Facing Post-Transaction Attacks, Banks Should Reassess Fraud Protection

Banks will have to continue to upgrade their fraud protection controls, especially in the face of new and evolving attacks exclusively designed to evade them, researchers now say.

A blog post, penned by Trusteer’s CTO Amit Klein, offers some research on these so-called post-transaction attack vectors and how they affect three different types of malware detection.

One format, deterministic detection, looks for hints of the malware before transactions are submitted and allows banks to limit payouts and block money transfers. Statistical transaction detection sends potentially risky transactions to be manually verified by the bank’s fraud team, and statistical post-transaction detection attempts to reverse transactions with high risk scores while some involve the bank contacting each customer for validation.

The research follows a bulletin issued by the FBI shortly after the New Year that warned Gameover, a new variant of Zeus malware, was narrowing its scope on snatching banking information. While doing so, the malware also attempts to throw off banks by upsetting their fraud protection systems through distributed denial-of-service (DDoS) attacks.

Attacks initiated by Gameover try to defeat statistical post-transaction detection by inundating the banks with these DDoS attacks, slowing their fraud protection controls to a near halt.

For more on their studies regarding post-transaction attacks, head to Trusteer.

Commenting on this Article is closed.