Fox-IT, for a more secure society

Internet banking is now an everyday affair and we cannot imagine life without it. Is it actually safe? Consumers believe it is. Secure HTTPS connections, TAN codes, tokens and other methods secure the online banking channel. Cybercriminals have actually adapted their methods, so that a number of these measures are being bypassed. They focus their phishing activities and malware on the unsuspecting customer, whose PC, laptop, iPad or smartphone is difficult to secure fully. Cybercriminals manipulate the transactions customers carry out with online banking, by quietly hitching a ride on connections with the bank’s webservers. Very quickly and unnoticed, they siphon money out through fraudulent transactions, via accounts of so-called money mules

Analysing communications, detecting anomalies

With online banking the TCP/IP communication channel contains a wealth of details. That’s why DetACT-OB taps into the raw data, extracts dozens of features from the traffic streams and stores the information in databases. Then it carries out a direct – real-time – analysis of the transactions. DetACT-OB searches for anomalies which (might) indicate fraud, by testing against a multiplicity of features. The more anomalous features, which switch from green to red, as it were, the stronger the fraud signal. It can be compared to a spam filter which regards an e-mail as spam if it meets a number of characteristics.All sorts of characteristics could indicate fraud; it’s often not just a single parameter, but a combination of them. Several examples might be:

• The customer is suddenly using a different operating system, a different screen resolution, a different browser, or is banking from a different country than usual.
• The way in which the online banking website is being browsed, or the speed at which this is happening, is a signal that it’s not a flesh and blood person who is banking but an automated ‘bot’ or virus.
• A transaction is using a known money mule account, fields are completed a little differently than usual, or a suspicious IP address is used.

In this way DetACT-OB holds every anomaly for inspection and the system triggers an alert when it suspects a transaction of being ‘fraudulent’. This sometimes even occurs before the customer, or the cybercriminal, has actually authorised the transaction! With its ‘live view’ feature DetACTOB offers the ability to make real-time notifications, subject to human interpretation, because experience has taught us that the human eye is extremely efficient and effective in drawing the distinction as to whether a transaction is fraudulent or not.

More information

Need more information? Please download the productsheet DetACT for Online Banking here.