From payments and remittances, to lending and wealth management, FinTech continues to change the way we live, manage money and bank. Through the nature of their operations, FinTech companies are leading the way to protect their data and that of their customers.
According to the 2021 Norton Cyber Safety Insights Report, South Africa has the third highest number of cybercrime victims worldwide, and it’s estimated that it costs the country R2.2 billion a year.
For many, cybercrime takes the form of someone stealing or using personal information for criminal purposes. This can include identity theft, where scammers pose as an individual to access things such as bank and mobile accounts.
“Increased fraud risks for both businesses and customers arise from, among other things, the increasing pace of innovation and Fintech disruption, the demands for immediate transactions, and the challenges around customer verification,” says Michael Lazarus, Chief Technical Officer at short term lender, Wonga.
“Cybercrime is increasing on a wide front, with many prevalent types of online fraud occurring, including identity theft, phishing, vishing, hacking, malware, SIM swops and data breaches,” defines Lazarus. “With this in mind, it is the responsibility of companies, no matter their size, to take appropriate measures to secure their data, systems and infrastructure.”
The rapid growth of innovation in financial technology means that there is much data to analyse and too few rules to govern how data is protected. These factors mean that the financial sector has become a leader in adapting and enhancing privacy practices.
“These include the development of new technology, a greater focus on digital transformation and the changing public perception regarding the collection and use of personal information,” he explains.
On 1 December 2021, several elements of South Africa’s new Cybercrimes Act came into effect. Some elements of the Act refer to state regulatory processes, but what is most relevant to customers is what it covers in terms of illegal digital and online activity. The Act breaks this down into two categories: cybercrimes and malicious communications.
As defined by the Act, cybercrimes include the unlawful access of computer systems and interception of data, unlawful acts in respect of software and hardware tools, and interference with data or computer programs.
“One of the biggest risks is the demand from customers for real-time transactions,” he says. “As a Fintech company we are mindful when innovating our products for our customers. We merge cybersecurity and cyber resilience, to defend our customers against threats, but also have strategies in place to prepare for, respond to and recover from a potential cyber-attack.”
“We have taken an evolutionary approach to cyber security strategy to ensure we evolve our technologies and do not become complacent,” continues Lazarus. “As critical systems are becoming borderless, protecting the perimeter and, more critically, customer data is vital.”
“We employ a zero-trust model, where trust must be earned and not given,” he continues. “Every user or device gets authenticated and challenged with a high level of scrutiny and access granted only via two-factor authentication. This model provides additional protection against possible endpoint compromises (using phishing and malware) and attacks targeting borderless applications.”
“A merging of cybercrime and product model vulnerabilities needs to be balanced next to the potential for increasing efficiency and improving access for our customers, through robust regulatory and legal frameworks,” concludes Lazarus.
