Fraud rates continue to climb each year as fraudsters scale operations. For banks seeking to protect themselves from financial crime, it can feel like a losing battle.

The Federal Trade Commission received more than 2.4 million fraud reports in 2022, with total losses due to fraud rising more than 30% year over year to nearly $8.8 billion. 

Yet technological advances, new tactics and changing attitudes surrounding privacy offer significant tailwinds favoring banks and customers who want to keep their money safe.  

Nate Vanderheyden, executive director of U.S. banks cyber and information security at Morgan Stanley, outlined three positive trends he sees in the cybersecurity world last week at the Fintech Connect North America conference in New York. 

1. Security through transparency

FIs have been implementing account security measures beyond usernames and passwords for years, but they are increasingly understanding the importance of putting these tactics in context, according to Vanderheyden.

This “security through transparency” approach involves educating customers on the functions of common security protocols so customers understand their importance and use them correctly, Vanderheyden said.

“Give your clients the ability to make informed decisions,” Vanderheyden urged banks. He recommended explanatory content such as warnings to never share one-time passwords, as well as multiple options for multi-factor authentication, including biometrics and token-based alternatives. 

FIs across the industry are taking this advice to heart. For example, the JPMorgan Chase website features a Security section that begins with a page titled, “How we protect you,” detailing its security measures and explaining possible sticking points, including why the bank requires customers’ Social Security numbers. 

Bellingham, Wash.-based Industrial Credit Union added a page to its website in April titled “One-Time Password Scams” that explains how the technology works and advises clients not to share codes to defend against fraud. 

2. Generative AI for education

With the advent of generative AI, Vanderheyden sees an important use case that does not directly involve security: education.  

Generative AI is a “massive utility” for FIs and fintechs as they seek to “lessen the curve for new cybersecurity talent,” Vanderheyden said. He emphasized the technology’s interactive character, saying the ability to “prompt, challenge, ask questions” with generative AI makes it invaluable as a teaching tool. 

Large language models (LLM) like ChatGPT can aid cybersecurity instruction, even without specific training in the subject, according to a June 7 report from Georgetown University’s Center for Security and Emerging Technology. Though they have limitations, LLMs can effectively explain difficult concepts as students prepare for cybersecurity training exercises, according to the report. 

3. Threat modeling 

By gaming out possible attacks and system vulnerabilities through models, cybersecurity professionals can stay one step ahead of criminals, according to Vanderheyden.  

The goal of threat modeling is to profile bad actors and identify their most likely avenues of attack, according to cybersecurity firm Crowdstrike. Some FIs and fintechs have even turned to the criminals, bringing on ex-fraudsters as cybersecurity consultants. 

Banks should begin their path toward building threat models by holding awareness workshops across teams, fitting model risk management standards to cybersecurity use cases and looking to third parties to provide threat evaluations, according to an August report from McKinsey.  

“Staying on top of what adversaries are doing and applying that to the context of your business applications and services is the only way we’re actually going to be able to rise to the occasion,” Vanderheyden said.