People get hit by scammers all too frequently these days. I know this because I am often tasked with trying to rescue them from said scams. And the number one way that Americans lose money to scams is via Zelle transfers. For those who haven’t heard of Zelle, here’s what Wikipedia says:
Zelle is a United States–based digital payments network run by a private financial services company owned by the banks Bank of America, Truist, Capital One, JPMorgan Chase, PNC Bank, U.S. Bank, and Wells Fargo. The Zelle service enables individuals to electronically transfer money from their bank account to another registered user’s bank account using a mobile device or the website of a participating banking institution. There is no fee or charge on the transaction.
Now the banks above have been under pressure to refund money to consumers who have been defrauded in this manner via scammers who use Zelle to send money from consumers to themselves. But they’ve pushed back on this to some degree:
JPMorgan Chase, Bank of America and Wells Fargo have reportedly agreed to testify at a US Senate hearing over hundreds of millions of dollars in fraud on the payments network Zelle.
Executives involved in the banks’ payment operations are expected to appear on July 23rd, reports Politico, citing sources who were allowed to speak anonymously about the plan.
The hearing will be held by the Permanent Subcommittee on Investigations, which says the banking giants’ customers reported $456 million in fraudulent transactions on Zelle in 2022 – with the banks refusing to reimburse $115 million in claims.
That’s where The Electronic Fund Transfer Act comes in. This is meant to protect consumers from this sort of thing. Here’s what John Gunn, CEO, Token had to say:
Consumers are very well protected in the United States, much more so than other Western Countries. Because the cybercriminals are most frequently based in enemy states, criminal prosecutions are very few and far between.
The ETPA has been remarkably effective in protecting consumers. It is likely that consumers have received billions of dollars of reimbursements over the years. But you also have to look at the level of involvement of the consumer and their actions. The ETPA was not enacted to absolve consumers for any responsibility in safeguarding their accounts. This is the digital age, when someone is a victim of fraud it invariably involves funds being transferred electronically from a victim to a criminal. Banks cannot possibly take on responsibility for every instance of fraud involving electronic funds transfers.
Banks and the media invest considerable time and effort in training consumers to spot scams and fraud. Consumers need to invest more time in learning how to spot fraud and to follow basic rules about not clicking on unknown links and not trusting unknown individuals who claim to work for their bank.
Banks do a lot of work to educate their customers. If you have used Zelle, you have seen, and hopefully read, the obvious warnings. Collectively, banks invest billions in fighting fraud and protecting their customers. Cybercriminals are now using generative AI and other advanced tools that pull the victim’s information from social media to attack consumers and this requires a higher level of care and diligence by consumers.
The regulatory framework is already very strong and should not be changed to protect consumers from their own negligent behavior. If we subscribe to this way of thinking then every customer has to pay for this. Why should those who are careful to avoid scams and fraud pay for the carelessness of those who are not?
Because I deal with scams, I would argue that there are all sorts of areas where improvements could be made. Education is one as there isn’t enough of that. But regulation is another as that needs to always evolve to meet new and emerging threats. I for one will be really interested to see what comes of these hearings, and what these CEO’s have to say.
Security Pros Admit to Using Unauthorized SaaS and AI (Despite the Risk) – NextDLP
Posted in Commentary with tags NextDLP on July 9, 2024 by itnerdNext DLP today revealed that nearly three-quarters (73%) of security professionals admit to using SaaS applications that had not been provided by their company’s IT team in the past year. This is despite the fact that they are acutely aware of the risks, with respondents naming data loss (65%), lack of visibility and control (62%), and data breaches (52%) as the top risks of using unauthorized tools. Adding to this, one in ten admitted they were certain their organization had suffered a data breach or data loss as a result.
A survey of more than 250 global security professionals, conducted at RSA Conference 2024 and Infosecurity Europe 2024, also revealed that despite having a laissez-faire attitude towards Shadow SaaS, security professionals have taken a more cautious approach to GenAI usage. Half of the respondents highlighted that AI use had been restricted to certain job functions and roles in their organization, while 16% had banned the technology completely. Adding to this, 46% of organizations have implemented tools and policies to control employees’ use of GenAI.
The research also provided a snapshot of how security professionals view their organization’s training and overall understanding of the risks of Shadow SaaS:
For further insights into the survey results, please see the full results report linked here. Or, for more information about Shadow SaaS and AI, and the possible defenses, visit the Next DLP website.
Methodology
The survey of more than 250 global security professionals was conducted at RSA Conference 2024 and Infosecurity Europe 2024. Each respondent was asked the same ten questions surrounding Shadow SaaS and Shadow AI usage within their organization, the implied security risks, and the policies and security tools their company has in place.
Leave a comment »