Cybersecurity

Artificial intelligence is neither good nor bad in itself, but, as with any tool, it all depends on how you use it. In fact, in cybersecurity it has a dual role: while security teams use its capabilities to bolster defenses, cybercriminals use it to hone their attacks.

Header image generated with Midjourney (IA)

Garanti BBVA, a leader in digital payment innovation in Türkiye, has introduced the country's first biometric verification card, the Bonus Platinum Biometric Card. This groundbreaking product, described as a "game-changing technology" in payment systems, enables users to make quick, unencrypted, and secure payments by scanning their fingerprints. It also allows for limitless secure contactless payments, setting a new standard in the industry.

Digital channels have become the main way banks interact with their customers, both to check information and to carry out any kind of transaction. In this context, biometrics are gaining ground as they are a safe way to verify that customers are who they say they are. “At BBVA, there are over 40 use cases on a group level in which customer identity must be identified by biometrics, one of the most secure ways to prevent fraud,” said Natalia Ortega, Global Head of Financial Crime Prevention at BBVA.

People entrust something as important as their money to banks. Financial institutions, and in particular BBVA, have cutting-edge tools and technologies to combat fraud and cyber threats, provide free training, and have redoubled their efforts to warn and inform customers about these risks. However, the main defense is that people should never share their passwords.

BBVA is a founding member of the Quantum Safe Financial Forum (QSFF), a safe space for collaboration between European and US financial firms promoted by Europol’s European Cybercrime Centre (EC3). The alliance aims to foster the creation of new technological systems within the financial industry that are safe, secure and resilient to malicious attacks that rely on quantum computing.

BBVA’s Turkish unit is launching another pioneering solution, the Bonus Platinum Biometric Card, allowing users to make payments in a secure manner by simply scanning their fingerprint.  The innovative new card will be available shortly.

The main mission of BBVA's Security Operations team is to adopt all the necessary security measures in the face of an increasingly diverse cybercriminal reality. To this end, it has highly specialized teams in charge of assessing the security measures and processes implemented in the Group, as well as monitoring, detecting, and responding to any security risk or threat. Hundreds of hackers make up this team worldwide, organized into offensive, defensive, and transversal teams.

BBVA has relied on behavioral economics techniques to encourage employee participation in cybercrime training. The messages conveyed through the use of these techniques have effectively doubled interest in the course and, in some cases, increased course attendance by up to 70%. The initiative, which has been recognized by the Global Association of Applied Behavioural Scientists, will succeed in making the bank’s regular cybersecurity messages to its customers more effective.

BBVA, Banco Santander and CaixaBank have joined forces to tackle one of the biggest challenges facing the banking sector, financial fraud. The three Spanish banks are working on tools to exchange relevant information and data to help prevent financial crime.

BBVA in Colombia redesigned its smartphone app. From now on, the app will feature a new interface, run faster, offer more security and provide new functionalities. This marks the launch in Colombia of BBVA's global mobile banking app, which is already active in Spain, Mexico, Peru and Argentina, among other countries. Today, more than 1.7 million Colombian users are using the new version of the app on their smartphones.

The Spanish tech firm has integrated dasGate in its platform and targets 100 percent growth by 2023, with €26.3 million in revenue and 278 employees.

The growing demand for digital financial services around the world has brought with it an increase in exposure to digital crime and fraud. With 47.8 million digital customers worldwide, BBVA has put its customers' protection and trust as a fundamental pillar of its strategy to combat this situation. In 3 years, the bank has managed to prevent up to 75% of fraud, strengthening customer protection.

Cybercriminals do not go on vacation. Their activity tends to intensify during the summer season. We could even go so far as to say that our time off is their bread and butter. They can take advantage of any break to attack, from the summer break to a weekend getaway. Our lack of precaution is often a way for cybercriminals to attack us.

It is increasingly common to receive attacks from fraudsters who impersonate banking institutions, the aim of which is to first obtain our passwords and then to gain access to our assets. However, the increase in these attacks has reinforced the efforts of bank security teams and police forces, both in terms of prevention and awareness, making it increasingly difficult for cybercriminals.

The bank becomes the first financial institution in the world to share its cybersecurity knowledge with society through Coursera, a learning platform with 97 million registered students. As experts in cybersecurity, BBVA's goal is to train, motivate and empower its customers, and society in general, to acquire secure behaviors to properly manage the risks posed by the digital era.

