In-depth Guide to Digital Lending Cybersecurity in 2023

Blog Post Digital Lending January 29, 2023

Interpol reports a 569% growth in malicious registrations, including malware and phishing, and a 788% growth in high-risk registrations. And it’s just the ones that were detected and reported. And since the trend toward the migration of businesses online, the potential for increased financial benefit will see cybercriminals continue to ramp up their activities and develop more advanced and sophisticated techniques.

For many companies, digital transformation plans have been radically changed and forcefully quickened by the remote-first policies of the Covid crisis. And when digitalization is forced, many cybersecurity holes can be overlooked and can lead to data loss, breaches, or even a takeover of the lending automation system.

Given the sensitive nature of the data lending operations collect, process, manage, and store, ensuring bulletproof cybersecurity is one of the cornerstones to build the foundation of a digital lending business on, to gain trust, and be a reliable partner to the borrowers.

Today’s lenders contend with credentials stuffing, phishing attacks, ransomware, spyware, keyloggers, worms, and compromised accounts every day of the week. There are so many diverse threats, and so many high tech security solutions, that it can be difficult to determine the best tools for your business.

Lender best practices in cybersecurity include both tried-and-true techniques as well as cutting edge technologies. The goal is to protect your customers’ personal information along with your business data using a combination of physical, electronic, and procedural safeguards that meet all applicable federal, state, and international regulatory requirements.

And if cybersecurity isn’t on your agenda, as a digital lender, you may be missing out on what’s going on on the web around your business. And if at some point you believe that your lending operation is impregnable, then your early warning system may not be working correctly. Remember that it takes an average of 69 days to identify a breach.

Unfortunately, consumers often are not aware their information has been compromised until they start to see signs of identity theft on clients’ accounts. Fraudsters generally use the information for credentials stuffing. This is a criminal activity where automation software attempts to access other accounts owned by the same customer. They do this by recycling the same user name and password combination on other websites.

Measures to combat most common cybersecurity threats

Only a large-scale bank with enterprise resources has the capabilities to develop and maintain a proprietary competitive lending automation system. With the development of lending technology, that becomes similar to creating your own e-commerce engine, instead of using some ready-made alternative tailored to your needs. It’s near impossible to keep up with cybersecurity threats in-house even if you have a dedicated department for the development and maintenance of the software.

TurnKey Lender’s end-to-end lending processes automation platform has received the SOC2 Type II certification, the standard operating procedures of the company are strictly audited for organizational oversight, vendor management, risk management, and regulatory oversight.

A SOC 2-certified service organization is appropriate for businesses whose regulators, auditors, compliance officers, business partners, and executives require documented standards. SOC 2 Type II is considered to be the most reliable certification to look for in a potential service provider’s credentials and proves the system to be designed for secure storage and operation of sensitive data.

Other than all the cyber-security best practices, to improve AML, KYC, as well as risk assessment, for every loan application, TurnKey Lender conducts bank statement analysis, credit bureau checks, network and cybersecurity checks, application data checks, as well as a list of configurable decision rules.

As a lender, you have to counter hacking attempts through insecure interfaces and APIs, borrower identity theft through two-factor authentication, lack of cloud security architecture and strategy, insufficient identity, credential, access and key management, money laundering attempts, configuration and inadequate change control, account fraud, and any number of ever arising new security threats.

The key approaches to get a hold of the customer and business data used are credentials stuffing, phishing attacks, ransomware, spyware, keyloggers, worms, compromised accounts, etc.

Fortunately, most attacks can be prevented by ensuring borrowers and employees follow basic rules for their password security and two-factor authorization, and the measures taken by the lending automation platform you use. For example, all of the above is addressed in the TurnKey Lender platform and the security features can be tailor-fit to each particular creditor.

TurnKey Lender also applies face and document recognition, integrated into the loan application workflow. The borrower takes a photo of themselves and their ID, and our system will analyze and cross-reference the two. When creating a loan application, the borrower can take a photo of themselves with the built-in camera of their device or the webcam.

Many lenders require borrowers to attach a photo to the loan application (optionally you can request photos with a form of ID for even greater security).

