Banks Face New Threat
Banks have been caught off guard by what experts say is the first major mobile banking security threat to hit the United States.
It is a modification of the mobile Trojan called Svpeng, which has been used to steal money from Russian mobile bank accounts, said Dmitry Bestuzhev, head of the global research and analysis team, Latin America, at Kaspersky Lab, the Woburn, Mass.-based antivirus software company that discovered the malware.
The malware, which emanates from Russia, has been termed “ransomware,” because the hackers demand payment in exchange for not destroying the victim’s reputation, claiming there is child pornography and other prohibited content on the cell phone.
“It takes a picture of the victim and then says it will send it with the child pornography findings to all of the victim’s contacts,” Bestuzhev said.
“Nobody wants to be a victim of such reputation damage.”
This new malware is deeply integrated and is almost impossible to remove from an infected device, he added.
Better software is needed to protect against malware, said Chris Keegan, a managing director at Beecher Carlson in New York.
For now, banks rely on warning their customers against social engineering attempts by fraudsters, and usually that means, “Don’t press the button or answer the email.” Banks must warn their customers not to download any applications not found on verified websites, he said.
Banks Ran Out of Time
Avivah Litan, a Gartner Inc. vice president and analyst in Potomac, Md., said the malware should serve as a wake-up call for many banks, as a fair number of them have not developed security measures for mobile banking that are as robust as those used in online banking.
Ensuring that customers use secured browsers doesn’t apply when they use mobile apps.
Giants like Chase Bank, U.S. Bank and others are developing tougher measures specific to mobile, but the industry as a whole needs to step it up, Litan said.
“They’ve just been slow to put measures in place specific to mobile because there hasn’t been any mobile malware,” she said. “Everybody knew it was coming, but they thought they had more time.”
Matt Krogstad, head of mobile banking at Bank of the West in San Francisco, said the bank’s fraud prevention department works with his department to combat mobile malware and other types of mobile banking fraud.
“It’s an ongoing process since the mobile security space is constantly evolving,” Krogstad said.
Bank of the West diligently educates customers about the latest threats, Krogstad said. In cases like Heartbleed, communications to customers were to reassure them that the bank had done its due diligence to ensure that their accounts were safe.
“With other malware like this randomware, it’s more about reinforcing certain behaviors, such as not downloading apps from unofficial app stores or not clicking on links from people you don’t know,” he said. “Don’t jailbreak your phone or put your banking passwords in your contacts.”
Keeping up with all types of cyber crime continues to challenge the industry. Indeed, computer crime and malicious codes rank as No. 5 as a top risk for banks, according to Aon’s “2014 U.S. Industry Report: Financial Institutions.”
However, there is a disconnect at most banks that hampers risk mitigation, said Michael O’Connell, managing director, financial institutions practice at Aon Risk Solutions.
The disconnect occurs because one group traditionally is responsible for purchasing insurance, while another group is responsible for assessing exposures, including technology that may pose an operational enterprise risk, said O’Connell.
“We strongly recommend linking the two groups together, to assess ‘what-if’ scenarios and develop mitigation strategies that include insurance,” he said.
Kevin Kalinich, Aon’s global practice leader for cyber/network risk, said that recent court decisions have ruled that if fraudsters are able to steal customer identities or money, it is the bank’s obligation to help their customers, even if the fraud is out of the bank’s control.
“So if a customer gets fooled on their mobile devices, then the bank has the responsibility to monitor usage of their bank accounts,” Kalinich said.
Befuddled by Bitcoin?
Five years after the emergence of bitcoins, consumers are using them to buy everything from pizza to cars, from drugs to real estate. Political donations can even be made in bitcoin. Just about every day, companies are announcing they will accept this “digital cash.”
Like traditional currency, bitcoins facilitate the exchange of goods or services. The advantages of bitcoin are fast payments worldwide with very low transaction costs. International monetary transactions can take three days to clear, whereas bitcoin transactions are considered settled after just one hour.
Credit card transaction fees are roughly 2 percent of the purchase price, while the minimum bitcoin transaction fee is 0.001 of the bitcoin’s value.
