1
$\begingroup$

In disease evolution, one often finds that bacteria and viruses evolve to co-exist with their hosts and become less malevolent. Making an analogy between cybercrime and disease, I am wondering if there can be a symbiotic relationship between banks and cyber criminals?

Here is a more specific example of something I'm wondering about. A cyber criminal with access to a bank's books adds a bunch of car loans in various states of repayment. He then transfers the outstanding amounts of all these loans to himself. Then, at the end of every month, he doctors the bank's books to look like the loan payments have been made. If the bank were to detect such activity, it might be very reluctant to do anything. Doing anything, the result would be default on a large number of authentic looking loans. Doing nothing, the bank would continue to receive for all intents and purposes interest payments on its loans.

To some extent, I have confusion about what is real about any of this money that is changing hands. Can't a cyber criminal increase/decrease a bank's holdings just by changing a number in a computerized ledger book?

|improve this question
$\endgroup$
  • $\begingroup$ I asked this question on the personal finance stack exchange, but was told it was off topic. I'm trying again here. $\endgroup$ – user2309840 Oct 5 '16 at 19:10
  • $\begingroup$ If the criminal actually withdraws money from the bank, or sends it to an account at another bank, then the original bank is financially damaged by this and will want to stop it. If that has not happened yet then the original bank will still want to prevent it happening. $\endgroup$ – Henry Oct 5 '16 at 23:42
  • $\begingroup$ Isn't it in a bank's interest to make loans to clients who will pay them back? Here the client has no intention of actually paying anything back, but will promise to doctor the books so it looks like he is paying the money back. In my primitive understanding of banking, it is actually deposits which sit on the negative side of the bank's ledger -- they are obligations the bank must meet at some point in the future to its clients. Loans on the other hand generate interest and service fees which should increase the bank's capitalization and let it make more loans... $\endgroup$ – user2309840 Oct 6 '16 at 2:40
  • $\begingroup$ This might work well on Information Security Stack Exchange $\endgroup$ – paj28 Oct 7 '16 at 18:55
1
$\begingroup$

The vast majority of cyber crime is fraud. The criminals don't hack the bank directly; rather they hack the customers of the bank and commit fraudulent transactions.

I strongly doubt there is active collaboration. Some criminals may have insider contacts, but that's different to a symbiotic relationship.

There may be an effect somewhat like you mention. Increasing security is expensive for banks, so it is only worth doing if they are experiencing a certain level of losses. In theory it would make sense for criminals to restrict their level of activity, to avoid banks implementing additional security, which would make their job harder. In practice I don't think this happens, because their are multiple cyber gangs and I strongly doubt there is a gentleman's code between then.

It is theoretically possible for someone to hack the bank itself, and directly modify balances - effectively creating money out of thin air. In fact, it is thought that some major nation states (mostly US and China) have penetrated many banks around the word. However, if they started to extract money, this is likely to be noticed, due to internal checks and balances. It is more valuable for these state-sponsored actors to silently remain present, capturing information. And one day, perhaps they will strike, as part of a larger war strategy.

|improve this answer
$\endgroup$
  • $\begingroup$ I worry that the first statement you make is actually just bank spin. Of course whenever a bank or clearing house discusses the situation, they will try to deflect attention away from themselves and toward others who should try to do more to address the problem, i.e. customers or governments. The government also has an active interest in getting the general population to trust banks, given the magnitude of problems that might occur if that trust were lost. $\endgroup$ – user2309840 Oct 7 '16 at 20:34
  • $\begingroup$ @user2309840 - I've worked in infosec for some years and worked with several of the major UK banks. That statement is not just spin. I can't show you proof, but consider this: cyber criminals target the weakest link. They don't go after security conscious users, they target the easy prey: non-tech-savvy home users. Most banks could do a lot to improve their internal security - but they're still a tougher target than your average grandma. $\endgroup$ – paj28 Oct 7 '16 at 22:57
  • $\begingroup$ I bow to your greater experience, but the numbers are curious. Why go after grandma and her 50k bank account when you can go after NACHA and 41 trillion dollars in transactions in 2015? Create fake accounts for fake people who won't call up the FBI and complain? $\endgroup$ – user2309840 Oct 8 '16 at 2:36
  • $\begingroup$ @user2309840 - Because it's too hard. Even if an attacker compromises some intneral bank systems, it's difficult to execute such a fraud - the systems are complex and proprietary. It does sometimes happen. There's also the middle ground of targeting corporate clients of banks. Still, the majority of cyber crime is fraud against individuals. $\endgroup$ – paj28 Oct 8 '16 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.