Guidance

Online banking has become an indispensable tool for organisations. It offers convenience, efficiency, and improved cash flow management, all while contributing to a more streamlined financial operation. The convenience of managing finances online comes with the responsibility of safeguarding sensitive financial data.

The Cyber Security breaches survey 2024, published by the UK Government, found that “half of businesses (50%) and around a third of charities (32%) report having experienced some form of cyber security breach or attack in the last 12 months.” These breaches can often result in financial fraud, especially if the organisation hasn’t taken proper measures to be cyber secure.

Some tips that an organisation can implement to help mitigate the risks associated with online financial transactions and protecting sensitive financial information from cyber threats include:

1. Educate Employees: Provide regular training to your employees on cyber security best practices, including how to recognise phishing attempts, the importance of strong passwords, and how to handle sensitive financial information securely.
2. Implement Strong Access Controls: Limit access to financial systems and sensitive data to only those employees who require it to perform their jobs. Use strong authentication methods such as two-factor authentication (2FA) for accessing financial accounts and systems.
3. Use Secure Connections: Ensure that your organisation’s network is secure by using encryption and secure connections, especially when accessing financial systems or transferring sensitive data.
4. Regularly Update Software: Keep all software, including operating systems, antivirus programs, and financial software, up to date with the latest security patches and updates to protect against known vulnerabilities.
5. Monitor Financial Transactions: Regularly monitor financial transactions and account activity for any unauthorised or suspicious activity. Implement automated alerts to notify you of any unusual transactions or changes in account balances.
6. Secure Payment Processes: Implement secure payment processes, such as using encrypted payment gateways and requiring approval from multiple authorised individuals for large or unusual transactions.
7. Backup Financial Data: Regularly backup financial data and store backups securely, both on-site and off-site, to protect against data loss due to cyberattacks, hardware failures, or other disasters.
8. Establish an Incident Response Plan: Develop and regularly update an Incident Response plan to guide your organisation’s response in the event of a cyber security incident or data breach involving financial information. This plan should include steps for containing the incident, notifying relevant parties, and restoring systems and data. It’s important to test your incident response plan, testing ensures that the plan is effective, identifies any weaknesses or gaps, and allows for refinement and improvement.
9. Invest in Cyber Security: Many of these measures are covered by a Cyber Essentials certification. Cyber Essentials is an effective, Government backed scheme that will help you to protect your organisation, whatever its size, against a whole range of the most common cyber attacks. Achieving certification will ensure that your organisation is cyber resilient and signal to customers and other organisations that you take cyber security seriously. Training opportunities, such as the NCSC developed Exercise in a Box, and various other qualifications offered by cyber security companies are often worth investing in to help boost your organisations cyber security.

What to do if you become a victim of financial fraud

• Don’t panic
• Contact your bank immediately
• Document everything: keep detailed records every step of the way
• Report the crime
• Review and improve security measures
• Seek emotional support if needed

Helpful Resources

• 10 Steps to Cyber Security – Guidance to help strengthen an organisation’s cyber security from the NCSC
• Business email compromise: defending your organisation – NCSC
• Responding to a cyber incident -a guide for CEOs – NCSC guidance for essential steps on what to do, as the head of an organisation, in the event of a cyber incident.
• Business Email Compromise – Preventative and Remedial Measures – The Cyber and Fraud Centre – Scotland
• Recovering a hacked account – NCSC
• If you are concerned your organisation has been the victim of either a cyber or financial fraud attack you can call the Cyber and Fraud Centre’s free Incident Response Helpline – 01786 447 441
• If you are a victim of cyber crime please call Police Scotland on 101

Further Cyber Secure Banking guidance:

• Cyber Secure Banking: Online threats
• Cyber Secure Banking: Best practice for individuals