## Introduction

## Source details

**Canonical URL:** [Introduction](https://www.imf.org/-/media/files/publications/wp/2026/english/wpiea2026062-source-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/wp/2026/english/wpiea2026062-source-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/wp/2026/english/wpiea2026062-source-pdf.pdf.json)

---

### Threat landscape and reporting challenges
- Analyzing the threat landscape is critical to understanding the nature, scope and intensity of cyber risks in the financial sector.
- Challenges that hinder analysis:
  - incomplete and missing information regarding incidence of cyber-attacks and digital fraud;
  - fragmented sourcing, recording and storage of information on such events;
  - inadequate frameworks for cybersecurity incident reporting;
  - weak arrangements for domestic and cross-border information sharing.
- Empirical context:
  - almost one-fifth of reported cyber incidents during 2004 and 2023 impacted the financial sector, with banks being the most frequent targets followed by insurers and asset managers (IMF, 2024).
  - the number of cyberattacks has almost doubled relative to the period before the COVID-19 pandemic.
  - few jurisdictions publish a generic threat landscape report or one tailored for the financial sector; available data often come from multiple official sources that may conflict or be incomplete.
  - law enforcement agencies in some jurisdictions monitor and publish progress and statistics to address scams, fraud, and cybercrime; such efforts have helped address cyber-enabled fraud amid rapid growth in digital finance, including online digital payments and cryptocurrency activities.

### Sources of threat intelligence and confidentiality constraints
- Typical threat intelligence sources:
  - public agencies (e.g., national Computer Emergency Response Team (CERT) in some jurisdictions);
  - private sector firms offering threat intelligence services;
  - regional reporting efforts.
- Financial sector authorities collect incident information through regulatory reporting by supervised entities.
- Constraints and inconsistencies:
  - incident information is often confidential and market sensitive and therefore not publicly available or requires paid access to private services;
  - differences in taxonomy used to define a cyber incident create inconsistencies in counts and complicate analysis;
  - international standard-setting bodies have sought to establish a common cyber lexicon and converge on incident reporting approaches.
- Public interest (internet search interest) in “cyber attack”, “cyber fraud”, and “payment fraud” has trended upwards over time, with peaks during events that could cause widespread disruptions.

### Objective and organization of the paper
- Objective: use publicly available data on cyber events and digital fraud to review developments over the past decade and examine trends.
- Organization:
  - Section 2: data and methodology;
  - Section 3: cyber events in the financial and ICT sectors, with sector-level analysis;
  - Section 4: trends in digital fraud—covering cyber-enabled and payment-related fraud—at aggregate level and in selected jurisdictions;
  - Section 5: conclusions.

### Data and methodology (primary data sources)
- Analysis uses three major sources of publicly available information:
  - (i) Cyber Events Database of the Center for International and Security Studies at Maryland (CISSM), University of Maryland;
  - (ii) cyber-enabled fraud database from the United Nations Office on Drugs and Crime (UNODC) and jurisdictions that publicly report cybercrime;
  - (iii) payment-related fraud data from selected jurisdictions.
- Jurisdictions referenced for UNODC and other public reporting include Canada, the United States, the United Kingdom, the European Union, and India.

### Cyber Events — database scope and taxonomy
- Database coverage after minor adjustments:
  - total of 14,055 cyber events recorded during January 2014 to December 2023;
  - data from 162 jurisdictions;
  - events across 20 industry sectors.
- Financial-sector overview:
  - 1,246 cyber events in the financial sector during 2014–2023, representing 9 percent of total cyber events;
  - the share of cyber events in the financial sector rose from 6 percent in 2014 to 13 percent in 2023.
- Aggregate sector shares (2014–2023):
  - public administration: 18 percent;
  - health care and social assistance: 13 percent;
  - ICT: 10 percent;
  - educational services: 10 percent;
  - finance and insurance: 9 percent.
- Event intent and method breakdown:
  - exploitative events: 54 percent of cyber events overall;
  - disruptive events: 46 percent of cyber events overall;
  - exploitative targets largely application servers: 40 percent, and end hosts: 11 percent;
  - disruptive methods largely message manipulation: 9 percent, and external denial of service: 11 percent.
- Definition: a cyber event refers to “the result of any single unauthorized effort, or the culmination of many such technical actions, that engineers, through use of computer technology and networks, a desired primary effect on a target” (taxonomy cited from Harry and Gallagher, 2018).

### Cyber Events — financial subsector findings
- Financial subsector shares of financial-sector cyber events (2014–2023):
  - monetary authorities (central banks): 4 percent;
  - credit intermediation and related activities: 46 percent;
  - securities and commodities markets and related activities: 33 percent;
  - insurance carriers and related activities: 16 percent;
  - funds, trusts, and other financial vehicles: 1 percent.
- Within the financial sector:
  - events were largely exploitative: 66 percent;
  - disruptive events: 34 percent;
  - exploitative methods largely targeted application servers: 50 percent, and end hosts: 12 percent;
  - disruptive methods primarily external denial of service: 18 percent, and data attacks: 12 percent.
- Subsector-specific application-server targeting:
  - banking: 44 percent targeted via application servers;
  - securities and commodities market intermediaries: 57 percent targeted via application servers;
  - insurance: 59 percent targeted via application servers.

