NORWICH – What do drive by downloads, spear phishing, work-at-home schemes and the Greek gods have in common? According to NBT Bank’s in-house security experts, they are but a few of the tactics used by cybercriminals to syphon money out of business and personal bank accounts.
“Cybercrime has reached epidemic proportions,” explained NBT President and CEO Martin Dietrich, during the introduction of a Cybercrime Prevention presentation hosted by NBT Bank in conjunction with Commerce Chenango.
More than one hundred local business leaders and IT professionals attended the breakfast session, held last Tuesday morning at Canasawacta Country Club.
According to NBT Chief Information Officer Joe Stagliano, cybercrime drains an estimated $117 billion from the U.S. economy each year. Only a fraction of that amount is ever reported.
“It’s earth shattering to see how much money is being lost in our economy today,” Stagliano said.
NBT invests a “tremendous amount” of human and financial resources to protect itself and its customers against this type of crime, the bank executive explained. But just as this and other financial institutions are protecting their resources, end-users must also take steps to protect themselves and their financial information.
“We can’t stop it on our own,” he said, explaining NBT’s commitment to educating consumers and businesses alike on the cyber threats out there and what they can do to detect, deter and defend themselves against these threats.
According to Senior Vice President and Bank Secrecy Officer Jim Terry, one of the biggest threats out there is a virus called ‘Zeus,’ which skates by 80 percent of commercially available anit-virus programs
“Like the king of all gods, this is the king of all viruses,” he told those in attendance, referring to the malicious program believed to be developed in the Ukraine. According to Terry, the former Soviet republic and other Eastern European nations are a hot-bed for cybercriminals.
“They are extremely organized, and they run their crime (organizations) like a business,” he said, recruiting marketing professionals, ex-bankers, programmers and hackers.
Once a PC is infected by Zeus, the malware recognizes when the user is attempting to access bank accounts and other sensitive financial information and notifies “the bad guys,” who will then record everything the user does.
“They’ll case the computer for about a week and a half,” Terry reported. “They they’ll go in for the kill.”
How does a computer get infected with this malicious software? According to Terry, it can happen in a number of ways which exploit the trust people have for one another and for companies and organizations they do business with. One way is through drive-by downloads, where the virus or malware is downloaded automatically to a person’s computer, such as when they click through an ad on a trusted website, which has either been hacked by “the bad guys,” or even purchased by them specifically to lure in the unsuspecting user. Or perhaps through infected “gift” media, such as a flash drive given out at a conference.
Spear phishing is another means used by cybercriminals.
“This is the most common way people are infected with malware,” Terry said, describing unsolicited emails which may look legitimate at first glance. He cautioned against clicking on any link included in such an email.
Once your computer has been infected, and the cybercriminals have all that personal financial information in hand, how do they actually get your money?
According to Terry, they use “money mules” to move their ill-gotten gains. These are the usually unsuspecting people who fall for work-from-home schemes, he explained. Few people realize when they answer these “earn cash now, no experience needed” ads that they are working for an Eastern European organized crime syndicate.
“It seems far fetched, but it happens every day,” reported Terry, who works closely with the FBI and state police organizations to fight cybercriminals.
To help educate consumers and businesses alike about cybercrime, NBT has started distributing a best practices brochure. In it, are 9 Points of Protection, which Stagliano describes as simple steps anyone can implement to help protect themselves and their sensitive financial information.
Their recommendations are to have a dedicated banking PC, one where you don’t access the internet or email for any other purpose; implement dual control for electronic transactions; review bank transactions on a daily basis; refresh passwords often; make sure your anti-virus and anti-spyware software are up to date; never include personal or sensitive information in response to an email; and be suspicious of unsolicited emails, especially those which ask for usernames and passwords. When in doubt, they said, contact your financial institution.
“An ounce of prevention really is worth a pound of cure,” said Terry.
Tuesday’s Cybercrime Prevention breakfast was the fifth presentation he and Stagliano have given recently. They have already spoken on the topic to customers and prospective customers in Albany, Scranton, Binghamton and Utica. They will continue to hold presentations on this topic throughout the financial institution’s footprint.