Cyber risk and fraud: what they are and why lenders are exposed

A shared vocabulary

The Financial Stability Board published a Cyber Lexicon in 2018 and updated it in 2023, to support the work of the Board, standard-setting bodies, authorities and private sector participants on cyber security and cyber resilience in the financial sector. Six of its definitions are enough to begin:

• Cyber security: preservation of the confidentiality, integrity and availability of information and/or information systems through the cyber medium.
• Cyber event: any observable occurrence in an information system.
• Cyber incident: a cyber event that adversely affects the cyber security of an information system or the information it processes, stores or transmits, whether resulting from malicious activity or not.
• Vulnerability: a weakness, susceptibility or flaw of an asset or control that can be exploited by one or more threats.
• Cyber threat: a circumstance with the potential to exploit one or more vulnerabilities that adversely affects cyber security.
• Cyber resilience: the ability of an organisation to continue to carry out its mission by anticipating and adapting to cyber threats and other relevant changes in the environment, and by withstanding, containing and rapidly recovering from cyber incidents.

Two points follow from these definitions. An incident need not be an attack: an error that exposes data or stops a system also counts. And resilience is wider than prevention: it includes carrying on through an incident and recovering from it.

Probability and impact

The same lexicon defines cyber risk as the combination of the probability of cyber incidents occurring and their impact. One simple way to put a number on that combination, for one type of incident over a year, is the expected loss.

Example, for illustration only, in any currency: a leak of customer data has a probability of 5 percent of occurring in a year and would cost 2 million if it occurred; its expected loss is 0.05 times 2 million, or 100,000 a year. A day-long outage of the loan system has a probability of 20 percent and would cost 300,000; its expected loss is 60,000 a year. The leak ranks higher, but the two numbers also hide a difference: the outage is more likely, while the leak, though rarer, would cost almost seven times as much. Expected loss is a starting point for ranking risks, not a full measure of the worst case.

Expected loss from one type of incident over a year = probability that it occurs in the year × loss if it occurs.

Why the financial sector is exposed

The International Monetary Fund devoted a chapter of its April 2024 Global Financial Stability Report to cyber risk. It finds that the financial sector is highly exposed, with nearly one-fifth of all incidents affecting financial firms, that incidents have become much more frequent over the past two decades and especially since 2020, and that the risk of extreme direct losses to firms, at least as large as 2.5 billion US dollars, has increased. It adds that indirect losses tend to be substantially larger than the direct losses firms report.

The report explains why an incident can be more disruptive and spread beyond one firm: high market concentration and low substitutability in critical services such as payment services and custody banking, and reliance on common third-party IT providers. It found modest and somewhat persistent deposit outflows from smaller US banks after a cyberattack, while noting that no significant cyber runs have occurred yet. Among its recommendations, supervisors should hold board members responsible for managing the cybersecurity of financial firms, and firms should develop and test response and recovery procedures.

Fraud: where cyber risk meets the customer

Not every loss comes from breaking into a lender's systems. Many come through the customer, or through someone pretending to be one. Four types are useful to distinguish:

• Identity fraud at application: someone applies with a stolen, borrowed or invented identity, with no intention of repaying.
• Account takeover: a criminal gains access to a genuine customer's account and borrows or withdraws money in that customer's name.
• Scams: the genuine customer is deceived into borrowing, or into sending money, to the criminal.
• Insider fraud: staff or agents misuse the access they have been given.

The Financial Action Task Force, in a 2023 report prepared with the Egmont Group and INTERPOL, describes cyber-enabled fraud as a major transnational organised crime that has grown exponentially in recent years, in both the volume of frauds reported and their global spread. It notes that the proceeds are often rapidly transferred to different jurisdictions, and that such crimes cause significant financial losses and erode trust in digital systems. It sets three priorities: domestic coordination between the public and private sectors, international cooperation, and better detection and prevention through awareness and reporting. Lesson 4 of this course returns to fraud in digital lending.

Six functions that organise the work

The US National Institute of Standards and Technology published version 2.0 of its Cybersecurity Framework on 26 February 2024. It is designed for organisations of all sizes and sectors, and groups cybersecurity outcomes into six functions:

• Govern: the organisation's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored.
• Identify: the organisation's current cybersecurity risks are understood.
• Protect: safeguards to manage the organisation's cybersecurity risks are used.
• Detect: possible cybersecurity attacks and compromises are found and analysed.
• Respond: actions regarding a detected cybersecurity incident are taken.
• Recover: assets and operations affected by a cybersecurity incident are restored.

The framework places Govern at the centre, because it informs how an organisation will implement the other five. The rest of this course is built around these functions: governance in lesson 2, protecting access and data in lesson 3, fraud in lesson 4, response and recovery in lesson 5, and testing and information sharing in lesson 6.