### ICT sector and interdependencies
- ICT sector (2014–2023) statistics:
  - 1,414 cyber events in ICT, representing 10 percent of total events;
  - within ICT, telecommunications accounted for 21 percent of ICT events;
  - computing infrastructure, data processing, web hosting, and related services accounted for 24 percent of ICT events;
  - combined telecommunications and computing infrastructure subsectors represent 45 percent of the ICT sector events discussed.

### Geographical distribution and trends
- Geographic pattern (2014–2023):
  - the U.S. recorded 6,479 incidents—far more than any other country.
  - Primary targets concentrated in North America, Western Europe, East Asia, and parts of South Asia.
  - Emerging markets and developing countries reported significantly fewer incidents.
- Temporal trends:
  - steady increase in frequency of cyberattacks globally from 2014 to 2023, with particularly sharp growth over the past five years;
  - financial-sector cyber events fluctuated upward between 2014 and 2020, followed by a sharp surge beginning in 2021;
  - growth of cyber events in the financial sector has been especially striking during the last five years, with a continuous and rapidly rising share of total cyber events since 2020.
- Subsector shares reiterated: credit intermediation and securities markets account for approximately 46 percent and 33 percent of financial-sector incidents, respectively.

### Digital fraud — cyber-enabled fraud and payment-related fraud
- Rationale: digital fraud is relevant to regulated financial institutions because of operational, reputational, and payment system risks, and arises with widespread use of digital financial services and social media platforms.
- Cyber-enabled fraud (UNODC):
  - Fraud defined as “obtaining money or other benefit or evading a liability through deceit or dishonest conduct”; cyber-related fraud occurs “if the use of computer data or computer systems was an integral part of the modus operandi of the crime” (UNODC, 2024).
  - The ICCS distinguishes cyber-dependent crimes and cyber-enabled crimes; this paper uses data on cyber-enabled crimes.
  - As of April 2025, 60 jurisdictions have reported cyber-related fraud statistics to the UNODC, but only 13 countries have reported sufficient data over a 10-year period to study trends.
  - National repositories mentioned: India’s National Crime Records Bureau, Singapore Police Force mid-year briefs, U.K. Action Fraud, and U.S. FBI Internet Crime Complaint Center (IC3).
- Payment-related fraud:
  - Public official sources reviewed include Canada, the European Union, India, the United Kingdom, and the United States.

### Methodology limitations and cautions
- Key limitations affecting analysis and cross-country comparisons:
  - the study is guided by the UNODC definition of “cyber-enabled fraud,” used interchangeably here with “digital fraud” as in BCBS.
  - aggregate global cyber-enabled fraud figures are rough estimates based on statistics reported by law enforcement agencies to the UNODC; data are missing for several jurisdictions over the 10-year window.
  - under-reporting or non-reporting of fraud by victims to law enforcement agencies is a common issue.
  - differences in legal definitions of offences, counting and recording methodologies, and reporting rates across countries complicate cross-country comparisons.
  - a cause-and-effect analysis across the three data sources—cyber events, cyber-enabled fraud, and payment fraud—is not practicable, though interrelationships may exist.
- To address limitations, the study references industry studies and media reports where specific events are relevant (for example, industry studies by the Global Anti-Scam Alliance).

### Central banks (Monetary Authorities—Central Bank)
- Importance and incidence:
  - Central banks account for only around four percent of all reported incidents within the financial sector but are critically important due to systemic role and unique responsibilities.
  - Between 2014 and 2023, cyber events involving central banks have remained consistently low, averaging about three incidents per year in nine out of the ten years.
  - An outlier occurred in 2016 when reported incidents involving central banks spiked to eighteen.
- Explanations for low counts:
  - stronger governance and cybersecurity frameworks at central banks;
  - internal cyber simulations and increased cybersecurity investments;
  - limited incentives or obligations to disclose cyber incidents; reputational concerns and scarce public data.
- Geography and capacity:
  - Central banks in emerging markets and developing economies account for 58 percent of reported cyber events, compared with 42 percent for developed markets.
  - Fewer than half of central banks and supervisory authorities in emerging market and developing economies had established a national cybersecurity strategy focused on the financial sector as of 2023.
  - Global cybersecurity workforce gap noted, with developing countries facing the most severe shortages.
- Systemic transmission mechanisms (selected):
  - deterioration in public confidence and reassessment by foreign investors, potentially affecting money demand;
  - liquidity disruptions if the central bank cannot clear transactions, leading to delays in wage payments and settlement failures;
  - amplified macroeconomic slowdown when limited operational resilience, lack of backup systems, and contingency frameworks interact with other stressors.
- Example: a 2023 event in a southern African country disrupted interbank payment operations for over a week; reported as causing no observable financial losses but likely to have threatened systemic vulnerabilities.

### Credit intermediation (banking sector)
- Scope and concentration:
  - Cyber incidents related to credit intermediaries account for 46 percent of all cases within the financial sector.
  - Incidents in the banking sector increased over the past decade, with a notable surge following the COVID-19 pandemic.
- G-SIBs versus non-G-SIBs:
  - Between 2014 and 2023, 13 percent of cyber incidents in the global banking sector involved G-SIBs; 87 percent involved non-G-SIBs.
  - Non-G-SIBs are more frequently targeted, possibly due to weaker cybersecurity investments, legacy systems, and constrained resources.
- Common outcomes and third-party risk:
  - Data breaches are among the most frequent outcomes; third-party vendors are often vulnerable links.
  - Banks’ limited capacity to monitor and manage third‑party cyber risk and misalignment of vendor priorities can create structural vulnerabilities.
- Role of geopolitics:
  - Geopolitical tensions have emerged as an important factor shaping attack motivations against banks, often aiming to disrupt public access rather than directly profit.

