Stop Fraud That Starts Outside Your Bank.

A plain summary of who each rule covers, taken from the official page. Not legal advice. Your legal team decides what applies to you.

• What does external threat protection mean for a bank?

  It means watching the places outside your network where attacks on your customers and brand are prepared. That includes fake banking sites, criminal forums where logins and card data are sold, and internet-facing systems you may have forgotten. When something appears, your team gets the facts and can act early.

• How do criminals get customer logins without breaking into us?

  They rarely need to. Infostealer malware copies saved passwords from infected customer devices. Phishing pages trick people into typing them. Many people also reuse a password that leaked from another service. The bank's systems can be sound and the account still gets taken over.

• Can a fake banking page be taken down?

  Usually, yes. The page is reported to the company that hosts it and to the domain registrar, with evidence that it copies your brand. Speed varies from one host to another, and no one can promise a result. Finding the page early is what shortens the time customers are exposed.

• Does DORA cover our technology suppliers?

  Managing the risk from third-party technology providers is one of DORA's main parts, next to ICT risk management, resilience testing and incident reporting. The exact duties depend on your type of firm, so check the detail with your legal and compliance teams.

• Which threat groups target financial institutions?

  Most are criminal groups that want money. Lazarus Group is the best documented state-linked group in this area, and its profile, with the governments that attribute it, is linked on this page.

• Where should a small security team start?

  Start with the two things customers feel first: look-alike brand pages and leaked credentials. Both can be watched from outside, without changing your own systems, and both point to clear actions such as a takedown request or a forced password reset.

• What happens when card numbers are found for sale?

  Card numbers and account details are traded on dark web forums. If you see them early, an issuer can block and reissue cards before they are used. Dark Web Monitoring alerts you when customer logins, staff accounts or card data linked to you appear in criminal markets.

• Why do banks care about infostealer logs?

  Infostealer malware on customer and staff devices collects saved passwords. The logs are sold on, and reused passwords do the rest. A takeover often ends in a fraudulent transfer.

• How do forgotten systems put a bank at risk?

  Forgotten internet-facing systems add to supplier and subsidiary risk, and initial access brokers sell entry to them. External Attack Surface Management shows the internet-facing systems that you and your subsidiaries expose, including the forgotten ones.

• Does PCI DSS apply to banks and payment firms?

  PCI DSS is the payment card security standard, maintained by the PCI Security Standards Council. It applies to entities that store, process or transmit cardholder data, including merchants, processors, acquirers, issuers and service providers. Your legal team decides what applies to you.