Phishing in 2020: the numbers

More than 75% of the fraudulent – ​​but perfectly signed – transfers were reversed by the banks,  both by detecting and blocking them in time and by recovering the captured amounts. These prevented fraud cases are not included in the net amount. The numbers and amounts are substantial, but cannot be compared with previous years, because Febelfin is reporting for the first time on all types of phishing (without distinction between bank and non-bank phishing) and all payment types (no longer exclusively e-transfers, but also e-payment card transactions).

This distinction is important: with bank phishing scammers impersonate a financial institution  by copying the logo and the look & feel of the bank. Non-bank phishing happens when scammers address their potential victims on behalf of other organizations such as e-commerce companies, telecom companies or the government. Phishing has recently become a social phenomenon that affects all sectors - no longer just financial institutions.

Fraudsters are also increasingly using e-payment card payments (i.e. when a fraudster pays online in your name with your card), which is why we also include these fraud figures in our statistics. So limiting reporting to bank phishing and e-transfers as we have always done in the past was no longer representative.

Not included in these figures are forms of online fraud where the fraudster did not fish for the victim's personal codes. In these cases, the victim was manipulated into transferring money to the scammer's account themselves. Examples include request for help, invoice and CEO fraud.

The corona crisis was a great opportunity for fraudsters to scam people. The different forms of phishing are numerous and complex. Fraudsters not only use different channels - such as email, letter, telephone, SMS, social media and whatsapp - but they also commit the fraud on behalf of various organizations and institutions such as banks, government administrations, telecom operators, utilities, and so on. The list is long. That is why this is also a broad social phenomenon: different sectors are involved and everyone is a potential victim due to the wide variety of channels.

The ingenuity of fraudsters may be impressive, but phishing is still easy to prevent:

Banks have built in various systems to ensure that transactions are secure and to prevent and/or contain fraud as a result of phishing as much as possible. For example, two-step authentication has been required for online and mobile banking for the last ten years. The customer identifies himself using two elements – a card or phone, a PIN, a fingerprint or a face scan – to initiate e-payments.

Banks invest in intensive monitoring and thus undo a lot of damage. These efforts have remarkable results: over 75% of all fraudulent transfers (for which a phish response code was used) are detected by the banks and blocked or recovered. Guaranteeing smooth and fast payment traffic and efficient fraud detection is a difficult and delicate balance. It requires continuous investments in personnel and infrastructure from the banking sector, but the results are encouraging.

We also launch awareness campaigns, in which we would like to call on everyone to be vigilant for phishing and online fraud. Campaigns with tips, both on social media and on TV and radio, reached a large target audience. But the number of fraud cases continues to increase, so there is still work to be done. Awareness campaigns will always remain important, but the financial sector does much more than that.

Given the nature of the problem, there are not only technical working groups with financial experts who exchange information to detect as much fraud as possible , but we are also working on partnerships with other stakeholders. For example, initiatives are underway in collaboration with telecom operators, the public prosecutor's office, the police, government agencies and the judiciary to tackle phishing in all its dimensions and manifestations. Together we also want to spread the awareness message as widely as possible.

Phishing has become a social problem. The fraudsters strike more and more and due to their diverse way of working, no sector is spared. Everyone is involved and that makes online safety a shared responsibility. Only together can we fight this battle.

Phishing can be prevented. You are always one step ahead of fraudsters if you consistently respect the following rules:

Received a text, email or letter that you suspect is phishing? Report this to phishing@bankdomainname and to suspicious@safeonweb.be. Forward the phishing message and then delete it.

If you have fallen into the trap, it is best to take the following steps: