FINRA Guidance Misses the Security Mark

Source: Shutterstock.

Account takeover (ATO), in which hackers gain unauthorized access to digital accounts by obtaining users’ credentials, is on the rise in the financial services sector, accounting for 32% of all targeted account types as shown in a recent report from Security.org and Deduce. The repercussions of these attacks are numerous – downtime, customer attrition and reputational damage, to name just a few. There’s also a significant financial impact, as 89% of financial institution executives point to ATO as the most common cause of losses in their digital channel.

In response to these and other factors, FINRA recently released guidance to help firms combat ATO. While it’s encouraging that the organization wants to educate on the ATO threat, the recent summary contains a glaring omission: Namely, how organizations can ensure that credentials aren’t already compromised at the time of use. This is particularly relevant given the fact that compromised credentials from third-party data breaches is noted as the primary cause of ATO.