### Securities and market intermediaries
- Incidents and systemic implications:
  - Cyber incidents affecting the securities sector accounted for approximately 33 percent of all observed financial-sector events.
  - Attacks targeting securities exchanges, trading systems, or other critical market infrastructure can cause trading disruptions, delays in price quotations, execution failures, and breakdowns in clearing and settlement processes.
  - Concentration of targets on high-value systemic nodes, such as stock exchanges and central securities depositories (CSDs), raises systemic spillover risk.
- Crypto-related incidents:
  - Rise of crypto assets and DeFi coincides with a rising number of crypto-related incidents and large financial losses.
  - Example: in 2023, a crypto platform based in a Southeast Asian jurisdiction experienced two major digital asset losses—one loss of approximately USD 125 million and an additional loss of USD 103 million—both reportedly linked to exploitation of application server vulnerabilities.

### Insurance sector
- Trends and data sensitivity:
  - Cyber incidents targeting the insurance sector remained relatively stable between 2014 and 2019, then increased significantly starting 2020.
  - Within financial-sector incidents recorded, insurance accounts for 16 percent.
  - Data breaches are the predominant form of cyber incidents in insurance.
- Data value and breach sources:
  - Insurance data, particularly customers’ medical records, is often more valuable than credit card data on dark web markets.
  - Life insurance: breaches more frequently linked to third-party service providers.
  - Property & Casualty: breaches tend to originate within insurers’ own systems.
- Latent risks:
  - Stolen insurance data are frequently sold on the dark web and used in identity theft, financial fraud, and other illicit activities.

### Funds and trusts
- Incidence and characteristics:
  - Cyber incidents involving funds and trusts account for about 1 percent of recorded financial-sector events, with nearly all cases concentrated in 2022 and 2023.
  - Predominance of sensitive data exposure, often resulting from breaches at third-party service providers.
  - Pension funds’ gradual involvement in crypto asset markets expands cybersecurity risk exposure via digital wallets, trading platforms, and custodial services.

### ICT Service Providers: interdependence and transmission risk
- Trend divergence:
  - From 2014 to 2020, cyber incidents affecting the financial sector and ICT service providers followed broadly similar trends; starting in 2021, financial-sector incidents rose sharply while ICT provider incidents remained relatively stable.
- Drivers and resilience:
  - Post-pandemic acceleration of digital transformation in finance increased exposure.
  - Many ICT service providers—especially cloud and infrastructure specialists—generally possess stronger cybersecurity capabilities.
- Transmission mechanisms and examples:
  - Cyberattacks on ICT providers can cascade to financial institutions that rely on their services (identity authentication, remote access, API connectivity, code hosting).
  - Example: Cloudflare experienced multiple outages in 2020 and 2022, and repeated DDoS attacks, with widespread repercussions for downstream financial clients.
  - Large-scale disruptions to ICT or logistics providers may function as negative supply shocks with potential implications for cost-push inflation when digital and physical supply chains are interconnected.

### Digital fraud and regional patterns
- Aggregate trends:
  - Cyber-enabled fraud has nearly tripled in the period of 10 years, reaching around 2.5 million cases in 2022 due to a sharp increase observed during COVID-19.
  - Industry studies estimate losses that amounted to around one trillion US dollars in 2024 (GASA, 2024a).
- Relationship with income and banking depth:
  - Number of cyber-enabled fraud cases appears to increase with rising national income (GDP per capita, PPP) across an analysis of 38 countries.
  - Cyber-enabled fraud also rises with the value of bank deposits (deposit money banks assets to GDP (%)).
- Regional observations:
  - Asia—cyber-enabled fraud has rapidly increased.
  - Europe—cyber-enabled fraud has moderately increased.
  - North America—cyber-enabled fraud has continually grown.
- Reporting caveats:
  - Actual numbers are estimates with underreporting in many jurisdictions.
  - Some developing countries’ estimated losses have been around 2.5 percent to 4.2 percent of GDP.
- Law enforcement observations:
  - Growth in sophistication of fraud using ICT, including artificial intelligence, prevalence of scam centers, and relationship-investment fraud.
  - Financial intelligence units identify money laundering networks involving banks, payments and remittance service providers, and virtual assets service providers.

### Asia: cyber-related fraud (selected jurisdictional evidence)
- Aggregate estimate (industry survey): USD 688 billion total economic impact across 13 jurisdictions in 2024 (GASA, 2024b).
- Singapore:
  - 28,751 cases between January and June 2024;
  - losses around Singapore Dollar 385 million between January and June 2024;
  - survey: 65 percent of Singaporeans face scams at least once per month; 68 percent of scam victims chose not to report their experience to law enforcement (GASA, 2024c);
  - as of 2025, total scam cases and losses have fallen and remained a key priority for the government.
- India:
  - 65,893 cases registered under cybercrimes where 26.5 percent (17,470 cases) were fraud-related (National Crime Records Bureau, 2022);
  - Reserve Bank of India noted online payment fraud grew INR14½ billion in the year ended March 2024; as of March 2025, online fraud declined (RBI, 2024; RBI, 2025).
- Mainland China:
  - No direct UNODC data; Macao, China data show sharp increases;
  - media report: in 2023, the Ministry of Public Security was reported to have solved 437,000 cases of telecom network fraud.

### Payment-related fraud: jurisdictional findings and figures
- Canada:
  - CAD530 million in losses in 2022;
  - cryptocurrency losses: CAD8.2 million (2019), CAD22.5 million (2020), nearly CAD126 million (2022);
  - wire transfer was the top payment method used in fraud; e-transfers also grew in popularity for fraud.
- Europe (EEA):
  - value of fraudulent payment transactions reported by the financial services sector: EUR 4.3 billion in 2022;
  - nearly EUR 2 billion in H1 2023;
  - declines in card fraud linked to strong customer authentication (SCA); concerns about instant payments and social-engineering fraud remain.
- India:
  - online payment fraud reported as INR14½ billion in the year ended March 2024 (media reports citing RBI).
- United Kingdom:
  - Authorized push payments (APP) volumes increased by 12 percent since 2022; losses fell by 12 percent in the same period (The Payment Systems Regulator, 2024);
  - industry studies: 77 percent of APP fraud in the first half of 2023 originated online (UK Finance, 2024).
- United States:
  - losses from Internet crime reached USD 16.6 billion in 2024 (FBI, 2024);
  - cyber-enabled fraud represented around 83 percent of all losses reported to the IC3 in 2024;
  - IC3 has received over 9 million complaints since 2000, averaging more than 2,000 complaints per day.

### Policy measures and practitioner actions identified
- Strengthen legal basis and regulatory framework to protect consumers on data privacy, liability-sharing, and recovery of financial losses.
- Formulate a ‘whole-of-society’ approach including national strategies to fight digital fraud.
- Develop and adopt a fraud taxonomy to capture and categorize fraud scenarios.
- Establish fraud risk management frameworks across organizations.
- Identify and eliminate mule accounts; deploy AI/ML detection models for mule accounts.
- Strengthen measures against payment fraud (e.g., SCA, daily payment limits, payee verification, fraud monitoring).
- Establish anti-scam centers and/or central fraud registries to facilitate victim reporting.
- Enable cross-sectoral co-operation among public authorities and the private sector.
- Consider mandatory reimbursement schemes for authorized push payment fraud victims in certain circumstances.

### Conclusion: implications for monitoring and stability
- Cyber events in the financial sector have grown by tenfold; cyber-enabled fraud has nearly tripled in the past decade.
- Incidents are heterogeneous institutionally and geographically; non-G-SIBs account for the majority of cases, indicating potential gaps in preparedness among smaller and less-resourced institutions.
- Advanced and highly digitalized economies report more incidents, likely reflecting greater exposure, digital integration, and stronger reporting mechanisms.
- Data breaches remain the most common outcome, particularly in securities, insurance, and payments sectors.
- Geopolitical tensions increasingly shape attack motivations, with several incidents exhibiting characteristics of state-linked operations.
- Financial stability implications from digital fraud include financial losses to banks and reputational risks to banks and supervisors (BCBS, 2023).
- Rapid growth of digital payments and cryptoassets, and movement of funds between traditional and crypto parts of the financial system, warrant close monitoring of evolving risks in the threat landscape.

*Source: wpiea2026062-source-pdf - Introduction (IMF Working Paper chapter content unit).*

### Introduction ...........................................................................................................

### Introduction

### Major sections (chapter structure)
- Introduction (page 4)
- Data and Methodology (page 5)
- Cyber Events (page 6)
  - Cyber Events (detailed, page 9)
  - Monetary Authorities (page 13)
  - Credit Intermediation (page 15)
  - Securities and Commodities Markets and Market Intermediaries (page 17)
  - Insurance (page 19)
  - Funds and Trusts (page 20)
  - ICT Service Providers (page 21)
- Digital Fraud (page 8 and beyond)
  - Cyber-Enabled Fraud (page 8; detailed from page 22)
  - Payment-Related Fraud (page 8; detailed from page 24)
  - Global (page 22)
  - Regional Evidence (page 24)
  - Payment-Related Fraud (detailed, page 24)
- Methodology and Limitations (page 8)
- Conclusion (page 28)
- References (page 29)

### Figures listed in the content unit
- Figure 1. Cyber Attack, Cyber Fraud, and Payment (no page given)
- Figure 2. Framework for Analyzing Cyber (no page given)
- Figure 3. Number of Cyber Events in the Financial Sector Across Jurisdictions, 2014-2023
- Figure 4. Global Cyber Events, 2014-2023
- Figure 5. Cyber Events in the Financial Sector, 2014-2023
- Figure 6. Cyber Events in Central Banks
- Figure 7. Cyber Events Impacting Credit Intermediaries
- Figure 8. Cyber Events in Securities
- Figure 9. Global Cyber Events in Insurance
- Figure 10. Global Cyber Events Trends in Financial Sector and ICT Service Provider
- Figure 11. Cyber-Enabled Fraud: Numbers and Trends
- Figure 12. Payment-Related Fraud: Losses and Trends

### Tables listed in the content unit
- Table 1. Cyber Events by Type and Industry Sector, 2014-23
- Table 2. Cyber Events in the Financial Sector by Subsector and Type, 2014-23
- Table 3. Cyber Events in the Information Sector by Subsector and Type, 2014-23

