Outsourcing is 'a source of risk'

Experts in the field of IT security have warned banks and financial institutions that increased dependence on outsourcing and inadequate use of secure systems would leave them vulnerable to frauds and misuse of sensitive banking data.

Local banks, which faced a spate of unauthorised ATM withdrawals and credit card frauds, need to be more vigilant and run security programmes in their Automatic Teller Machines (ATM) and other banking software, said several experts that Emirates Business spoke to.

The banking and financial sector across the world is vulnerable to hackers and fraudsters, which can only be countered by introducing new layers of security, such as flexible one-time password systems which are not saved on any server. Experts said in-house management of banking and ATM networks is essential for ensuring the highest level of security for customers. Outsourcing customer services and maintenance of banks' IT networks to optimise cost is a risky and vulnerable option that can invite fraud and misuse, they said.

It is common for many banks to outsource their data processing, which involves the risk of vital data getting disclosed. Recently, banks across the UAE alerted customers to change their PIN numbers following a surge in fraudulent ATM withdrawals made abroad.

Citibank, Lloyds TSB, HSBC, Dubai Bank, National Bank of Abu Dhabi (NBAD) and Emirates NBD were among the banks to have contacted customers via SMS to tell them to visit ATMs and change their PIN numbers.

Rajender Singh Beniwal, marketing manager of Wipro Infotech, a leading Indian IT company working closely with several banks and financial institutions in the UAE and Saudi Arabia, said: "IT security and data safety is vital for the financial services industry. Companies looking to optimise cost by outsourcing vital work may compromise on security. Now we are offering a co-sourcing model for our clients in the Gulf."

Co-sourcing avoids the dangers of outsourcing and increases the clients' control over sensitive data, Beniwal said. Wipro has implemented this with several multinational banks and financial institutions in the US, Europe and India.

Klus Peter Breitenbach, Chief Executive Officer of Applied Security (Apsec), a leading German IT security company which provides data security to Deutche Bourse and other multinational banks, said: "Most banks in the UAE and the Gulf use only a user name and password protection for ATM transactions and online banking. It is very easy to find out the username and password. Smart hackers use several innovative methods to clone ATM and credit cards."

Follow Emirates 24|7 on Google News.