15 April 2024

---

Protecting Savings: Online Payments and Scams

Luigi Campopiano

---

The financial sector, even in Italy, ranks among the major victims of cybercriminals. According to the latest "Clusit 2023 Report on Cybersecurity", in 2022 alone, approximately 2 new phishing pages were activated daily in this area, through which scammers attempted to deceive victims into providing personal information, financial data, or access codes. Big brands like Bper Banca, Intesa Sanpaolo, and Poste Italiane are targeted by hackers. However, phishing is not the only type of cyber risk associated with banking services.

When discussing the banking world, we must distinguish between two areas:

1. Risks for account holders, related to phishing activities aimed at obtaining credentials, personal information, and financial data. The average damage caused per individual citizen can be quite high, but when analyzed in absolute value, it generally involves many cases of relatively low value.
2. Cyber risks indirectly involving clients. Cases of ransomware attacks on a bank, where data is encrypted and published on the internet, are numerically lower but have greater potential for damage.

Depending on the context, defending against cyber risks related to financial services can take on different aspects:

• If a market player is affected, the defense depends on the bank's ability to implement a mix of technologies, processes, backup operations, and staff training.
• When considering citizen-oriented scams like phishing, knowing digital risks, being cautious about what is clicked, always asking questions, and not acting hastily, bypassing any logic of control over what is requested, can be key. (Banks never ask for passwords via SMS or send emails requesting code insertion).
• Another issue concerns risks associated with online payments, where cybercriminals tend to exploit psychologically incentivizing communication techniques, promising possible winnings or discounts. (Anything resembling a gift is a scam, so caution must be exercised and payment systems should not be used without first conducting appropriate risk comprehension checks).
• If the risk to be contained is the abusive use of one's credentials, any form of two-factor authentication is a method of great caution (e.g., double-channel via SMS, token, etc.). However, it's important to note that multi-factor authentication can help but not save from all risks. For example, if a legitimate payment is made on a portal not under one's control, this system often doesn't work, and the money is unlikely to be recovered as these portals are often managed by offshore companies with impossible identification.

The banking world is subject to an extremely wide range of regulations aimed at maximizing system resilience: it is generally a sector less affected compared to others that have not made investments of this nature. However, it is evident that the more data a reality possesses, the more advantages a criminal can gain by attacking it, and the more they will attempt to do so. It all depends on the trade-off between the ease of the attack and the possibility of return on investment.