Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organizations from such dangers.

An Overview of Fraud and Cybersecurity

As digital technology continues to transform the world around us, fraudsters are becoming braver, more creative and increasingly sophisticated. At Citi, we understand the challenges you face and are passionate about sharing knowledge and best practices to help protect your business.

Cybersecurity and Fraud Prevention

Watch this video to understand the different ways fraudsters are using email to target businesses and ways you can protect yourself from common scams.&nbsp;

Video: understanding email scams

Fraud Prevention

Commercial Banking

Commercial Bank

Companies worldwide rely on technology and connectivity to engage with customers and suppliers, process payments, and conduct daily operations. While innovation has revolutionized business practices, it also introduces significant risks, such as cyberattacks.&nbsp;Threats such as the rise of AI allow threat actors to deploy more sophisticated attacks faster and more widely.&nbsp;Continuity of business (COB) or business continuity plans (BCPs) are often associated with physical disruptions such as natural disasters. But given the critical threats presented by cyberattacks, which can interrupt business, facilitate fraud, lead to regulatory fines, and tarnish a company’s reputation, cyber must be a key part of COB plans.&nbsp;Whether hurricanes, human error, supply chain breakdown or cyberattacks disrupt business, it is important to have a business continuity team in place that has an (offline) list of contacts (including banks, suppliers and other stakeholders) with clear escalation plans, and a strategy for communications and regulatory advisories.&nbsp;However, the cyber threats are both rapidly-evolving and constant; they therefore necessitate a distinct approach compared to other risks in a COB plan.

<h4>Preparing for Cyberattacks</h4>It is a business reality that most companies will suffer a cyberattack at some point. Adequate preparation can make a big difference to a company’s ability to respond to an attack, contain the threat and recover. Basic cyber hygiene measures, must be practiced throughout the organization and closely integrated with the COB plan. In practice, this means being aware of risks such as:&nbsp;<h6>What is Business email compromise (BEC)&nbsp;</h6><ul style="list-style-type:disc;"><li>What is it? BEC is an attack method where the fraudster uses email to trick an employee into sending money, changing account numbers or divulging confidential information. </li><li>What are the red flags? Watch for small discrepancies in a sender’s email address (e.g., similar-looking characters, additional characters or email domain changes). </li><li>What are the best practices? Verify payment detail changes by contacting vendors directly using known phone numbers. Confirm any requested changes received via email such as switching banks or changing account numbers. </li><li>What preventative measures should you build into your security program? <ul><li>Establish a culture of vigilance (e.g., questioning unusual emails, verifying the sender’s email address etc). </li><li>Use a maker-checker approach for payment approvals. </li><li>Perform regular reconciliation, ideally on a daily basis. </li><li>Ensure employees understand relevant risks and know correct escalation processes for concerns or suspicions.</li></ul></li></ul><h6>&nbsp;</h6><h6>Credential phishing</h6><ul style="list-style-type:disc;"><li>What is it? Credential phishing is where a fraudster attempts to gain access to, and steal, login credentials or other sensitive information. It primarily aims to gain access to accounts by stealing usernames and passwords, which can then be used for various malicious activities. </li><li>What are the red flags? Fake emails, websites, messages or calls that appear to be from legitimate sources to trick recipients into providing their information. </li><li>What are the best practices? Employee training must be up to date as phishing approaches evolve over time. </li><li>What preventative measures should you build into your security program? </li><li>Multi-Factor Authentication makes it harder for attackers to gain access even if credentials are compromised. </li><li>Advanced email filtering can reduce the number of phishing emails reaching employees. </li><li>Regular password expiry should be built in to all systems that require login.</li></ul>

<h4>Designing a Cyber COB Plan</h4>A COB plan should contain a set of actions and procedures, generally contained in a playbook, that is regularly tested and maintained, and a copy stored offline in the event that an attack shuts down all systems, that will ensure stability and continuity of business should operational disruptions occur.&nbsp;The nature of a cyber-COB necessarily depends on the company and its requirements. Continuity must be assessed in relation to the company’s size, structure, and technology capabilities. In addition, the number and complexity of vendors and the sophistication of their systems should be considered.&nbsp;Mid-sized companies can face greater challenges and these should be reflected in both regular cybersecurity measures and COB plans. For instance, there may be greater reliance on third-party suppliers, which can increase risk exposure.&nbsp;Similarly, mid-sized companies may also have fewer controls like maker/checker processes, making them more vulnerable to fraud; if one account is compromised, it may be possible to easily manipulate payments.