Video: New York State Superintendent of Financial Services Benjamin Lawsky on the future of digital currency regulation.
Using bitcoin is somewhat similar to online banking. Software known as a “wallet” stores bitcoin addresses (similar to an account number) and handles transactions. The wallet can reside on any computing device, or on a website known as a “web wallet.” Wallets securely store bitcoin using encryption and can send them to an individual or company for payment.
Wallets connected to the Internet and used for transactions are called “hot wallets.” Wallets stored on devices without Internet connections are “cold wallets.” A cold wallet can be stored on a stand-alone USB device, for example. Similar to an online bank account, the user name and password must be protected from unauthorized access to protect the bitcoins within the wallet.
How Does Bitcoin Work?
Bitcoin does not have banks that log transactions or track how many bitcoins are held in individual accounts. Instead, the bitcoin network uses a “block chain” to perform these functions openly and publicly.
The block chain is a public ledger containing all confirmed transactions. The integrity and chronological order of the block chain is maintained with encryption provided by the bitcoin network. User identities are protected by recording the bitcoin address in the ledger instead of user names. As long as bitcoin users do not identify themselves as the owner of a bitcoin address, their transactions remain anonymous.
No single entity or central bank controls the bitcoin network or sets economic policy. Instead, bitcoin users control the bitcoin network, with a subgroup of bitcoin “miners” who use their computers to process transactions and add them to the block chain by “mining.”
Roughly every 10 minutes, the bitcoin network bundles recent transactions and sends them to the miners. The miners’ computers perform complex calculations or “proofs of work” that require billions of calculations per second, turning the effort into a type of lottery.
The first miner to satisfy the proof of work is rewarded in bitcoins. This incentive motivates miners to participate in the bitcoin network.
As the bitcoin network grows in computing power, it automatically adjusts the difficulty of the proof of work to ensure the calculations take roughly 10 minutes. This keeps mining competitive and ensures that no single individual or entity can control the network.
The transactions, combined with the proof of work and control data, are now a block in the chain. The calculations for the proof of work are based off the previous block in the chain to enforce chronological order.
As more blocks are added to the chain, it becomes increasingly difficult to reverse previous transactions since all subsequent blocks would require recalculation.
As with any emerging technology, this new practice brings associated — and sometimes uncharted — risks.
Like cash, a lost bitcoin is lost forever. There is no recourse to recover the money if the password to a bitcoin wallet is forgotten. The same is true if the wallet is corrupted due to hardware failure, or if the USB storage device containing a cold wallet is lost. Having good backups of the wallet is critical.
Additionally, bitcoin transactions are not reversible. Once a transaction has been confirmed in the block chain, it cannot be undone. This benefits merchants since chargeback fraud, (e.g., when someone purchases an item with their credit card, then petitions their credit card company for a refund claiming they never received the item), is not possible.
By the same token, unscrupulous companies may keep the bitcoin and never fulfill an order.
Like cash, a lost bitcoin is lost forever. There is no recourse to recover the money if the password to a bitcoin wallet is forgotten.
Acting too fast could result in lost payment. Bitcoin transactions can occur nearly instantly, however, blocks are added to the block chain every 10 minutes; it takes at least that long for the transaction to be confirmed by the bitcoin network.
If an order is fulfilled before the transaction is confirmed, a company may find that product has been shipped, but payment never occurred. For particularly large transactions, waiting until several blocks are added to the chain may be wise.
Bitcoin value is volatile. Bitcoin values have risen and fallen significantly over the last two years. This makes storing value in bitcoins somewhat of a gamble. Many companies that accept bitcoins immediately exchange them for local currency, protecting their organizations from potentially dramatic price swings.
Malware can steal bitcoins. Computer processing power can be stolen to mine for bitcoins. Such malware has been found on computers, tablets and cell phones. Such malware can also attack the wallet software itself and potentially drain the wallet of any bitcoins it contains.
