH processors, real-time payments can be used as a backup in case of an ACH disruption.&nbsp;COB plans are only valuable if they can be relied on. Companies need to perform annual denial-of-service tests (where an application goes down, and manual workarounds are implemented). Annual denial-of-access tests (where alternate working arrangements, such as remote work, are tested) are also essential. Data backups and failovers must be regularly tested and maintained to ensure business continuity.&nbsp;Mid-sized companies, in particular, need to ensure their communications plans are robust. If email systems go down, they need a failsafe plan to communicate and manage incidents. While technology testing is often rigorous, communication processes are harder to test but equally important. It’s essential to ensure that staff understand escalation protocols and how to keep business operations running during an incident.

Continuity of Business (COB) planning is essential in the digital age

Banking, Capital Markets & Advisory

Securities Services

Citi Global Perspectives & Solutions

Global Insights

Leadership

Private Bank

Treasury & Trade Solutions

Markets

Issuer Services

Citi Digital Assets

Research

Wealth

Column 1

Column 2

About Us

Programs

Knowledge Center

Apply for Funding

Column 3

Column 4

Column 5

Links

Footer

Citi Foundation

Businesses

Our Impact

News

Insights

Investors

Careers

My Account

Para Sport

Emergency

Disclosures

Privacy Notices

Hidden

Citi Gpa

Europe, Middle East and Africa

North America

Latin America

Asia Pacific

Social Welfare Funds

Development Organizations

SOEs

Multilateral Development Bank

Central Banks

Central Governments

Ministry of Finance

Local Governments

Ministry of Foreign Affairs

Regional Development Bank

Fraud Prevention

FinTech

iBuyers

Mortgage

Origination

PropTech

Real Estate

Single-Family Rental

Data

GDPR

Privacy

Regulsyion

Auto

Demand

Food

Industrial

Metals

Russia

Shortage

Supply

Supply Chain

Tariff

Ukraine

Asteroids

Imagery

Logistics

Mining

Moon

Rockets

Satellites

Space

Space-Based Solar Power

Aware

Do No Harm

Impact

Investing

Monitoring

Risk

Sustainability

Taxonomies

Augmented Reality

Cryptocurrency

dApps

DeFi

Metaverse

Money

Virtual Reality

VR/AR

Auction

Disruption

Money Laundering

Online

Regulation

Virtual

Entrepreneur

Equal Opportunity

Equality

Global Growth

Innovation

Venture Capital

Women

Women Entrepreneurs

Education

Eliminating Poverty

Health

Multidimensional Index

Poverty

Standard of Living

Sustainability-Linked Bond

UN SDG

Inflation

Just in Case

Just in Time

Production

Transportation

Charity

Donations

Multiplier

Philanthropy

Service

Technology

Growth & Prosperity

Risk & Resilience

Sustainability & Society

Technology & Innovation

Health & Wellness

Citi Blog

Press Release

Regulatory

Product Marketing

Wealth Publications

Newsletter

Global Markets and Economy

Business Strategies

Community Impact

Wealth Management

Retail Banking

Diversity, Equity, and Inclusion

ICG Insight Detail Template

As our premier thought leadership product, Citi Global Perspectives & Solutions (Citi GPS) is designed to help our clients navigate the global economy’s most demanding challenges, identify future themes and trends, and prosper in a fast-changing and interconnected world. 

Keep Exploring CITI GPS Content

Keep up to date with our latest insights.

Subscribe to Citi GPS

Cybersecurity and Fraud Prevention

Related Stories

Be Prepared for the Unexpected

Video: understanding email scams

Cybersecurity: Tackling the Threat from Artificial Intelligence

Commercial Bank

Sign up to receive the latest from Citi.