<h4>A Tale of Two COB Plans</h4>Many companies, across multiple sectors, rely heavily on the ability to digitally send wires and make payments. Cyberattacks can often force a shutdown of operations. Drafting a COB plan without consulting your bank can be costly. It is important for all companies, irrespective of size, to consider how they would operate during and following a cyberattack and devise a plan accordingly, discussing their plan with their banks.&nbsp;Comparing two companies who recently experienced cyberattacks, both companies had to shut down their systems as a preventative measure and to safeguard their reputation. One company remained shuttered for over a week. In contrast, the other company activated its COB plan that had been drafted with input from Citi; payment volumes were gradually increased, and 70% operational capacity was achieved by the end of the day of the attack.&nbsp;Key components of the successful COB plan included:&nbsp;<ul style="list-style-type:disc;"><li>Prioritization of larger transactions to maintain critical client services. </li><li>A contingency bank account, not linked to the company’s accounting software and known only to a few senior team members, for use in the event of system compromise. </li><li>Regular cyber drills to ensure those aware of the backup system can access it and verify its readiness. Periodic transactions are also conducted to ensure functionality. </li><li>Undertake a ‘look back’ review of all recent transactions for suspect payments or unusual activity. It is important to identify any other potentially fraudulent activity that may have occurred.</li></ul>

From a cyber risk perspective, a COB plan should be designed to ensure the ability to continue business operations. Data backups and failovers (where a system automatically switches to a backup) are typical components of any plan. Ensure that escalation points are identified, along with a list of emergency contacts, both internal and external. Seemingly mundane matters, such as having a printed list of phone contacts for contingency situations, are vital when all networks (and stored telephone numbers) are inaccessible; they can make the difference between resilience and catastrophe in the event of a cyberattack.&nbsp;Plans should also address payments infrastructure; contingency arrangements should reflect the business or reputational risk that would result from an inability to make payments.&nbsp;Planning should identify critical functions and data, not just within the organization but also where there are vendor or supplier dependencies. For example, it is important to have emergency contacts for your banking partners, vendors and others that you may need to contact in the event of any disruption.&nbsp;Questions to be considered in a COB plan include:&nbsp;<ul style="list-style-type:disc;"><li>Who is empowered to make decisions?</li><li>What are the priorities in terms of action?</li><li>What alternative forms of communications should be used if there is no network or email?</li><li>Who should be contacted at the bank or vendor?</li><li>Should access to all bank services be restricted or should visibility be prioritized?</li><li>Should clients or counterparties be contacted, and if so, by whom?&nbsp;</li></ul>&nbsp;The COB plan should also ensure that the right tools are in place and appropriate subject matter expertise would work together in case of any disruption including technology, legal and others as appropriate from inside and/or outside the organization.&nbsp;Companies should start by assessing the suitability and availability of alternative payment types. Wires, for example, are always accessible and require no additional implementation. For high-volume ACH processors, real-time payments can be used as a backup in case of an ACH disruption.&nbsp;COB plans are only valuable if they can be relied on. Companies need to perform annual denial-of-service tests (where an application goes down, and manual workarounds are implemented). Annual denial-of-access tests (where alternate working arrangements, such as remote work, are tested) are also essential. Data backups and failovers must be regularly tested and maintained to ensure business continuity.&nbsp;Mid-sized companies, in particular, need to ensure their communications plans are robust. If email systems go down, they need a failsafe plan to communicate and manage incidents. While technology testing is often rigorous, communication processes are harder to test but equally important. It’s essential to ensure that staff understand escalation protocols and how to keep business operations running during an incident.