Bitcoins can be lost to theft or exchange failure. In early 2014, hackers exploited weaknesses in several bitcoin exchange websites. By sending many copies of the same bitcoin payment, a vulnerable exchange sent out the requested bitcoins repeatedly.
Using this technique, hackers stole thousands of bitcoins, worth millions of dollars. Unable to return bitcoins to their customers, the hacked exchanges closed. Since there is no FDIC-like insurance protecting users, the only remedy is through the legal system.
Transactions may be anonymous, but they are recorded. Bitcoin is popular with criminals since their identities are protected. However, every transaction is recorded in the public ledger and IP addresses are recordable by Internet service providers.
This makes it possible for law enforcement agencies to reconstruct past bitcoin transactions if a user’s identity can be matched with a bitcoin address. Once the identity is matched, the criminal’s entire history of bitcoin use becomes available.
A company may not wish to have its customer list revealed to others. It might be a competitive disadvantage or perhaps the company might lose customers (especially if it is in a socially gray area where customer privacy is greatly valued).
Laws and regulations are still emerging. In the United States, various federal and state agencies disagree on how to classify bitcoins and regulate their use.
At the federal level, for example, the IRS is treating bitcoin as property, not currency. This means that capital gains and losses must be calculated and reported for tax purposes, thereby complicating everyday use since every purchase requires accounting documentation.
Most states have not adopted a regulatory approach to digital currency. Texas has issued a regulatory guidance on its decision to not treat bitcoin as currency. As of this writing, New York is developing virtual currency exchanges, while Florida is applying existing laws to bitcoin exchanges, particularly money-laundering laws.
Until government agencies fully decide exactly what bitcoin is, insurers are unlikely to feel comfortable offering standardized coverage. Pending that, companies seeking insurance can inquire about customized offerings.
Internationally, the legal landscape is just as complicated, with many laws in development.
Some countries, such as Iceland, have restricted the foreign exchange of bitcoin. Others, such as Ecuador, have banned the currency. China has barred its financial institutions from transacting in bitcoin, while India has advised the public to avoid buying and selling virtual currencies.
Given all of the media coverage that bitcoin receives, it is important to remember that it emerged only five years ago. Will bitcoin revolutionize the financial world? Or will it join other valueless currencies only found in history books? It’s too soon to know for certain.
Should a company accept bitcoin as payment today? If approached thoughtfully, accepting bitcoin can be a differentiator in today’s competitive marketplace.
If implemented poorly, accepting bitcoin can be risky. Taking appropriate steps to minimize risks allows companies to adopt virtual currencies and attract the growing user base.
And if nothing else, being educated about virtual currencies ensures each company will be prepared for the future — whichever direction it may take.
Lloyd Takata is executive vice president of OneBeacon Technology Insurance. JOE BUDZYN is the organization’s assistant vice president and senior business development manager. They can be reached at firstname.lastname@example.org.
A Renaissance In U.S. Energy
America’s energy resurgence is one of the biggest economic game-changers in modern global history. Current technologies are extracting more oil and gas from shale, oil sands and beneath the ocean floor.
Domestic manufacturers once clamoring for more affordable fuels now have them. Breaking from its past role as a hungry energy importer, the U.S. is moving toward potentially becoming a major energy exporter.
“As the surge in domestic energy production becomes a game-changer, it’s time to change the game when it comes to both midstream and downstream energy risk management and risk transfer,” said Rob Rokicki, a New York-based senior vice president with Liberty International Underwriters (LIU) with 25 years of experience underwriting energy property risks around the globe.
Given the domino effect, whereby critical issues impact each other, today’s businesses and insurers can no longer look at challenges in isolation one issue at a time. A holistic, collaborative and integrated approach to minimizing risk and improving outcomes is called for instead.
Aging Infrastructure, Aging Personnel
The irony of the domestic energy surge is that just as the industry is poised to capitalize on the bonanza, its infrastructure is in serious need of improvement. Ten years ago, the domestic refining industry was declining, with much of the industry moving overseas. That decline was exacerbated by the Great Recession, meaning even less investment went into the domestic energy infrastructure, which is now facing a sudden upsurge in the volume of gas and oil it’s being called on to handle and process.
