Reports

Threat Intelligence Report- 2023 Banking and Finance Phishing Landscape

Jericho Security Contributor

February 22, 2024

Global Distribution of Phishing themes per sector

Executive Summary

Phishing attacks continued to pose a critical threat to the banking and finance sector in 2023. Attackers demonstrated advanced tactics, with familiar phishing methods enhanced by increasingly sophisticated techniques and targeted attack vectors. Key trends and observations include:

Prevalence and Impact

  • Business Email Compromise (BEC) Dominance: BEC scams continued their reign as highly lucrative for threat actors, leading to staggering losses exceeding $43 billion in 2023 (FBI IC3 Report). This is due to advanced social engineering tactics and meticulously targeted attacks.
  • Supply Chain Compromise on the Rise: 2023 saw increased attacks compromising software and service providers used by financial institutions, emphasizing the need to review the security posture of third-party vendors.
  • Mobile Channel Expansion (Smishing): Financial institutions faced a rise in smishing (SMS phishing) attempts. This underscores the need to educate users about mobile channel threats and implement appropriate mobile device security measures.
  • Psychological Manipulation: Attackers amplified their exploitation of fear, greed, urgency, and trust tactics to bypass traditional security filters and increase their success rates.
  • Ransomware Augmentation: Phishing continues to serve as the initial point of entry for ransomware attacks. Financial institutions face the combined threat of data theft and business disruption if they fall victim.



 

Figure 1 Global Distribution of Phishing themes per sector

2023 Phishing Techniques & Attack Vectors

  • E-commerce & Banking Impersonation: Phishing emails and websites posing as popular e-commerce platforms and renowned banks remained top attack vectors. Increased sophistication in brand imitation and social engineering lures added to the challenge of detection.
  • Exploitation of Zero-Day Vulnerabilities: While not strictly phishing, attacks combining credential theft or social engineering with previously unknown software vulnerabilities amplified the overall risk to financial organizations.
  • Malicious Attachments and Links: Classic methods like malicious email attachments and embedded links within emails maintained their effectiveness. In particular, attacks employed weaponized Microsoft Office documents with customized VBA macros to download malware payloads.

Comparisons with Prior Years

  • Volume and Financial Impact: The overall volume of phishing attacks in the financial sector rose in 2023, exceeding 80% of organizations reporting at least one successful attack (KnowBe4). This correlates with an increase in total financial losses.
  • BEC Escalation: BEC attack tactics became more refined in 2023, utilizing advanced research targeting high-level executives. These personalized attacks contribute to an increased average loss per BEC incident.
  • Speed vs. Detection: Increased attacker sophistication has reduced the average lifespan of phishing campaigns, highlighting the evolving nature of attacks. Simultaneously, the average time to detect a breach remains significant at 146 days. This underscores the need for advanced proactive threat detection solutions.

Security Recommendations

  • User Awareness is Paramount: Ongoing security training must incorporate social engineering scenarios, suspicious URLs, attachment identification, and mobile phishing threats. Simulated attacks further improve user vigilance.
  • Multi-Factor Authentication (MFA): MFA for all business-critical accounts is non-negotiable as it dramatically reduces the impact of compromised credentials.

Email Security Investments: Advanced email filters, anti-virus solutions, and sandboxing should be a cornerstone of protection. Consider behavior analysis technologies to augment protection against sophisticated scams.

  • Threat Intelligence Utilization: Real-time threat feeds and active monitoring help anticipate and block emerging phishing campaigns. This is particularly important for proactive protection against targeted BEC tactics.

Conclusion

The report highlights that phishing is still a major threat to the banking and finance industry in 2023. To tackle this, multi-faceted defenses and constant security evolution are necessary to keep up with the evolving techniques of threat actors.

 

  1.  https://www.ic3.gov/
  2.  https://info.knowbe4.com/en-us/phishing-by-industry-benchmarking-report
  3.  https://www.cyfirma.com/outofband/cyfirma-industries-report-finance-october-2023

Jericho Security Contributor

February 22, 2024

Continue reading

← Back to blog
Global Distribution of Phishing themes per sector

Reports

Threat Intelligence Report- 2023 Banking and Finance Phishing Landscape

Jericho Security Contributor

February 22, 2024

Global Distribution of Phishing themes per sector

Reports

Threat Intelligence Report- 2023 Banking and Finance Phishing Landscape

Jericho Security Contributor

February 22, 2024

Global Distribution of Phishing themes per sector

Reports

Threat Intelligence Report- 2023 Banking and Finance Phishing Landscape

Jericho Security Contributor

February 22, 2024

Get the latest updates

Join our newsletter