Continuity of Business (COB) planning is essential in the digital age

Companies worldwide rely on technology and connectivity to engage with customers and suppliers, process payments, and conduct daily operations. While innovation has revolutionized business practices, it also introduces significant risks, such as cyberattacks.&nbsp;

Be Prepared for the Unexpected

Download

Cyber criminals are becoming more sophisticated in their methods to commit fraud. Learn how to recognize the warning signs of fraud and the helpful tips and general best practices to effectively combat it.&nbsp;&nbsp;Click<a href="https://www.citibank.com/commercialbank/docs/2344153_Guidance_HowToCombatFraud.pdf"> here</a> to learn more&nbsp;

Guidance on How to Combat Fraud

Banking, Capital Markets & Advisory

Securities Services

Citi Global Perspectives & Solutions

Global Insights

Leadership

Private Bank

Treasury & Trade Solutions

Markets

Issuer Services

Citi Digital Assets

Research

Wealth

Services

Column 1

Column 2

About Us

Programs

Knowledge Center

Apply for Funding

Column 3

Column 4

Column 5

Links

Footer

Citi Foundation

Businesses

Our Impact

News

Insights

Investors

Careers

My Account

Para Sport

Emergency

Disclosures

Privacy Notices

Hidden

Citi Gpa

Europe, Middle East and Africa

North America

Latin America

Asia Pacific

Social Welfare Funds

Development Organizations

SOEs

Multilateral Development Bank

Central Banks

Central Governments

Ministry of Finance

Local Governments

Ministry of Foreign Affairs

Regional Development Bank

FinTech

iBuyers

Mortgage

Origination

PropTech

Real Estate

Single-Family Rental

Data

GDPR

Privacy

Regulsyion

Auto

Demand

Food

Industrial

Metals

Russia

Shortage

Supply

Supply Chain

Tariff

Ukraine

Asteroids

Imagery

Logistics

Mining

Moon

Rockets

Satellites

Space

Space-Based Solar Power

Aware

Do No Harm

Impact

Investing

Monitoring

Risk

Sustainability

Taxonomies

Augmented Reality

Cryptocurrency

dApps

DeFi

Metaverse

Money

Virtual Reality

VR/AR

Auction

Disruption

Money Laundering

Online

Regulation

Virtual

Entrepreneur

Equal Opportunity

Equality

Global Growth

Innovation

Venture Capital

Women

Women Entrepreneurs

Education

Eliminating Poverty

Health

Multidimensional Index

Poverty

Standard of Living

Sustainability-Linked Bond

UN SDG

Inflation

Just in Case

Just in Time

Production

Transportation

Charity

Donations

Multiplier

Philanthropy

Service

Technology

Growth & Prosperity

Risk & Resilience

Sustainability & Society

Technology & Innovation

Health & Wellness

Citi Blog

Press Release

Regulatory

Product Marketing

Wealth Publications

Newsletter

Global Markets and Economy

Business Strategies

Community Impact

Wealth Management

Retail Banking

ICG Insight Detail Template

As our premier thought leadership product, Citi Global Perspectives & Solutions (Citi GPS) is designed to help our clients navigate the global economy’s most demanding challenges, identify future themes and trends, and prosper in a fast-changing and interconnected world. 

Keep Exploring CITI GPS Content

Keep up to date with our latest insights.

Subscribe to Citi GPS

gpa-footer

gpa-menu

Citi, the leading global bank, serves more than 200 million customer accounts and does business in more than 160 countries and jurisdictions. Learn more today.

Global Investment Bank and Financial Services | Citi

Guidance on How to Combat Fraud

Related Stories

Be Prepared for the Unexpected

Video: understanding email scams

Sign up to receive the latest from Citi.