Overview of transactions not authorised by customers of financial institutions in 2023

In 2023, as part of reporting form 0403203, credit institutions provided information on transactions without the consent of individual customers broken down by the following main types of transactions: Cards, Accounts, SBP, E-wallets, and Without opening account.

Number of transactions without consent of individual customers (in thousands)

Since 2023, credit institutions have been sending information to the Bank of Russia on prevented thefts of funds. In 2023, the value of prevented unauthorised transactions reached ₽5,798.35 billion. Thanks to the effectiveness of anti-fraud procedures adopted by credit institutions, criminals failed to commit 34.77 million fraudulent transactions.

In 2023, as part of its interaction with domain name registrars in the top-level domains .ru, .рф and .su, as well as other geographical top-level domains, the Bank of Russia sent information to the registrars on 3,639 online resources in order to remove their delegation, which was 30% less than in the previous year (5,217 resources). As earlier, on average, it takes registrars from three hours to several days to remove domain delegation.

Fraudulent online resources sent to domain name registrars

The Bank of Russia continues to cooperate actively with the Prosecutor General’s Office of the Russian Federation to block access in Russia to online resources that disseminate information about the provision of unlicensed financial services or advertise pyramid schemes. In 2023, access to 34,677 resources was blocked based on the regulator’s information, which is more than three times higher than in the previous year.

Fraudulent resources referred to the Prosecutor General’s Office

This was achieved thanks to cooperation between the Bank of Russia and the Russian Ministry of Digital Development on automated identification of online resources and pages on social networks used for illegal activities.

In 2023, the Bank of Russia initiated the blocking of access to 4,464 social media pages/groups and 35 applications. As in the previous year, most of the blocked pages/groups on social networks had been used for unlicensed activities. Blocked applications had been used to conduct phishing under the guise of existing credit institutions.

Resources used by attackers in 2023 by type (%)

In 2023, more than a half (55%) of the online resources for which the Bank of Russia initiated action were related to phishing. These are resources whose main purpose is to steal the data of customers of financial institutions. Compared to 2022, pyramid schemes ranked second (21%), although the number of resources subject to measures actually doubled. Fraudulent resources used by criminals to carry out unlicensed operations in the securities market and the activities of non-existent credit and microfinance organisations were also active in 2023, accounting for 15% of all resources. Other fraud accounted for about 9%, and less than 1% represented resources disseminating malware.

Cyber incidents and attacks in 2023

In 2023, the regulator observed an overall decrease in the number of cyber attacks against financial institutions compared to 2022; however, the main focus of attacks remained unchanged. Attackers mainly carried out DDoS attacks, sent phishing emails and malware, exploited vulnerabilities in systems used by financial institutions, and used password brute force attacks to compromise the accounts of employees and customers. Some attacks were timely detected and prevented thanks to machine-readable bulletins issued by the Information Security Department of the Bank of Russia daily. The bulletins contain indicators of compromise identified by analysing cyber attacks and incidents.

The practice of attacks against third parties continued in 2023. Criminals targeted integrators and vendors of IT solutions used in the financial market. The main goal of criminals was financial gain. Thus, they typically tried to encrypt documents on corporate servers, disrupt information systems or obtain access to confidential data.

No sophisticated targeted attacks with elaborate techniques were recorded by the regulator. Exploiting vulnerabilities in software that had not been updated in time was a prominent feature of critical attacks on financial institutions. One such incident became a mass attack.

To most effectively counter cyber attacks, it is still necessary to comply with the recommendations of the Federal Service for Technical and Export Control of Russia (FSTEC) and the Financial Sector Computer Emergency Response Team of the Bank of Russia (FinCERT) on fixing software vulnerabilities. In 2023, the Information Security Department issued a number of bulletins; three of them contained information on such attacks with a detailed analysis of the attackers’ tactics and techniques and recommendations on how to protect against them.

In 50% of cyber incidents, criminals gained access to the internal infrastructure of financial institutions and aimed to extract confidential information in order to sell or publish it on the darknet.

In 15% of cyber incidents, attackers did not steal any information, but altered content on the institution’s website by publishing various inappropriate materials.

In the remaining 35% of cases, attackers disrupted information infrastructure, which negatively affected the availability of financial services.