Latest cybersecurity reporting from selected sources.

Fraud Expert Ken Palla on Why Detection Controls Still Lag BehindFraud continues to climb even as banks invest heavily in detection tools and analytics. The gap between technology spending and fraud losses reflects a deeper issue in how financial institutions approach scam prevention, says Ken Palla, retired director at MUFG Bank.

Top European Court Advisor Says Policy Should Be 'Refund Now, Sue Later'Banks must promptly refund phishing victims when the scams lead to unauthorized transactions, an advisor to the European Union’s top court has said. The case in question involves an unnamed Polish woman who got duped on an online auction platform.

Also: npm Packages Infiltrated, FBI Issues Fraud Alert, Campbell's Soup Cans CISOThis week, a recently fixed Oracle flaw is being actively exploited, Shelly tackled Pro 4PM DoS bug, "Shai-Hulud 2.0" hit npm, the FBI warned of rising bank account takeover scams, regulators fined Comcast over a vendor breach, Iberia reported a supplier incident and Campbell's canned its CISO.

Ping Identity and Ameris Bank on Stopping Fraud Without Alienating Legitimate UsersIn the latest "Proof of Concept," Rich Keith, director of product and solutions marketing at Ping Identity, and Todd Smith, senior vice president of customer IAM at Bank Ameris, joined ISMG editors to discuss how AI-based fraud is breaking trust models faster than many systems can adapt.

XML-Based Messaging Tech Extends Fraud Detection Into Wider Bank Use CasesACI's signals network intelligence harnesses neural networks and federated machine learning to spot fraud in real time without banks sharing data. Beyond fraud detection, its insights can drive business growth from other business units, and ACI aims to accelerate adoption by making it open source.

Also: Coinbase's Misconfigured Smart Contract, GMX Repayment PlansThis week, a Ponzi scammer must pay $228 million, Google clarified Play Store non-custodial wallet rules, Coinbase misconfiguration, GMX repayment, BtcTurk halted transfers, bank groups wrote lawmakers. Prosecutors seized funds. The Federal Reserve ended a special oversight program. Hong Kong published new rules.

Also, Nike Sued Over Shutdown of NFT SubsidiaryThis week, KiloEX compensation after Oracle exploit, Nike sued over NFT shutdown, SEC dropped probe into PayPal PYUSD, Long Island man sentenced for crypto fraud, Americans lost billions to crypto scams, Loopscale exploiter agreed to return stolen funds and bank regulators softened stance on crypto.

Jason Costain on Ways Traditional and Digital Banks Could Learn from Each OtherDigital-only banks promise speed and sleek digital experiences but are not the best places to handle scam victims. Without branches to visit, victims find themselves stuck in a loop of chatbots, said Jason Costain, former head of fraud analytics and threat management at NatWest Group.

Jason Costain on Ways Traditional and Digital Banks Could Learn from Each OtherDigital-only banks promise speed and sleek digital experiences but are not the best places to handle scam victims. Without branches to visit, victims find themselves stuck in a loop of chatbots, said Jason Costain, former head of fraud analytics and threat management at NatWest Group.

M&T Bank's Karen Boyer on Need for Shared Responsibility with Telecoms, Tech FirmsTechnology solutions can help banks fight fraud, but privacy constraints are preventing them from doing an effective job to ferret out scammers, said Karen Boyer, senior vice president at M&T Bank. She supports a new Australian law that also places responsibility on telecom and internet providers.

Ken Palla on Lessons From U.K and Australia to Reduce Fraud and ScamsThe U.S. Consumer Financial Protection Bureau's decision to file a lawsuit against Zelle is too late and too narrow to reduce scams, said Ken Palla, retired director with MUFG Bank. CFPB last month sued the operator of Zelle, as well as three banks for failing to protect consumers from fraud.

Academics Build AI Agent With OpenAI to Execute Phone Scams at ScaleHackers can use OpenAI's real-time voice API to carry out for less than a dollar deepfake scams involving voice impersonations of government officials or bank employees to swindle victims, said researchers at the University of Illinois Urbana-Champaign.

Fraud Expert Ken Palla on Recent Legislative Efforts and Regulatory ScrutinyRecent developments suggest the U.S. is taking a more serious approach to holding faster payments platforms accountable for scams. It's unlikely any changes will occur before the November U.S. election, but the move toward more regulation is a good start, said Ken Palla, retired MUFB Bank director.

Scammers Use Social Engineering and Phishing to Fool Workers and IT Help Desk StaffFederal authorities warn of social engineering and phishing scams - sometimes targeting IT help desk workers - that allow attackers to steal login credentials and access healthcare sector entities' IT systems so they can divert automated clearinghouse payments to bank accounts the attackers control.

Hackers Used Dozens of Servers to Distribute Malicious Android AppsLaw enforcement authorities in Singapore, Malaysia, Hong Kong and Taiwan took down a cybercrime ring that used dozens of servers and hundreds of phishing pages across multiple jurisdictions to run a malware-enabled scam operation and steal tens of millions from victims' bank accounts.

Also: Pump.fun Hack, Arrests in $73M Pig-Butchering ScamThis week, Gala Games and Pump.fun were hacked; alleged pig-butchering scammers, Incognito admin and illicit banking racketeers were arrested; Pink Drainer was shut down; the U.S. House approved a crypto bill; a man pleaded guilty to wire fraud; and tech companies formed a scam-fighting coalition.

Prove's Mary Ann Miller on Strategies for Stronger ID VerificationThe banking and financial services industry will see a growth in scams and frauds perpetrated through fake businesses, incentivizing bad actors to continue creating these fraudulent entities, said Mary Ann Miller, a fraud and cybercrime executive advisor with Prove.

GoldPickaxe Malware Can Record User’s Face - Use Video to Commit Deepfake ScamsA Chinese-speaking cybercrime group with the codename GoldFactory has built a new Android and iOS banking Trojan, GoldPickaxe, that can harvest and steal personal details, including biometric face profiles, that attackers use to create AI-driven deepfakes to fool bank defenses, researchers warn.

Kansas Bank Forced to Close After CEO Allegedly Embezzled Nearly $50 MillionA watchdog report reveals how Heartland Tri-State Bank CEO Shan Hanes allegedly defrauded a local church and investment club in Kansas out of $47.1 million through a "pig-butchering" cryptocurrency scam that ultimately caused the bank to fail in 2023.

Banking Fraud Heads Say Facebook Marketplace Is Teeming With ScammersMeta-owned online marketplaces are swarming with scammers who use deceptive ads to defraud banking customers, fraud prevention heads at leading British banks testified before a U.K. Parliament committee. They called on the social media giant to roll out stronger fraud prevention measures.