Banks must report even failed hacking attempts

U.S. banks have to promptly report any online theft, fraud or hacking attempts involving more than $5,000, even if they failed, under new guidance from the Treasury Department's money-laundering and financial crimes enforcement office FinCEN.

U.S. banks have to promptly report any online theft, fraud or hacking attempts involving more than $5,000, even if they failed, under new guidance from the Treasury Department’s money-laundering and financial crimes enforcement office FinCEN.

“A financial institution is required to report a suspicious transaction conducted or attempted by, at, or through the institution that involves or aggregates to $5,000 or more in funds or other assets,” states the guidance, issued this week. The banks should use the Suspicious Activity Reporting channels, or SAR, established under the 1970 Bank Secrecy Act, FinCEN states.

Examples of the kind of cyber events that must be reported include “unauthorized electronic intrusion,” “account takeover” and “malware intrusion,” but not “continuous probing or scanning,” according to an FAQ issued the same day.

When they file their SAR, banks should include “all relevant and available information regarding the suspicious transactions and the cyber-event — including the type, magnitude, and methodology of the cyberevent as well as signatures and facts on a network or system that indicate a cyberevent,” according to the FAQ.

The kinds of information required include:

• IP address and port information with respective date timestamps

• Uniform Resource Locator (URL) addresses

• Attack vectors

• Command-and-control nodes

• Suspected malware filenames

• Email addresses

• Social media account/screen names

“Cyberevents targeting financial institutions that could affect a transaction or series of transactions would be reportable as suspicious transactions because they are unauthorized, relevant to a possible violation of law or regulation, and regularly involve efforts to acquire funds through illegal activities,” the advisory states.

SARs are kept secret and disclosing their contents is a federal crime. The banks that file them enjoy wide-ranging immunity from any legal consequences.

The guidance is the latest additional cybersecurity measure recently imposed on banks. Others include the Office of the Comptroller of the Currency requirement that national banks file SARs to report unauthorized electronic intrusions; and guidance from the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation and the National Credit Union Administration requiring the filing of SARs to report certain computer-related crimes.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure