Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack.

  • What should the IT Security department of a Broker/Dealer do to specifically address and mitigate these threats?

  • What technical solutions should be put in place? (or be enhanced accordingly)

  • Does anyone have additional information on these attacks? (e.g. breadth, scope, etc?)

share|improve this question
up vote 1 down vote accepted

If you look at the guidance provided, they give a couple of specifics that are relevant for IT Security:

  • Perform out-of-band authentication and verification of the payment instructions through a validated contact channel.

Ensure your controls are enforced so that individuals cannot sidestep your current out-of-band authentication and verification

  • Leverage payment instruction and transaction anomaly tools to flag suspect transactions.

If you run statistical analysis tools to alert on anomalies, they may well already be picking up this sort of wire transfer fraud.

  • Use traditional security tools (DLP, spam filters, etc.) to search for e-mails with key words like “wire + funeral”, or “wire + travel,” etc. Clients and employees noted in 3 flagged messages should then be contacted directly by other resources within your financial institution.

This is probably the key IT control here - even a basic DLP solution should allow you to search for these words at your mail gateway, which can pick this up rapidly.

It is a fairly standard social engineering attack, relying on the financial institution wanting to be as helpful as possible to the customer in dire straits. As staff are only human, enforcing IT controls is the simplest way to avoid a 'helpful' member of staff bypassing procedures and then becoming a victim.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.