How can threat intelligence benefit the banking sector?

During these unprecedented times, social upheaval has also taken place, from anti-police and anti-racism protests taking hold in the United States, to anti-lockdown protests spreading far and wide across the globe, as individuals become increasingly weary and afraid of the state of affairs caused by the pandemic. This increase in unrest at a global scale has added another layer of uncertainty and security threats for businesses to monitor and build out mitigation strategies for.

The banking sector, considered in this piece as its physical infrastructure from ATMs to bank branches and corporate offices, but also the cash logistics side of the sector, faces a number of threats on a daily basis. The rise in online banking and cashless transactions have led to additional risks, such as cybercrime, which in turn can poses significant reputational impacts for the banks, notwithstanding the damage caused to clients. However, this piece only looks at some of the physical threats the sector faces.

While the number of physical bank branches in the United States has started to decline due to the digitization of services, there still remains tens of thousands of branches, and banking institutions in the United States also have interests and branches abroad. Additionally, banking institutions in other regions of the world face similar physical threats, and the cash logistics industry continues to be multi-billion a year industry for companies tasked with moving large sums of money to and from branches, ATMs, and businesses.

Traditional threats such as burglaries/thefts, ATM robberies and armed robberies are continuously faced by bank branches in the United States and across the world. Intelligence Fusion monitors, geolocates, and records these incidents in order to provide clients a more complete picture of the threats that banks face. Through our detailed incident form, which includes an ‘Involved Parties’ section, we are able to ascertain which banks have been most commonly targeted, determining whether large multi-national banks are the primary target or whether the smaller local credit unions are more likely to be targeted.

Understanding the modus operandi of suspects is also key in order for banks to put strategies in place to mitigate the threats. Each incident of burglary/theft, ATM robbery or armed robbery targeting a bank branch or standalone ATM are also tagged with key terms in order to better understand how the crime was committed. Some of these tags like ‘firearm’ or ‘knife’ may be used for incidents to determine what type of weapon is most commonly used. Finally, the tag ‘ATMbombings’ is used for incidents of explosives being used to rob ATMs. We’ve observed instances of such a crime in the United States, but also in countries like Brazil where ATMs have commonly been targeted with dynamite or using a method involving filling up the ATM with gas to ignite and blow up, in order to gain access to the cash drawers.

Recent unrest, particularly in the United States, has showcased the vulnerabilities of bank branches and stand-alone ATMs. Since May 2020, a wave of anti-racism and anti-police protests have taken place across the country, with some protests being infiltrated with anarchist and anti-capitalist elements. These protests, while the majority have been peaceful, can and have devolved into looting and vandalism. We’ve been monitoring these protests since they began in May, and have recorded the incidents of vandalism, looting, and ATM robberies throughout the unrest.

Having access to historical data as well as real-time incidents provides additional insight to financial clients, such as areas most likely to see unrest. In turn, this allows banks and financial institutions to know which branches may be at risk and where additional security measures may need to be implemented. With Intelligence Fusion, for example, we never archive any of our incidents. This allows you to search as far back as 2014, which can be key to fully understanding the threat landscape within the financial industry.

While this period of unrest has been significant, recent years have also seen bank branches and the corporate offices of banks being targeted for other reasons. The growing environmental movement in the last few years has seen protests and direct-action targeting banks funding oil and gas companies. In May 2018, activists protested outside a Morgan Stanley annual shareholder’s meeting due to the company’s role in funding several pipeline projects like the Dakota Access Pipeline and the Bayou Bridge Pipelines, while in September 2019, climate change protesters gathered in the Financial District of San Francisco to demand that banks divest their interests from oil and gas companies.

With the economic impacts that COVID-19 has had on individuals, there have also been protests outside banks demanding rent and mortgage relief, and these types of protests are likely to increase dependent on any federal funding for individuals to avoid foreclosures and other economic hardships.

We record protests across the world and monitor a variety of open sources to alert clients of any future protests planned by the groups involved, often providing you months, weeks or days notice of an event. This allows your security team to be prepared for any disruptions and have business continuity plans in place.

In this instance, accurate geolocation is crucial to reporting. Threat intelligence should provide you with all of the information you need to better protest your people, assets and reputations. Unreliable geolocation can fail to alert you to an incident that may impact your banks, offices or ATM locations, or in contrast, you may waste time, money and resource responding to an incident that actually doesn’t affect you much at all. This is why the human element of intelligence is so significant to us at IF. Our 24/7 operations team verify and check every incident that’s uploaded to our platform, to ensure accuracy and actionability.

Users of our threat intelligence platform can also be notified of how close an incident is to a physical asset. You can upload such locations onto the map and add filters based on distance from those assets, so that you receive e-mail alerts anytime an incident is reported within the set distance.

Finally, threat intelligence can provide support for the cash logistics sector too. Cash logistics is the physical movement and handling of cash from one location to another and involves cash-in-transit (CIT), cash management and ATM replenishment. A number of tasks handled in the cash logistics sector is done by private companies hired by banks and businesses. Attacks on cash-in-transit vehicles in countries like South Africa and Brazil have often led to not only large sums of cash being stolen, but also to casualties, both of employees and bystanders to the robbery. Intelligence Fusion in particular can support the cash logistics sector through providing intelligence on the threats that may be faced along these routes.

Within our threat intelligence platform solution, the ‘draw area’ function of the filters available to clients allows users to draw a polygon around the route or routes that are being considered by cash-in-transit employees, and receive alerts on any incidents mapped by our analyst team that are within the parameters of the route. Using ‘date’ filters, clients can also view historical incidents that have taken place around these routes so as to better plan and understand the threats that have taken place around the route.

Threat intelligence is key to managing and maintaining business continuity during these uncertain times. Reliable, fact-checked data can provide you with an advantage not only when responding to criminal acts or unrest, but in terms of spotting potential actions and identifying trends through indicators and warnings.

And it’s not only high-quality intelligence that’s important but choosing a software solution that enables you to streamline that feed of data and customise the interface can have significant benefits too. If you can tailor your threat intelligence platform to truly reflect your business operations, you can focus on what’s important, increasing the response time and productivity of your team.

Get started with a free trial of the Intelligence Fusion platform and start putting these threat intelligence principles into action within your own banking business. Book a demo here.