“We are in a renaissance for energy’s midstream and downstream business leading us to a critical point that no one predicted,” Rokicki said. “Plants that were once stranded assets have become diamonds based on their location. Plus, there was not a lot of new talent coming into the industry during that fallow period.”
In fact, according to a 2014 Manpower Inc. study, an aging workforce along with a lack of new talent and skills coming in is one of the largest threats facing the energy sector today. Other estimates show that during the next decade, approximately 50 percent of those working in the energy industry will be retiring. “So risk managers can now add concerns about an aging workforce to concerns about the aging infrastructure,” he said.
Increasing Frequency of Severity
Current financial factors have also contributed to a marked increase in frequency of severity losses in both the midstream and downstream energy sector. The costs associated with upgrades, debottlenecking and replacement of equipment, have increased significantly,” Rokicki said. For example, a small loss 10 years ago in the $1 million to $5 million ranges, is now increasing rapidly and could readily develop into a $20 million to $30 million loss.
Man-made disasters, such as fires and explosions that are linked to aging infrastructure and the decrease in experienced staff due to the aging workforce, play a big part. The location of energy midstream and downstream facilities has added to the underwriting risk.
“When you look at energy plants, they tend to be located around rivers, near ports, or near a harbor. These assets are susceptible to flood and storm surge exposure from a natural catastrophe standpoint. We are seeing greater concentrations of assets located in areas that are highly exposed to natural catastrophe perils,” Rokicki explained.
“A hurricane thirty years ago would affect fewer installations then a storm does today. This increases aggregation and the magnitude for potential loss.”
On its own, the domestic energy bonanza presents complex risk management challenges.
However, gradual changes to insurance coverage for both midstream and downstream energy have complicated the situation further. Broadening coverage over the decades by downstream energy carriers has led to greater uncertainty in adjusting claims.
A combination of the downturn in domestic energy production, the recession and soft insurance market cycles meant greatly increased competition from carriers and resulted in the writing of untested policy language.
In effect, the industry went from an environment of tested policy language and structure to vague and ambiguous policy language.
Keep in mind that no one carrier has the capacity to underwrite a $3 billion oil refinery. Each insurance program has many carriers that subscribe and share the risk, with each carrier potentially participating on differential terms.
“Achieving clarity in the policy language is getting very complicated and potentially detrimental,” Rokicki said.
Back to Basics
Has the time come for a reset?
Rokicki proposes getting back to basics with both midstream and downstream energy risk management and risk transfer.
He recommends that the insured, the broker, and the carrier’s underwriter, engineer and claims executive sit down and make sure they are all on the same page about coverage terms and conditions.
It’s something the industry used to do and got away from, but needs to get back to.
“Having a claims person involved with policy wording before a loss is of the utmost importance,” Rokicki said, “because that claims executive can best explain to the insured what they can expect from policy coverage prior to any loss, eliminating the frustration of interpreting today’s policy wording.”
As well, having an engineer and underwriter working on the team with dual accountability and responsibility can be invaluable, often leading to innovative coverage solutions for clients as a result of close collaboration.
According to Rokicki, the best time to have this collaborative discussion is at the mid-point in a policy year. For a property policy that runs from July 1 through June 30, for example, the meeting should happen in December or January. If underwriters try to discuss policy-wording concerns during the renewal period on their own, the process tends to get overshadowed by the negotiations centered around premiums.
After a loss occurs is not the best time to find out everyone was thinking differently about the coverage,” he said.
Changes in both the energy and insurance markets require a new approach to minimizing risk. A more holistic, less siloed approach is called for in today’s climate. Carriers need to conduct more complex analysis across multiple measures and have in-depth conversations with brokers and insureds to create a better understanding and collectively develop the best solutions. LIU’s integrated business approach utilizing underwriters, engineers and claims executives provides a solid platform for realizing success in this new and ever-changing energy environment.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty International Underwriters. The editorial staff of Risk & Insurance had no role in its preparation.