Research suggests UK banks are lagging on email cybersecurity measures exposing customers, staff, and stakeholders to increased risk of email-based impersonation attacks. Credit: Rawpixel/Shutterstock More than half of banks incorporated in the UK are lagging on email cybersecurity measures, subjecting customers, staff, and stakeholders to increased risk of email-based impersonation attacks. That’s according to new research from cybersecurity firm Proofpoint, which analysed 150 banks incorporated in the UK as listed by the Bank of England. It found that only 47% implement the strictest and recommended level of Domain-based Message Authentication, Reporting and Conformance (DMARC) – an email validation protocol designed to protect domain names from being misused by cybercriminals. DMARC authenticates a sender’s identity before allowing a message to reach its intended destination. DMARC has three levels of protection – monitor, quarantine, and reject, with reject being the most secure for preventing suspicious emails from reaching the inbox. The lack of such protection against email fraud exposes organisations to increased risk of businesses email compromise (BEC). According to Proofpoint’s 2023 State of the Phish report, 86% of UK organisations reported an attempted BEC attack last year. Almost a third of UK banks have no DMARC protection at all Proofpoint’s research revealed that while 70% of the banking institutions analysed have taken the initial steps to protecting customers from email fraud by publishing a basic DMARC record, only 47% have implemented the recommended level of reject. This level enables the proactive blocking of spoofed emails from reaching recipients inboxes, decreasing the risk of email fraud. What’s more, 30% of the banks studied have no DMARC protection in place at all, while 18% only have a monitoring policy for spoofed emails, thereby still allowing potentially malicious spoofed emails into the recipient’s inbox, according to Proofpoint. “Banking institutions are a prime target for cybercriminals due to the vast amounts of sensitive personal and financial data they store,” said Matt Cooke, cybersecurity strategist at Proofpoint. “With continuous digitalisation in the banking sector and increased usage of mobile apps by customers, it is crucial for these institutions to prioritise cybersecurity measures to safeguard against potential cyber threats.” UK banking CISOs have work cut out to tackle security inadequacies Research from earlier this year suggests that CISOs in the UK banking industry have their work cut out to address key security inadequacies. In February, consumer goods and services testing company Which? tested the customer-facing security systems of 13 leading UK banks, revealing that basic security flaws on websites and apps are putting consumers at increased risk of fraud. Which? assessed for login, navigation and logout, account management, and encryption for both online banking security and app security. Banks were marked down for things like not adequately blocking weak passwords, sending one-time passcodes or other sensitive information via text messages, and failing to log customers out after five minutes of inactivity. Meanwhile, findings from Imperva discovered that Open Banking – implemented by several of the largest UK banking providers – has contributed to making UK banks and financial services an increased target for cybercriminals. Imperva stated that financial services companies were targeted by 28% of all cyberattacks on UK businesses over the course of 2022, driven by digital transformation and regulation such as Open Banking. Application programming interface (API) abuse, DDoS attacks, and bad bots were cited as three of the biggest cybersecurity challenges for the industry. Related content how-to Download the hybrid cloud data protection enterprise buyer’s guide From the editors of our sister publication Network World, this enterprise buyer’s guide helps network and security IT staff understand the issues their organizations face around protecting corporate data in a hybrid cloud environment and how to By Neal Weinberg May 20, 2024 1 min Cloud Security Data and Information Security Enterprise Buyer’s Guides news analysis Global stability issues alter cyber threat landscape, ESET reports With conflict on the rise, regional APT groups are increasing activity, altering focus, and putting specific industries in their crosshairs. Here’s what CISOs should know. By Evan Schuman May 20, 2024 4 mins Advanced Persistent Threats Cyberattacks Threat and Vulnerability Management feature The inside story of Cyber Command’s creation Cartoons, Starbucks cards, and Hollywood storyboards: The ‘Four Horsemen of Cyber’ — CISA’s Jen Easterly, Lt. Gen. S.L. Davis, retired US Navy Vice Admiral T.J. White, and former NSA chief Paul Nakasone — revealed at RSA By Cynthia Brumfield May 20, 2024 8 mins Aerospace and Defense Industry CSO and CISO Military news analysis SEC rule for finance firms boosts disclosure requirements Amendments to Regulation S-P requires broker-dealers, investment companies, registered investment advisers, and transfer agents to disclose incidents to customers. By Evan Schuman May 17, 2024 5 mins Data Breach Financial Services Industry Data Privacy PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe