Likelihood: HIGH
Impact: HIGH
Treatment: MITIGATE
Confidence: Low
Phishing campaigns targeting financial institution customers via credential harvesting are a proven, high-frequency attack vector with low technical barriers to execution; even without confirmed exploitation, the personalized spear-phishing methodology and brand impersonation increase success probability significantly above baseline. Business impact is high because successful credential theft directly enables fraudulent account takeovers and unauthorized fund transfers, with cascading regulatory, reputational, and customer-trust consequences specific to the financial sector.
Treatment rationale: The threat vector is active, technically feasible, and directly targets customer-facing assets where avoidance is not possible and acceptance of account-takeover risk is inconsistent with financial sector regulatory expectations; mitigation through enhanced customer-facing controls, anti-phishing infrastructure, and rapid takedown capability is the only viable primary treatment.
Third-Party / Supply-Chain Risk
Financial institutions relying on shared email delivery platforms, third-party customer authentication providers, or outsourced digital banking portals face compounded exposure: a spoofed brand on infrastructure outside the institution's direct control limits detection and takedown response time. Third-party email security vendors and domain registrars are also implicit dependencies — their responsiveness directly affects the institution's ability to disrupt harvesting page infrastructure (NIST SP 800-161 Tier 3 supply chain dependency).
Loss Exposure (illustrative)
Magnitude: High — illustrative $500K–$5M per institution depending on customer base size, credential volume exposed, and fraud velocity before detection; excludes regulatory fines and litigation
Frequency: Illustrative: financial institutions operating customer-facing digital banking are plausible targets for credential harvesting campaigns multiple times per year given sector targeting frequency; a successful campaign resulting in confirmed account takeovers may occur 1–3 times per year at a mid-to-large institution without mature anti-phishing controls
Annualized: Illustrative ALE: $500K–$15M annually across a mid-to-large institution, weighted by fraud realization rate, customer notification costs, and regulatory response overhead — no defensible single-point figure given single-sourced intelligence and unconfirmed exploitation status
Basis: Loss magnitude driven by estimated fraud loss per compromised account (illustrative: $500–$5,000 per account depending on account type and access level) scaled against plausible credential yield from a targeted spear-phishing campaign; frequency derived from sector targeting patterns observable in public threat intelligence, not from any cited third-party report. Figures are internally derived and illustrative only.
Illustrative estimate — not actuarially derived.
Insurance / Contractual / Legal — Potential Obligations
Potential triggers, not legal determinations. Verify with counsel/broker before acting.
• Confirmed customer credential theft may invoke state and federal breach-notification obligations under GLBA and applicable state data protection statutes — verify with counsel.
• PCI-DSS incident response and notification requirements may be triggered if payment card credentials are confirmed among stolen data — verify with counsel.
• Cyber insurance policies may contain notice obligations tied to discovery of an active credential harvesting campaign targeting the institution's customers — verify with broker.
• Brand impersonation and domain spoofing may create grounds for takedown action under UDRP or similar mechanisms — verify with counsel.