### Annex
- ANNEX I. North American Industrial Classification System (page 32)

*Source: wpiea2026062-source-pdf - Introduction (IMF Working Paper content unit).*

### Introduction

### Introduction

### Threat landscape and reporting challenges
- Analyzing the threat landscape is critical to understanding the nature, scope and intensity of cyber risks in the financial sector.
- Challenges that hinder analysis:
  - incomplete and missing information regarding incidence of cyber-attacks and digital fraud;
  - fragmented sourcing, recording and storage of information on such events;
  - inadequate frameworks for cybersecurity incident reporting;
  - weak arrangements for domestic and cross-border information sharing.
- The IMF’s recent study found that almost one-fifth of reported cyber incidents during 2004 and 2023 impacted the financial sector, with banks being the most frequent targets followed by insurers and asset managers (IMF, 2024).
- The number of cyberattacks has almost doubled relative to the period before the COVID-19 pandemic.
- Few jurisdictions publish a generic threat landscape report or one tailored for the financial sector; available data often come from multiple official sources that may conflict or be incomplete.
- Law enforcement agencies in some jurisdictions monitor and publish progress and statistics to address scams, fraud, and cybercrime; such efforts have helped address cyber-enabled fraud amid rapid growth in digital finance, including online digital payments and cryptocurrency activities.

### Sources of threat intelligence and confidentiality constraints
- Threat intelligence is typically obtained from:
  - public agencies (e.g., national Computer Emergency Response Team (CERT) in some jurisdictions);
  - private sector firms offering threat intelligence services;
  - regional reporting efforts (example regional bodies cited in the source).
- Financial sector authorities also collect incident information through regulatory reporting by supervised entities.
- Information on cybersecurity incidents is often confidential and market sensitive and therefore not publicly available or requires paid access to private services.
- Differences in taxonomy used to define a cyber incident create inconsistencies in counts and complicate analysis.
- International standard-setting bodies have sought to establish a common cyber lexicon and converge on incident reporting approaches.
- Public interest (internet search interest) in “cyber attack”, “cyber fraud”, and “payment fraud” has trended upwards over time, with peaks during events that could cause widespread disruptions.

### Objective and organization of the paper
- Objective: use publicly available data on cyber events and digital fraud to review developments over the past decade and examine trends.
- Organization:
  - Section 2: data and methodology;
  - Section 3: cyber events in the financial and ICT sectors, with sector-level analysis;
  - Section 4: trends in digital fraud—covering cyber-enabled and payment-related fraud—at aggregate level and in selected jurisdictions;
  - Section 5: conclusions.

### Data and methodology (primary data sources)
- Analysis uses three major sources of publicly available information:
  - (i) Cyber Events Database of the Center for International and Security Studies at Maryland (CISSM), University of Maryland;
  - (ii) cyber-enabled fraud database from the United Nations Office on Drugs and Crime (UNODC) and jurisdictions that publicly report cybercrime;
  - (iii) payment-related fraud data from selected jurisdictions.
- Jurisdictions referenced for UNODC and other public reporting include Canada, the United States, the United Kingdom, the European Union, and India.

### Cyber Events — database scope and taxonomy
- After minor adjustments, the Cyber Events Database covered:
  - total of 14,055 cyber events recorded during January 2014 to December 2023;
  - data from 162 jurisdictions;
  - events across 20 industry sectors.
- Financial-sector overview:
  - 1,246 cyber events in the financial sector during 2014–2023, representing 9 percent of total cyber events;
  - the share of cyber events in the financial sector rose from 6 percent in 2014 to 13 percent in 2023.
- Aggregate sector shares (2014–2023):
  - public administration: 18 percent;
  - health care and social assistance: 13 percent;
  - ICT: 10 percent;
  - educational services: 10 percent;
  - finance and insurance: 9 percent.
- Event intent and method breakdown:
  - exploitative events: 54 percent of cyber events overall;
  - disruptive events: 46 percent of cyber events overall;
  - exploitative targets largely application servers: 40 percent, and end hosts: 11 percent;
  - disruptive methods largely message manipulation: 9 percent, and external denial of service: 11 percent.
- Definition: a cyber event refers to “the result of any single unauthorized effort, or the culmination of many such technical actions, that engineers, through use of computer technology and networks, a desired primary effect on a target” (taxonomy cited from Harry and Gallagher, 2018).

### Cyber Events — financial subsector findings
- Financial subsectors (NAICS-guided) and shares of financial-sector cyber events (2014–2023):
  - monetary authorities (central banks): 4 percent;
  - credit intermediation and related activities: 46 percent;
  - securities and commodities markets and related activities (including market intermediaries): 33 percent;
  - insurance carriers and related activities: 16 percent;
  - funds, trusts, and other financial vehicles: 1 percent.
- Within the financial sector:
  - events were largely exploitative: 66 percent;
  - disruptive events: 34 percent;
  - exploitative methods largely targeted application servers: 50 percent, and end hosts: 12 percent;
  - disruptive methods primarily external denial of service: 18 percent, and data attacks: 12 percent.
- Subsector-specific targeting via application-server exploitation:
  - banking: 44 percent targeted via application servers;
  - securities and commodities market intermediaries: 57 percent targeted via application servers;
  - insurance: 59 percent targeted via application servers.

