Incident: Fraudulent Activity Exploiting Lloyds Bank's Security System.

Published Date: 2021-05-10

Postmortem Analysis
Timeline 1. The software failure incident happened in the past month before the article was published on May 10, 2021. 2. Estimation: The incident likely occurred in April 2021. [114771]
System The software failure incident described in the article involved a failure in the fraud detection and prevention system of Lloyds bank. Specifically, the following systems/components failed: 1. Fraud detection and prevention system of Lloyds bank [114771]
Responsible Organization 1. Lloyds bank's software system, specifically the telephone banking system, which allowed the fraudsters to move money from the victim's account without proper security checks [114771].
Impacted Organization 1. Adrian Giles - the victim of the fraud incident [Article 114771] 2. Lloyds bank - the bank involved in the incident [Article 114771]
Software Causes 1. The software cause of the failure incident was the vulnerability in Lloyds' telephone banking system that allowed the fraudster to move money from the victim's savings and authorize payments without proper security checks [114771].
Non-software Causes 1. Lack of immediate action by the bank to freeze the account despite the customer's request [114771] 2. Insufficient security measures in place to prevent fraudulent activity, such as allowing payments to previous payees without additional security checks [114771] 3. Inadequate response and support from the bank's customer service and fraud department in handling the situation effectively [114771]
Impacts 1. The software failure incident led to fraudsters being able to empty the victim's current account by exploiting vulnerabilities in the bank's telephone banking system [114771]. 2. The victim experienced financial loss totaling £8,200 as a result of the software failure incident [114771]. 3. The victim faced challenges in recovering the stolen funds due to the bank's initial lack of cooperation and reluctance to investigate the fraud [114771]. 4. The incident caused a significant amount of distress and inconvenience to the victim, impacting his faith in the bank's security systems and customer service [114771].
Preventions 1. Implementing stricter security measures for authorizing payments, especially large sums, such as requiring additional verification steps beyond just previous payee authorization [114771]. 2. Enhancing fraud detection algorithms to flag suspicious activities, like sudden large transfers to unfamiliar payees, for immediate investigation and intervention [114771]. 3. Providing better training for customer service staff to handle fraud reports efficiently and take prompt actions to prevent further unauthorized transactions [114771].
Fixes 1. Implement additional security measures for authorizing payments, especially large sums, to prevent unauthorized transactions [114771]. 2. Enhance the fraud detection system to flag suspicious activities, such as sudden large transfers to unfamiliar payees, for immediate action [114771]. 3. Provide better training to customer service staff to handle fraud cases efficiently and effectively, including the ability to block accounts when necessary [114771]. 4. Improve communication and coordination between different departments within the bank, such as customer service and fraud prevention, to streamline the response to fraud incidents [114771].
References 1. Adrian Giles (victim of the fraud incident) [Article 114771] 2. Lloyds bank (the bank involved in the incident) [Article 114771] 3. UK Finance (providing advice on handling unexpected payments) [Article 114771]

