New LexisNexis Risk Solutions data has revealed Australia has experienced a significant increase in bot attacks, with a 169% jump year-over-year, compared to a 19% decrease in the Asia-Pacific (APAC) region on average.
This surge is likely due to the availability of breached data in 2022, which cybercriminals are exploiting to launch automated attacks, according to the latest LexisNexis Risk Solutions Cybercrime Report – the Australia Edition.
“Several prominent Australian companies experienced cyberattacks last year, exposing millions of customers' data to cybercriminals, resulting in significant fallout,” according to Kon Poptodorov (pictured above left), ANZ director at LexisNexis Risk Solutions.
Worse still, it’s Australia’s 2.4 million small businesses – and especially financial businesses like mortgage brokerages – that are most at risk.
On November 8, many Australian woke up to their internet services being down. While it was due to an Optus system failure, the same thought collectively went through many minds: not again.
Australians are scarred from cyberattacks, exposed to their expense and scope late last year. The Optus 2022 cyberattack alone affected nearly 10 million people and cost at least $140 million.
Bot attacks – which are a type of cyberattack that uses automated scripts, or bots, to disrupt a website or steal data – are not a new phenomenon. However, the current number of bot attacks being detected in Australia is unprecedented.
Bots can be programmed to perform a variety of tasks, such as sending spam emails, overloading website traffic, or downloading malware.
Poptodorov said bots were not only used by individual fraudsters, but also in criminal teams around the globe.
“Bot networks are diversifying, potentially seeking to originate from locations previously unconnected to bots to circumvent basic bot mitigation measures, as demonstrated by the substantial increase in bot attacks originating from Australia,” Poptodorov said.
With the names, emails, passwords, and medical information of Australians being traded on the dark web, the mission for hackers to sign up more bots to these networks has become considerably easier.
In comparison to other countries in the APAC region, language presents another crucial factor.
“Diverse languages spoken across countries add an additional layer of complexity for cybercriminals,” Poptodorov said. “In Australia, malicious actors only need to employ English to deceive users, which may be another factor that attracts cybercriminals to the region.”
While the risk has increased across the board, financial services companies, such as mortgage brokerages, banks, and insurance companies, are more likely to suffer a bot attack, according to LexisNexis.
The risk solutions company’s True Cost of Fraud APAC Study showed these companies face a “higher fraud multiplier” resulting in elevated fraud costs compared to other organisations.
“This is primarily due to their account-based operations and the necessity to reimburse or recover funds lost to fraudulent activities from customer accounts, often requiring increased use of internal and external resources for investigation, detection and recovery efforts,” Poptodorov said.
As customers increasingly shift towards digital channels, online transactions take place within a relatively anonymous environment when compared to traditional in-person interactions.
Poptodorov said relying solely on physical identity attributes such as name, address, and date of birth “is inadequate” for authenticating genuine customers.
Data from mortgage aggregator Connective showed a similar story, experiencing a 50% surge in cyberattacks targeting brokers and clients.
Daniel Oh (pictured above right), Connective group counsel, urged brokers to remain vigilant and shift their focus from merely protecting data and systems to proactively mitigating cyber threats.
“Threat actors pose a significant risk in our industry due to the highly sensitive data we capture, hold and send on a regular basis,” Oh said. “Even the smallest cyber security incident can have devastating impacts on both the business and clients.”
Small businesses are also at risk due to their limited fraud prevention strategies and potential operational impact of cyberattacks.
Recent examples in the media illustrate the potentially devastating impact of cybercriminal activities on small companies.
‘Small businesses often prioritise day-to-day operations over the development of robust fraud prevention strategies, rendering organisations without adequate protection measures as appealing targets for cybercriminals,” Poptodorov said.
With the threat increased, many companies have bolstered their defences against these types of cyber-attacks.
NAB added 70 staff to its investigations and fraud team in the past financial year, which prevented and recovered over $200 million in scam losses for customers since September 2021.
ANZ introduced its Scam Safe technology, which provides greater controls to customers, extra security measures for ANZ Plus and education on related threats.
Through these measures, ANZ removed 1,600 fraudulent websites, over 20,000 SMS scams, and blocked 12 million attacks against customer facing services each month.
But while these mass cyber investment strategies help reduce risk among the big end of town, most businesses at risk do not have the capacity or resources to fully be protected.
However, there are still preventative measures business owners and brokers can do.
Poptodorov said small businesses must focus on the adoption of a multi-layered anti-fraud approach, including digital fraud prevention measures that prove more effective in early detection and mitigation of fraud and its associated costs.
“It is crucial for small businesses to grasp the potential operational impact of such attacks and proactively implement protective measures,” Poptodorov said.
In contrast, Poptodorov emphasised the need for financial institutions to adopt more advanced, multi-layered fraud management strategies that consider both digital risk factors, such as device and online session parameters, and behavioural intelligence, which analyses how customers interact with their devices.
“This also involves educating both staff and customers about the risks associated with digitisation and how to recognise and safeguard themselves against scams.”
How are you protecting your business from bot attacks? Comment below.