### ICT sector and interdependencies
- ICT sector (2014–2023) statistics:
  - 1,414 cyber events in ICT, representing 10 percent of total events;
  - within ICT, telecommunications accounted for 21 percent of ICT events;
  - computing infrastructure, data processing, web hosting, and related services accounted for 24 percent of ICT events;
  - combined telecommunications and computing infrastructure subsectors represent 45 percent of the ICT sector events discussed.

### Geographical distribution and trends
- Geographical pattern (2014–2023):
  - the U.S. recorded 6,479 incidents—far more than any other country.
  - Primary targets concentrated in North America, Western Europe, East Asia, and parts of South Asia—regions that are global financial hubs or have large digital financial markets and complex digital public infrastructure.
  - Emerging markets and developing countries reported significantly fewer incidents.
- Temporal trends:
  - steady increase in frequency of cyberattacks globally from 2014 to 2023, with particularly sharp growth over the past five years;
  - financial-sector cyber events fluctuated upward between 2014 and 2020, followed by a sharp surge beginning in 2021;
  - growth of cyber events in the financial sector has been especially striking during the last five years, with a continuous and rapidly rising share of total cyber events since 2020.
- Subsector shares reiterated: credit intermediation and securities markets account for approximately 46 percent and 33 percent of financial-sector incidents, respectively.

### Digital fraud — cyber-enabled fraud and payment-related fraud
- Rationale: digital fraud is relevant to regulated financial institutions because of operational, reputational, and payment system risks, and arises with widespread use of digital financial services and social media platforms.
- Cyber-enabled fraud (UNODC):
  - UNODC collects data via the United Nations Crime Trends Survey, guided by the International Classification of Crimes for Statistical Purposes (ICCS).
  - Fraud defined as “obtaining money or other benefit or evading a liability through deceit or dishonest conduct”; cyber-related fraud occurs “if the use of computer data or computer systems was an integral part of the modus operandi of the crime” (UNODC, 2024).
  - The ICCS distinguishes cyber-dependent crimes and cyber-enabled crimes; this paper uses data on cyber-enabled crimes.
  - As of April 2025, 60 jurisdictions have reported cyber-related fraud statistics to the UNODC, but only 13 countries have reported sufficient data over a 10-year period to study trends.
  - Noted jurisdictions publishing data include India and the United States; national repositories mentioned include India’s National Crime Records Bureau, Singapore Police Force mid-year briefs, U.K. Action Fraud, and U.S. FBI Internet Crime Complaint Center (IC3).
- Payment-related fraud:
  - Public official sources reviewed for payment-related fraud include Canada, the European Union, India, the United Kingdom, and the United States.

### Methodology limitations and cautions
- Key limitations affecting analysis and cross-country comparisons:
  - the study is guided by the UNODC definition of “cyber-enabled fraud,” used interchangeably here with “digital fraud” as in BCBS.
  - aggregate global cyber-enabled fraud figures are rough estimates based on statistics reported by law enforcement agencies to the UNODC; data are missing for several jurisdictions over the 10-year window.
  - under-reporting or non-reporting of fraud by victims to law enforcement agencies is a common issue.
  - differences in legal definitions of offences, counting and recording methodologies, and reporting rates across countries complicate cross-country comparisons.
  - a cause-and-effect analysis across the three data sources—cyber events, cyber-enabled fraud, and payment fraud—is not practicable, though interrelationships may exist.
- To address limitations, the study references industry studies and media reports where specific events are relevant (for example, industry studies by the Global Anti-Scam Alliance).

_Introduction — IMF Working Paper chapter content (wpiea2026062-source-pdf - Introduction)._

### 1. Global: Number of Cyber Events 2. Global: Number of Cyber Events by Top 5 Sectors

### 1. Global: Number of Cyber Events 2. Global: Number of Cyber Events by Top 5 Sectors

### Global trends and sectoral distribution
- Sources: University of Maryland CISSM Cyber Events Database; and IMF staff calculations.
- Top sectors highlighted in figures and text: Financial sector, Educational Services, Information sector, Health Care and Social Assistance, Public Administration.
- Visuals referenced include time series panels covering 2014–2023 for:
  - Global number of cyber events (overall and by top 5 sectors).
  - Cyber events in the financial sector and its subsectors (including Monetary Authorities–Central Bank; Credit Intermediation and Related Activities; Securities, Commodity Contracts, and Other Financial...; Insurance Carriers and Related Activities; Funds, Trusts, and Other Financial Vehicles).

### Central banks (Monetary Authorities—Central Bank)
- Context and importance:
  - Central banks account for only around four percent of all reported incidents within the financial sector but are critically important due to systemic role and unique responsibilities.
  - Central banks play a central role in operation and oversight of key financial infrastructures, including payment systems, settlement arrangements, and liquidity facilities.
- Incident frequency and reporting:
  - Between 2014 and 2023, cyber events involving central banks have remained consistently low, averaging about three incidents per year in nine out of the ten years.
  - An outlier occurred in 2016 when reported incidents involving central banks spiked to eighteen.
  - Possible explanations for low reported counts: stronger governance and cybersecurity frameworks at central banks; internal cyber simulations and increased cybersecurity investments; limited incentives or obligations to disclose cyber incidents; reputational concerns and scarce public data.
  - Example: May 2016 Distributed Denial of Service (DDoS) attacks during Operation Icarus affected multiple central bank websites across regions and contributed to the 2016 spike.
- Geography and capacity:
  - Central banks in emerging markets and developing economies account for 58 percent of reported cyber events, compared with 42 percent for developed markets.
  - Fewer than half of central banks and supervisory authorities in emerging market and developing economies had established a national cybersecurity strategy focused on the financial sector as of 2023.
  - Global cybersecurity workforce gap noted, with developing countries facing the most severe shortages.
- Systemic risk transmission:
  - A cyber event disrupting a central bank–operated interbank payment system can threaten financial stability and propagate to the real economy through three principal transmission mechanisms (as depicted in Figure 6, panel 3):
    - Deterioration in public confidence and reassessment by foreign investors, potentially affecting money demand.
    - Liquidity disruptions if the central bank cannot clear transactions, leading to delays in wage payments and settlement failures.
    - Amplified macroeconomic slowdown when limited operational resilience, lack of backup systems, and contingency frameworks interact with other stressors.
  - Example: A 2023 event in a southern African country disrupted interbank payment operations for over a week; reported as causing no observable financial losses but likely to have threatened systemic vulnerabilities.