Adaptation to the environment is the main vector of operation and survival for a business. The technological environment plays a crucial role in this process. As a result, cybersecurity becomes a fundamental pillar and employees are key players. Not in vain, 62% of incidents of this nature that take place in organizations happen due to human error, as reflected in the latest ‘Cyberthreats and Trends’ report prepared by the National Cryptologic Center.

We are increasingly aware of the importance of passwords: we create stronger ones, change them regularly and make sure not to use the same ones for everything. We also know that one of the biggest risks we face is password theft, since passwords unlock our information. But are we as careful with the passwords we store in our browsers?

After the incidents of the previous months (SolarWinds, Codecov,...) it is becoming more evident that it is necessary to have a strong inventory and control over the components with which we build our software, as well as to strengthen the process used to build it.

BBVA has been involved in the creation of Pinakes, the Interbank Cooperation Center (ICC) platform that simplifies the provider evaluation process in areas relating to cybersecurity. The aim of this platform is to offer the 124 financial institutions associated with the ICC and the more than 400 providers that provide products and services to the financial sector a new efficient mechanism for ensuring their reliability and ensuring compliance with the demanding banking sector regulations when it comes to managing technological risks.

BBVA and Google Cloud today announced a new strategic partnership to transform the bank’s security strategy by optimizing and improving its security infrastructure. As part of this global agreement, BBVA will collaborate with Google Cloud in the development of groundbreaking new artificial intelligence (AI) and machine learning (ML) models to predict and prevent cyberattacks against its banking infrastructure, providing a more secure experience for the bank and its customers.

The European Banking Federation recently organized a conference on innovation and cybersecurity where the role of banks in the digital economy and platform economy was discussed, among other topics. According to BBVA, the key to ensuring that financial services benefit from this economy is the creation of a framework for the different types of participating companies to compete fairly.

BBVA has launched Aqua, a new line of pioneering credit cards in Spain which feature a dynamic CVV code and do not contain card numbers (PAN) or expiration dates printed on them. This reinforces security both for its digital and physical versions since not having this data prevents possible fraudulent use of them. In addition, BBVA´s app has renewed the entire payment experience to make it easier for the customer to manage their expenses and order the services it offers based on their use. The bank is already working to launch this mobile experience in other countries.

Garanti BBVA launches Bonus Diji, a rewards credit card that is extremely secure, as it does not include any numbers or codes that can be copied.

Corporate virtual security has become even more important as a result of the coronavirus pandemic. Cybercriminals have found new opportunities in digitization and remote-working to commit fraud and cyber attacks; companies and employees alike have to be prepared against this risk. To this end, Campus BBVA has trained approximately 2,000 employees using courses, conferences, and discussion groups focused on digitization and tele-working as strategic capabilities that promise to be fundamental during the near future.

How do cybercriminals think? What techniques do they use and how do they set up to implement them? What are their goals? There's nothing better than putting yourself inside the bad guy's mind so you will be ready to react. We tell you how these criminals behave.

The uncertainty triggered by COVID-19 has led to a rise in cyberattacks against individuals in Spain. BBVA has therefore hosted several webinars in recent months to offer practical advice to customers and non-customers and thus alert the general public to the risk of fraud on the Internet. During these online events, involving members of the BBVA Cybersecurity team, including Roberto Ortiz, Global Head of Security Culture and Training at BBVA (People Information Security), speakers addressed the need to educate, inform and raise awareness of cyber attacks to protect the identity and finances of network users.

Álvaro Garrido has been safeguarding the integrity of BBVA's assets for the past three years. In his role as Chief Security Officer (CSO), he’s responsible not only for the Group’s physical & digital security, but also for its fraud prevention efforts, an exceptionally broad range of duties for such a large company and, at the same time, a great professional challenge.

A few weeks ago some colleagues from a development team told us about their worries on the JSON Web tokens (JWT) generation they were doing as part of a new tool integration they were working on. They had heard about several security issues regarding the use of JWT tokens so they asked us for help in order to validate if the tokens they were issuing were correct and met some basic security requirements.

We are currently working on a project to help automate security tests, APICheck, which we’ve recently released as open source. APICheck is comprised of a set of small tools that can be pipe chained in order to run several tests on API requests, so we got down to work with the development of a new tool for validating the JWT they were issuing, jwt-checker, in which we’ve implemented the ability to pass the validations on the tokens we’ll talk about. Below I’ll show you an example of a test implemented using the tool.