Phishingfraud in 2021: the numbers

And those efforts are paying off. There is a substantial decrease in the total amount stolen via phishing: In 2021, 9 million euros less was stolen than the year before. That is a decrease of more than 26%. A good thing, but we are noticing an important shift towards other forms of fraud, such as investment, invoice, request for help or vault account fraud, where the victim is persuaded to transfer money himself.

In addition to phishing - fraud through sharing your codes with third parties - there are also many other ways of online scams. Victims are manipulated by scammers and are encouraged to transfer money themselves to the account of the scammer.

One such form of fraud that is increasingly on the rise is investment fraud or boiler room fraud. It is a form of scam in which fraudsters offer you fictitious or worthless stocks or financial products. You are usually contacted unsolicited with an offer for a fantastic deal that promises high returns. The “sellers” put you under heavy pressure so that you would deposit more and more money. If you go along with this, you will get your hands on fictitious shares or worthless financial products. The criminals will run with your money and you will be left penniless.

With safe-deposit account fraud, fraudsters try to gain the trust of the victim and pose as a bank employee and ask to transfer your money to a supposedly new, safe account, because fraud has been committed with your current account. Of course that account does not exist. If you transfer the money, it will end up in the scammer's account.

Request for help fraud is another well-known example of this type of fraud. The fraudster pretends to be an acquaintance or family member of the victim and, through a web of lies, convinces the victim to make a transfer.

Investment, safe-deposit account fraud and help request fraud are therefore forms of fraud in which the victim himself transfers the money to an account of a fraudster. But many other forms of fraud fit into this list, just think: invoice fraud, helpdesk and friendship fraud, and CEO fraud.

Fraudsters not only use different channels - such as email, letter, telephone, SMS, social media and whatsapp - but they also commit the fraud on behalf of various organizations and institutions such as banks, government administrations, telecom operators, utilities, and so on. The list is long. That is why this is also a broad social phenomenon: different sectors are involved and everyone is a potential victim due to the wide variety of channels.

Banks have built in various systems to ensure that transactions are secure and to prevent and/or contain fraud as a result of phishing as much as possible. For example, two-step authentication has been required for online and mobile banking for the last ten years. The customer identifies himself using two of the following three elements to initiate e-payments: something he knows (e.g. PIN code), something he owns (e.g. smartphone), something he owns (e.g. fingerprint) . Guaranteeing smooth and fast payment traffic and efficient fraud detection is a difficult and delicate balance. It requires continuous investments in personnel and infrastructure from the banking sector.

The banks also invest in intensive monitoring and thus undo a great deal of damage. These efforts are yielding remarkable results: about 75% of fraudulent transfers via phishing were detected by the banks and blocked or recovered.

Banks are therefore constantly taking measures to prevent fraud. But if victims are persuaded to transfer money to the scammers themselves, it is more difficult for the bank to recognize fraud and detect it through monitoring.

We are also fully committed to awareness-raising campaigns, both by individual banks and at sector level, in which we would like to call on everyone to be vigilant for phishing and online fraud. Campaigns with tips, both on social media and on TV and radio, reached a large target audience. But the number of fraud cases remains high and so there is still work to be done.

Given the many forms and complex nature of online scams, there are not only technical working groups with financial experts who exchange information, but also partnerships with other stakeholders. For example, there are collaborative initiatives with telecom operators, the public prosecutor's office, the police, government agencies and the judiciary to tackle online fraud in all its forms. Together we also want to spread the awareness message as widely as possible.

After all, online fraud has become a social problem. The fraudsters strike more and more and due to their diverse way of working, no sector is spared. Everyone is involved and that makes online safety a shared responsibility. Only together can we fight this battle.

Received a text, email or letter that you suspect is phishing? Be on the lookout and forward it to suspicious@safeonweb.be and if the message misuses the name of a bank to phishing@bankdomainname.

If you receive a phishing message at work, notify the ICT service as well. Forward the phishing message and then delete it.