Key Themes
Introduction
Attackers have shifted from exploiting perimeter weaknesses to logging in with stolen identities, bought from specialised credential marketplaces.
By the time a bank detects fraud, it is watching the final act of a story that began months earlier.
Picture the actual sequence: a customer downloads what looks like a free PDF converter, or clicks a sponsored search result that mimics a tool they already use. Nothing appears to happen, but in the background, an infostealer copies every password saved in their browser, their session cookies, their autofill details, and the corporate login they use for work, then deletes itself.
The customer notices nothing, their bank notices nothing, because from the bank’s side nothing has happened yet.
Six weeks later, on a normal Tuesday, someone logs in with the stolen password, gets past the one-time code by phoning the…
MANAGEMENT & CULTURE (THE “TONE AT THE TOP”)
Fraud thrives in “sloppy” environments where leadership ignores the rules.
- The Fraud Triangle: For fraud to occur, three elements must be present: Pressure (the need for money), Rationalization (thinking “I deserve this”), and Opportunity (weak controls). You can only control the Opportunity.
- Whistleblower Hotline: Provide an anonymous way for staff to report “odd behavior.” Most internal frauds are caught via tips, not audits.
- Background Checks: Conduct credit and criminal record checks for all employees in financial or data-sensitive roles.
- Annual Ethics Training: Make sure every staff member knows that the company has a Zero Tolerance policy toward “borrowing” from petty cash or fudging overtime.