### Credit intermediation (banking sector)
- Scope and concentration:
  - Cyber incidents related to credit intermediaries account for 46 percent of all cases within the financial sector.
  - Incidents in the banking sector increased over the past decade, with a notable surge following the COVID-19 pandemic.
- G-SIBs versus non-G-SIBs:
  - Between 2014 and 2023, 13 percent of cyber incidents in the global banking sector involved G-SIBs; 87 percent involved non-G-SIBs.
  - Non-G-SIBs are more frequently targeted, possibly due to weaker cybersecurity investments, legacy systems, and constrained resources.
  - Despite fewer incidents involving G-SIBs, their systemic importance means successful attacks could have far-reaching consequences.
- Common outcomes and third-party risk:
  - Data breaches are among the most frequent outcomes; third-party vendors (payment processors, file transfer providers, marketing firms, IT vendors) are often vulnerable links.
  - Banks’ limited capacity to monitor and manage third‑party cyber risk and misalignment of vendor priorities can create structural vulnerabilities and entry points for attackers.
- Role of geopolitics:
  - Geopolitical tensions have emerged as an important factor shaping attack motivations against banks.
  - Observed politically charged attacks often aim to disrupt public access (website takedowns, defacements, denial-of-service) rather than to directly profit, but still expose critical vulnerabilities.

### Securities and market intermediaries
- Increasing incidents:
  - Over the past decade, cyber incidents targeting the securities sector have steadily increased, driven by growth in financial technology, expansion of crypto-asset ecosystems, and digitalization of securities services.
- Broad exposure:
  - Cybersecurity risks extend across reporting issuers, trading venues, market intermediaries, asset managers, and financial market infrastructures (FMIs), reflecting the sector’s multifaceted and highly interconnected exposure to cyber threats.
- Crypto-related incidents:
  - Crypto-related incidents are discussed within existing financial sector categories where they intersect with regulated institutions.

### Key statistics and figures (exact values preserved from source)
- Central banks: around four percent of all reported incidents within the financial sector.
- Central bank incident counts (2014–2023): averaging about three incidents per year in nine out of the ten years.
- Central bank spike in 2016: spiked to eighteen reported incidents.
- Share of central bank cyber events: 58 percent Emerging Market; 42 percent Developed Market.
- Credit intermediation: account for 46 percent of all cases within the financial sector.
- Share of banking-sector incidents involving G-SIBs (2014–2023): 13 percent G-SIBs; 87 percent Non-G-SIBs.

*Sources: University of Maryland CISSM Cyber Events Database; and IMF staff calculations.*

### 1. Global Cyber Events Trends in Securities  2. Cyberattack Transmission Through Capital

### 1. Global Cyber Events Trends in Securities  2. Cyberattack Transmission Through Capital Market Layers

### Overview and dataset
- Sources: University of Maryland CISSM Cyber Events Database; and IMF staff calculations.
- According to the University of Maryland’s CISSM Cyber Events Database, cyber incidents affecting the securities sector accounted for approximately 33 percent of all observed financial-sector events.

### Securities sector: characteristics and systemic implications
- Key observed characteristics:
  - Cyber incidents may contribute to broader market volatility, particularly when they target securities exchanges, trading systems, or other critical market infrastructure.
  - Disruptions can cause trading disruptions, delays in price quotations, execution failures, and breakdowns in clearing and settlement processes, eroding investor confidence and amplifying short-term market fluctuations.
  - Widespread media attention can cause spillovers to other markets, triggering increased risk aversion, reduced liquidity, or abrupt asset repricing.
  - Empirical research on the causal link between cyber events and market volatility is at an early stage, but accumulating case evidence suggests the relationship warrants greater scrutiny.
- Concentration of targets:
  - Cyberattacks disproportionately target high-value systemic nodes, such as stock exchanges and central securities depositories (CSDs), reflecting reliance on a limited set of critical market infrastructures.
  - A successful attack on such FMIs can trigger widespread operational disruptions and systemic spillovers.
  - Example (reported): in 2022, a leading CSD in an Asian jurisdiction experienced a malware incident that disrupted core system operations; official disclosures did not confirm large-scale data compromise or direct financial losses, but potential downstream effects on broker-dealers and custodian institutions were reported.

