INDUSTRY SOLUTIONS

Phishing Protection for Financial Services

Protect your business from phishing attacks with INKY's next-generation email security solution.

Why and How do Phishers Target Financial Institutions?

Accelerated by the pandemic, banking has moved almost entirely online and is likely to stay that way. Online access provides a thousand avenues phishers can pursue in their quest to despoil people of money. And financial institutions provide a perfectly fungible commodity: money. Once phishers pilfer it, it disappears in the night.

In addition, financial institutions interact with a wide array of other individuals and institutions. In sum, banks are where the money is, there's lots of interaction between people who don't necessarily know each other well, and security systems and protocols are uneven at best. An attack starts with a phishing email, sent, perhaps, from a trusted but hijacked account known to the recipient, maybe impersonating a trusted brand or person in the company's own hierarchy.

Request a demo.

How are Financial Institutions Currently Protected?

At the moment, most financial institutions deliver their email through either their own on-premise Exchange server or a secure email gateway (SEG) provider — including but not limited to Microsoft, Proofpoint, and Mimecast. These services have only rudimentary protection against phishing. Phishing attacks are like nuclear missile sallies. It’s not enough to stop 99% of them; it has to be 100%.

In the tight window between when an email server receives a mail and when it has to deliver it to a recipient’s inbox, the SEGs can only examine the universal email tests (DKIM and SPF), take a cursory look at the nature of the message with regular expression matching, and look up the sender’s address on whatever bad lists they have on the shelf. With this limited examination, they can't spot the phish. And this is the best case. Most can’t run their full analysis stack on every email because it takes too long.

Request a demo.

How Does INKY Stop Phishing Attacks on Financial Institutions?

INKY sits downstream from the SEG and spends less than two seconds looking at an email before dropping it in the recipient’s inbox. From this privileged position, INKY catches all the phish that get past the SEGs (proof that they’re not catching them and we are). Recently, INKY processed its billionth email. It's seen a lot of phish they missed.

What INKY does during that two seconds is release a swarm of mathematical models on the email’s raw HTML code. They all operate simultaneously on it, testing for this and that (our secret sauce), and formulating an “opinion,” which is in fact a number on a scale, representing the results of its particular test.

Request a demo.

Real-time phishing awareness training.

One more model takes the output of all the rest and comes up with an overall score that represents how bad INKY thinks the email is. This value is interpreted to create a colored banner, which is inserted in the email before it's passed on to the recipient’s inbox (and pulled back out of any reply on the way out).

Beyond a certain threshold of badness, the banner is red. Suspicious, maybe spam, but not necessarily outright dangerous? Yellow. Neutral gray means no thresholds were triggered.

The banners also have feedback links that allow the recipient to correct INKY (e.g., That’s not spam; that's my Wall Street Journal subscription!). When an authenticated INKY user designates something spam in the feedback dialog, they have the opportunity to block the sender — or even the sender’s entire domain, a favorite feature of many customers.

Request a demo.

INKY-Mobile-Desktop-and-Banners_GsuiteGray,-yellow,-red-banner

Can you rely on your end-users to be on high-alert for all of these phishing tactics across all devices?

Brand Hijacking

Detect brand-indicative and scam-indicative images using computer vision models.

Text Anomalies

Find brand-indicative and scam-indicative text using approximate matching.

Brand Impersonation

Determine the apparent brand using color palette, layout features, prominent text, and more.

Zero Font

Pinpoint zero-font and other forms or hidden text.

Text Cloaking

Identify Unicode homographs, typos, and other text cloaking.

Ready to see how INKY is the smartest investment you'll make in email security?

Learn More

The financial industry is an especially popular target for phishing attacks because it has exactly what cybercriminals are after – money. Hackers can target the institution’s money or go after their customers. There are a number of schemes that phishers have devised and each year they become more sophisticated. Within the financial sector, hackers can steal bank account numbers, log-ins and PINs, and credit card numbers. They can also steal sensitive data from institutions and hold it for ransom or sell it on the dark web.

According to one recent report, 20% of all employees will click on a phishing email link. From there, more than 65% will enter their credentials into a phishing site.¹ That means there are two main ways to prevent phishing attacks from harming your business. You can either stop the employees from falling for phishing emails, or you can stop phishing emails from showing up in their inboxes. The first choice is next to impossible since human error is what sets a phishing attack in motion. You can, however, protect your business with a third-party software solution that recognizes and stops phishing emails.

As the most comprehensive malware and email phishing protection available, INKY takes the responsibility of recognizing phishing scams away from employees and IT departments. It scans every sent and delivered email automatically and flags malicious emails, protecting your organization and your clients from even the most complex threats. INKY’s intelligent machine learning algorithms identify abnormalities in emails, even if the threat has never been seen before.

¹Source: https://terranovasecurity.com/2020-gpt-report/

The financial sector invites every type of phishing attack, however, at the top of the list are data breaches and credential harvesting. When a hacker creates a phishing scam designed to capture a financial institution’s data, it might contain customer email addresses, account numbers, passwords, balances, credit card numbers, PINs, and more. The hacker can sell this data on the dark web, hold it for ransom (ransomware attack), or email all customers on the list and trick them into giving up their banking credentials. This phishing threat – known as credential harvesting - usually involves a phishing email suggesting they must log into their account for some sort of routine verification or even an emergency. The link usually takes the unsuspecting victim to a fake site that looks like their banking page but is really there to capture their information. The financial sector has also been known to receive a large amount of business email compromises or CEO impersonation phish. In these cases, they are usually trying to dupe someone into thinking they are transferring money, paying a vendor, or sharing sensitive information with a boss or colleague when in actuality, they’re delivering the goods right into the hands of a cybercriminal.

Banks, and similar institutions where there is access to cash, will always be a target for cyberthieves because they presumably have easy access to cash. Examples might include:

Credential harvesting: Stealing your personal information and using it to open a new credit card in your name.
Account takeover – gaining access to your banking information, changing your passwords and other information so you are locked out and they have full access
Business Email Compromise – phishers disguised as someone you know, or even a charity, might ask for a loan or donation and convince you to send money to a phoney bank account.

Products

Featured Resource

Annual Report - Volume, Impact, Variety, and Sophistication of Phishing Attacks on the Rise

By Use Case

By Industries

By Platform

Education

Featured Resource

Email Security Annual Report - Download to learn about phishing trends uncovered in 2023 and predictions for 2024.

Partners Featured Resource

Why INKY for Managed Services

INDUSTRY SOLUTIONS

Phishing Protection for Financial Services

Why and How do Phishers Target Financial Institutions?

How are Financial Institutions Currently Protected?

How Does INKY Stop Phishing Attacks on Financial Institutions?

Real-time phishing awareness training.

Can you rely on your end-users to be on high-alert for all of these phishing tactics across all devices?

Brand Hijacking

Text Anomalies

Brand Impersonation

Zero Font

Text Cloaking

Ready to see how INKY is the smartest investment you'll make in email security?