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) The software failure incident having happened again at one_organization: - The article does not mention any specific information about a similar software failure incident happening again within the same organization (Lloyds bank) or with its products and services. Therefore, it is unknown if a similar incident has occurred before at Lloyds bank [114771]. (b) The software failure incident having happened again at multiple_organization: - The article mentions that fraudsters were able to exploit a vulnerability in Lloyds bank's system that allowed them to make payments to previous payees without the need for further security checks. This indicates a potential systemic issue across multiple banks or financial institutions that allow similar payment processes without adequate security measures [114771].
Phase (Design/Operation) unknown The articles do not provide specific information about the software failure incident related to the development phases, whether it was due to design or operation factors. Therefore, it is unknown which specific phase contributed to the failure in this case.
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the article is primarily within the system. The failure occurred due to the bank's internal processes and procedures related to fraud detection and account freezing. The bank's call center staff insisted that only the fraud department could help, leaving the customer on hold for a long time and not taking immediate action to freeze the account to prevent fraudulent transactions [114771]. Additionally, the article mentions that the fraudsters were able to exploit the bank's system by using the telephone banking system and taking advantage of the feature that allows customers to make payments to previous payees without further security checks, which facilitated the fraudulent transactions [114771]. (b) outside_system: The software failure incident does not seem to be primarily due to factors originating from outside the system. The fraudsters' actions were enabled by the bank's internal processes and the customer's account details within the bank's system. The incident does not indicate any external factors such as external cyber attacks or breaches that directly caused the failure [114771].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the article was primarily due to non-human actions. The fraudsters were able to exploit the bank's system by using the telephone banking system to move money from the victim's account without the need for further security checks. This allowed them to make unauthorized payments to contractors without the victim's consent [114771]. (b) Human actions also played a role in the incident. The victim, Adrian Giles, tried to take immediate action by contacting the bank to halt the unauthorized payments. However, he faced challenges in getting through to the fraud department and experienced delays and lack of support from the bank's call center staff. Additionally, the bank's initial response to the incident, where they did not immediately freeze the account and later pressured the victim to admit potential security compromises, contributed to the distress and inconvenience faced by the victim [114771].
Dimension (Hardware/Software) software (a) The software failure incident in the article does not seem to be related to hardware issues. It primarily revolves around the bank's call center staff not being able to block the account or take immediate action to prevent fraudulent transactions, as mentioned by a Lloyds spokesman. The failure appears to stem from procedural and operational shortcomings rather than hardware-related issues. (b) The software failure incident in the article is primarily related to software issues. The fraudsters were able to exploit vulnerabilities in Lloyds' telephone banking system and online account management software to move money from the victim's account without proper authorization. The victim mentioned that he was unable to stop the fraudulent transactions even after multiple attempts to contact Lloyds' customer services, indicating a failure in the software systems' security and fraud detection mechanisms.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. Fraudsters exploited vulnerabilities in the banking system to fraudulently transfer money from the victim's account. They used the bank's telephone banking system to move money from the victim's savings and authorize payments to contractors. The fraudsters pretended to be the victim and contacted the contractors to request the money be moved back to a different account controlled by them. Additionally, the fraudsters took advantage of the fact that the bank allowed customers to make payments to previous payees without additional security checks, enabling them to carry out the fraudulent transactions [114771].
Intent (Poor/Accidental Decisions) unknown The software failure incident described in the article [114771] does not directly point to a specific software failure caused by poor decisions or accidental decisions. The incident primarily revolves around the bank's handling of a fraud case where the victim faced challenges in stopping fraudulent transactions and recovering the stolen money.
Capability (Incompetence/Accidental) unknown The articles do not provide information about the software failure incident being related to development incompetence or accidental factors.
Duration temporary The software failure incident described in the article is more related to a temporary failure rather than a permanent one. This temporary failure was due to contributing factors introduced by certain circumstances but not all. The incident involved the bank's call center staff insisting that only the fraud department could help, leaving the customer on hold for more than an hour before cutting him off, and the inability to immediately freeze the account when the customer called up to report the fraud. These factors contributed to the temporary failure in the system's response to the fraud incident [114771].
Behaviour other (a) crash: The software failure incident described in the article does not involve a crash where the system loses state and does not perform any of its intended functions. The incident primarily revolves around fraudulent activities and the bank's response to them, rather than a system crash [Article 114771]. (b) omission: The failure does not seem to be due to the system omitting to perform its intended functions at an instance(s). The issue here is more related to fraudulent transactions and the bank's handling of the situation rather than the system omitting its functions [Article 114771]. (c) timing: The failure is not attributed to the system performing its intended functions too late or too early. The focus of the incident is on fraudulent activities and the subsequent response from the bank, rather than timing issues related to system functions [Article 114771]. (d) value: The failure is not due to the system performing its intended functions incorrectly. The main issue in this incident is the fraudulent transactions and the bank's handling of the situation, rather than the system providing incorrect outputs or results [Article 114771]. (e) byzantine: The failure does not involve the system behaving erroneously with inconsistent responses and interactions. The incident primarily revolves around fraudulent activities and the bank's response to them, rather than inconsistent behavior of the system [Article 114771]. (f) other: The behavior of the software failure incident in this case can be described as a failure to adequately prevent fraudulent transactions and provide timely assistance to the customer. The bank's system did not effectively block the fraudulent transactions, leading to financial loss for the customer. Additionally, the response from the bank's customer service was inadequate, requiring the customer to go through significant effort to resolve the issue [Article 114771].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure. The software failure incident described in the article resulted in financial loss for the individual, Adrian Giles. Fraudsters were able to empty his current account by moving money from his savings and authorizing payments without his consent. Despite his efforts to stop the theft, the bank's call center staff were unable to assist promptly, leading to the loss of £8,200 from his account. Additionally, the fraudsters instructed the bank to send the money to contractors Giles had previously paid, causing further financial harm [114771].
Domain finance (a) The failed system in the incident was related to the finance industry. The software failure incident involved fraudsters exploiting vulnerabilities in the banking system to transfer money fraudulently from a customer's account [Article 114771].

Sources

Back to List