CYBER SAFETY, DIGITAL LENDING BEST PRACTICES

At TurnKey Lender we’ve identified six cyber safety best practices that should be part of every lender’s playbook:

Build a solid foundation
Turn staff into cyber warriors
Detect fraudulent loan applications
Prevent account takeovers
Identify cross-device use
Analyze borrower data
Use two-factor authorization
Deploy a cloud-based lending platform.

Feel free to download the whitepaper we wrote around creating a cybersecurity playbook here.

Cybersecurity disaster recovery plan outline

The purpose of the Disaster Recovery Plan (DRP) is to maintain the continuous operational capacities for all systems powering your digital lending operation. For every business, recovery plans after an attack differ but here’s a high-level overview of what we do in case TurnKey Lender.

In Turnkey Lender we use data centers and server hostings worldwide to prevent loss of any customers’ data. The DRP we apply is universal and applicable for all systems based on Turnkey Lender software platform.

The DRP must be executed in the event of the collapse of the system caused by technical, natural, or human-made disaster.

To maintain the capability for the fastest recovery TurnKey Lender:

Saves all the source code for the software on both local and remote hosting servers with RAID massives storage structure.
Performs regular daily backups of the live system databases and downloads them to a different server.
Performs ongoing mirroring of the databases.
Maintains the server hostings in Europe, Asia, Australia, and North America with extra capacity for an emergency set up for systems from collapsed servers.
Provides 24/7 technical support for all the customers’ systems by the team trained to execute this DRP in the shortest terms.

In case of an attack, Turnkey Lender can instantly:

deploy the system copy to the hosting server where it was previously functioning, if the disaster was not caused by this server hosting issue. Otherwise, the system shall be installed to one of the other servers maintained by TurnKey Lender;
upload the database to the safe and fully operational data center which is available and located closest to that where the recovered system is being installed, and
proceed with the system settings set up.

But each operation differs and your optimal recovery plan against breaches can include extra steps, But it’s important to have a clear vision to carry out the four key components of a working policy:

Plans to protect against a breach
Plans to encrypt and obfuscate data in case of a breach
Plans to decoy data and lure attackers away from valuable information
Plans to respond immediately when a threat has been identified or an actual breach has occurred.

BUILD A SOLID FOUNDATION

Lenders who treat cybersecurity like a DIY project are taking a big risk. Cybersecurity must be an ongoing initiative led by a designated cyber safety director. Your company should tap the expertise of both cyber safety and compliance consultants to help you develop, implement and maintain your program. Their experience should include a strong track record in the lending industry. And experience defending cybersecurity programs that were audited by a regulatory agency.

They’ll start by reviewing your entire ecosystem for potential security gaps, including data collection, storage, encryption, transmission protocols, and interfaces with outside third-party vendors. Mobile apps require special scrutiny, including platforms, servers, GPS receivers, cameras, sensors, social media accounts, etc. And you’ll want to monitor and maintain proper security over the life of a financial product, not just during launch.

Today’s lending industry sits in the eye of a perfect storm, driven by three key components. First, alternative financing, fueled by fintech mobile apps, is growing by 51% per year. And traditional lenders are all going digital. It’s big news that’s catching the attention of hackers. Second, massive data breaches are throwing enormous amounts of personal financial data out on the dark web. And third, instant-decision software systems, often supported by third-party vendors, create a variety of vulnerabilities that cybercriminals are ready, willing, and able to exploit.

Keep Educating Staff & Borrowers

The vast majority of system breaches are caused by employee error or third-party vendors who mishandle data. Unfortunately, hacking via these two entry points is on the rise.

Help your staff understand how easy it is to cause a breach. That it’s no more complicated than opening an email attachment, installing a thumb drive on a network computer system, sharing a document via personal email, or installing a business program on a personal computer. Your entire system can be instantly infiltrated with the intrusion lying dormant and difficult to detect until triggered from an outside source.

As soon as your team understands how they can become a hacker’s best friend (or worst enemy), then they’re already armed with the weapons they need to defend against an attack.

