How to react to computer fraud: the right reflexes
The increasing number of cyber frauds is putting professionals in the financial sector under pressure. Between legal obligations, technical reflexes and compliance imperatives, the effectiveness of the response now conditions confidence in the Luxembourg financial centre.
When a suspicious transfer turns everything upside down
One morning, an executive at an asset management company examines and approves an urgent transfer suggested by an investment adviser. The message seems legitimate, the address is correct and the request is urgent. A few hours later, the investment adviser called: he hadn’t ordered anything. The recipient account? Unknown.
The scenario is sadly banal: identity theft, phishing or “president fraud”, where a swindler poses as a legitimate or authorised person to obtain an immediate transfer.
These frauds are increasing in number and sophistication. They exploit both technology (fake sites, undetectable emails, voice deepfakes) and the time pressure imposed by instant payment systems and regulatory obligations for rapid processing.
Why is the Luxembourg financial centre in the front line?
In a financial centre as interconnected as Luxembourg, the combination of international flows, a diversified customer base and stringent regulatory requirements increases the risks.
“Institutions must reconcile speed of execution with their duty of vigilance.” – Anne-Marie Ka
IT fraud has become a strategic compliance issue: it puts not only IT systems to the test, but also governance, internal procedures and staff training.
Supervisory authorities, including the CSSF, are placing increasing emphasis on operational resilience and fraud risk prevention as part of the Digital Operational Resilience Act (DORA), applicable from 2025.
The right reflexes when fraud is discovered: act quickly, but methodically
When fraud is suspected or discovered, the first few hours are decisive. You need to act in stages, without haste but without delay:
- Identify the source of the attack:An immediate technical audit can determine the origin of the problem: external intrusion, email account compromise, phishing or internal failure. The aim is twofold: to stop the bleeding and preserve evidence for the next steps.
- Involve the compliance function: Professionals subject to the 2004 law on the fight against money laundering and the financing of terrorism must assess the situation from the point of view of this fight. Reporting to the FIU (Financial Intelligence Unit) may be necessary: beyond the legal obligation, it can facilitate the blocking of misappropriated funds: the units and administrations active in this area in many countries cooperate and can block suspicious transfers.
- Check whether there has been a data leak: If personal data has been compromised, notification must be made to the CNPD or the competent authority in the Union within 72 hours. Failure to do so may result in significant administrative penalties, irrespective of the criminal or civil liability of the fraudster.
- Envisaging the filing of a complaint: A complaint with civil party status allows you to become a player in the proceedings and gain quicker access to investigation information. In some cases, it can also strengthen the victim’s position vis-à-vis their insurers or contractual partners.
Anticipating to limit the damage
The best defence is still preparation. Each institution should have a fraud response vademecum, a veritable crisis manual specifying:
- who acts,
- according to what procedure,
- and with which external service providers (IT, lawyer, insurer).
Such a system, regularly tested through simulations, allows you to react without improvisation and to rapidly coordinate technical, legal and communication actions. It also constitutes proof of due diligence in the event of an inspection or dispute.
Conclusion
IT fraud is now a compliance risk in its own right. In an environment where the speed of operations is both a strength and a weakness, financial institutions must combine responsiveness, coordination and preparation. The implementation of the DORA regulation will make these requirements even more stringent, by imposing a genuine culture of digital resilience. Because when it comes to fraud, it is no longer a question of if it will happen, but when, and how we will respond.
Anne-Marie Ka, Partner : anne-marie.ka@btplawyers.lu