Your company may want to connect with one of many employee education programs that specializes in teaching and reinforcing cyber safety practices. They can even conduct blind tests to show your staff how vulnerable they are to a cleverly designed Trojan horse. The high cost of a data breach makes these programs well worth the investment.

DETECT FRAUDULENT LOAN APPLICATIONS

Lenders are constantly balancing risk and reward. As the credit decision process becomes more automated lenders must determine the best way to use security filters to reduce risk. Underuse increases the risk of fraud as you approve more bad accounts, but overuse reduces sales revenue as customers abandon applications and go to your competition.

Start by implementing basic security protocols for AML (anti-money laundering), CIP (customer identification program), and KYC (know your customer). An advanced approach is to participate in a global shared intelligence database that flags stolen identities in real-time. These tactics can all be integrated into an automated system, where potential fraud is detected and prevented automatically without any inconvenience to a good application.

Learn more: What You Need to Know About AML and KYC As a Digital Lender in 2022

PREVENT ACCOUNT TAKEOVERS

Another advantage of the global shared intelligence database is that it can help prevent unauthorized account access. Consumers and businesses tend to use the same user name, email address and password to open multiple accounts. So a fraudster can use the same stolen credentials to open new accounts and gain entry to existing accounts, where they’re free to siphon open credit or request a line increase. All without the owner’s knowledge.

We recommend a layered cybersecurity solution when it comes to account access. Start by encouraging customers to activate 2-factor authentication. Then integrate your software systems with a global shared intelligence database that flags suspicious log-in attempts from unknown mobile devices, known botnets or masked locations.

IDENTIFY & CONTROL CROSS-DEVICE USE

Consumers demand omni-channel access to their accounts. On Monday morning a husband pays a bill before work from a home PC. On Wednesday lunchtime his partner deposits a check to their joint account using a smartphone with a coffee shop WIFI connection. On Thursday afternoon she checks their account balance from her office computer. On Thursday night, while lying in bed, he updates profile information using a smartphone with a home WIFI. And on Saturday morning they transfer funds between accounts and request a line increase over breakfast using their tablet or laptop with diner WIFI.

This level of cross-device activity used to be the domain of young techno-geeks, but Zoomers, Millennials, and even Baby Boomers are getting in on the act. Their grandchildren activate online account access and then walk them through their first transactions. Consumers of all ages are addicted, and lenders are scrambling to differentiate legitimate activity from fraud in real-time. Customers appreciate protection when it’s invisible, but you risk losing them to the competition when a fraud alert disrupts their day.

21st-century leaders need sophisticated software with real-time identity updates to ensure a seamless experience. A comprehensive profile includes physical address, multiple users, multiple email addresses per user, multiple computer and mobile devices, as well as location geo-targeting for mobile devices.

US LENDERS DRAFTED INTO SERVICE

Many countries around the globe recruit young hackers, and redirect their creative talents towards government-sponsored cyber safety programs. Unfortunately for US lenders most of their cyber talent supports private industry or criminal enterprise. US regulatory agencies are pushing prevention and accountability for cyberattacks onto the private sector. Lenders have literally been drafted into service, where they’re now serving as soldiers in the war on cybercrime.

The best way to prevent similar worldwide regulated lender accountability is through industry self-regulation where bankers, non-bank lenders and fintech providers pool intelligence. So everyone implements the strongest cyber safety programs available.

“As always, TurnKey Lender is committed to protecting our clients and their data. We are proud of the way our technical and security teams balance award-winning usability and enterprise-grade security in our software. TurnKey Lender’s security policies exceed regulatory requirements for data security, going above industry standards, and best practices, because we know just how important cybersecurity is today. And we are committed to safeguarding customer data with the same vigor and attentiveness to detail as we always have,” states Elena Ionenko, Co-Founder and COO at TurnKey Lender.

Previously, TurnKey Lender successfully obtained the SOC2 Type I and SOC2 Type II compliance reports and the globally-recognized ISO 27001 Certification. Learn more about data security and compliance on the TurnKey Lender Information Security page.

Reach out and schedule a live TurnKey Lender demo today to learn about the security measures we’ll take to protect your business.

Request a demo.