### Digital asset ecosystems and crypto-related incidents
- Trends and incidents:
  - The rise of crypto assets and decentralized finance (DeFi) coincides with a rising number of crypto-related incidents and large financial losses.
  - Overall financial losses from crypto-related cyberattacks have demonstrated an upward trajectory, with growing sophistication and diversification of attack vectors and targets (Chainalysis, 2024).
  - Platform-level example (reported): in 2023, a crypto platform based in a Southeast Asian jurisdiction experienced two major digital asset losses within a single week—one loss of approximately USD 125 million and an additional loss of USD 103 million.
  - Both 2023 incidents were reportedly linked to the exploitation of application server vulnerabilities.
- Implication:
  - High frequency and magnitude of attacks underscore acute operational risks facing digital asset infrastructures and how recurring vulnerabilities can amplify systemic exposure within the crypto-financial ecosystem.

### Insurance sector: trends and data sensitivity
- Aggregate trends:
  - Cyber incidents targeting the insurance sector remained relatively stable between 2014 and 2019, then increased significantly starting 2020 following the COVID-19 pandemic.
  - Within financial-sector incidents recorded in the CISSM database, the insurance sector accounts for 16 percent—ranking just behind credit intermediaries and securities markets sectors.
  - Data breaches are the predominant form of cyber incidents in the insurance sector.
- Data sensitivity and sources of breaches:
  - Insurance data, particularly customers’ medical records, is often more valuable than credit card data on dark web markets due to long-term utility and non-replaceable nature.
  - Difference by line:
    - Life insurance: data breaches are more frequently linked to vulnerabilities in third-party service providers, reflecting outsourcing of long-term sensitive data.
    - Property & Casualty (P&C): breaches tend to originate within insurers’ own systems due to more standardized, in-house processes.
- Latent risks:
  - Stolen insurance data are frequently sold on the dark web and used in identity theft, financial fraud, and other illicit activities, producing broader secondary harm.

### Funds and trusts: incidence, visibility, and crypto exposure
- Incidence and attribution:
  - Cyber incidents involving funds and trusts account for only about one percent of all recorded events in the financial sector, with nearly all cases concentrated in 2022 and 2023.
  - Low proportion may reflect limited disclosure practices and smaller digital attack surfaces.
- Typical characteristics:
  - Predominance of sensitive data exposure, often resulting from breaches at third-party service providers (data processors, file transfer platforms).
  - Many funds and trusts have limited cybersecurity budgets, leading to uneven defensive capabilities and greater susceptibility to sophisticated attacks.
- Crypto linkages:
  - Pension funds’ gradual involvement in crypto asset markets—often indirect through crypto investment vehicles or exchange-traded products—expands cybersecurity risk exposure via digital wallets, trading platforms, and custodial services.

### ICT Service Providers: interdependence and transmission risk
- Trend divergence:
  - From 2014 to 2020, the number of cyber incidents affecting the financial sector and ICT service providers followed broadly similar trends with moderate fluctuations.
  - Starting in 2021, incidents in the financial sector rose sharply, while growth among ICT service providers remained relatively stable.
- Drivers:
  - Post-pandemic acceleration of digital transformation in finance (digital banking, remote work, virtual asset services) increased financial-sector exposure to cyber risk.
  - Many ICT service providers—especially cloud and infrastructure specialists—generally possess stronger cybersecurity capabilities.
- Transmission mechanisms and examples:
  - Cyberattacks on ICT providers can cascade to financial institutions that rely on their services (identity authentication, remote access, API connectivity, code hosting).
  - Example: Cloudflare experienced multiple outages in 2020 and 2022, and repeated DDoS attacks, with widespread repercussions for downstream financial clients.
  - Large-scale disruptions to ICT or logistics providers may function as negative supply shocks with potential implications for cost-push inflation when digital and physical supply chains are interconnected.

### Digital fraud and cyber-enabled fraud trends
- Aggregate and regional trends:
  - Cyber-enabled fraud has nearly tripled in the period of 10 years, reaching around 2.5 million cases in 2022 due to a sharp increase observed during COVID-19.
  - Industry studies estimate losses that amounted to around one trillion US dollars in 2024 (GASA, 2024a).
- Relationship with national income and banking depth:
  - The number of cyber-enabled fraud cases appears to increase with rising national income (GDP per capita, PPP) across an analysis of 38 countries.
  - Cyber-enabled fraud also rises with the value of bank deposits (deposit money banks assets to GDP (%)).
- Regional observations:
  - Asia—cyber-enabled fraud has rapidly increased.
  - Europe—cyber-enabled fraud has moderately increased.
  - North America—cyber-enabled fraud has continually grown.
- Reporting and measurement caveats:
  - Actual numbers are estimates with underreporting in many jurisdictions.
  - Some jurisdictions are partially reported or unreported to UNODC, making regional trends difficult to observe (for example, Africa and the Middle East).
  - For some developing countries, estimated losses have been around 2.5 percent to 4.2 percent of GDP.
- Law enforcement and financial intelligence observations:
  - Growth in sophistication of fraud using ICT, including artificial intelligence, prevalence of scam centers, and relationship-investment fraud.
  - Financial intelligence units identify money laundering networks involving banks, payments and remittance service providers, and virtual assets service providers.

*Italic: Source — University of Maryland CISSM Cyber Events Database; IMF staff calculations; and materials cited within the source text.*

### 3. Asia Cyber-Related Fraud

### 3. Asia Cyber-Related Fraud

### Regional evidence: Asia
- Rapid increase in cyber-enabled fraud reported (Figure 11, panel 4).
- Industry surveys estimate total economic impact across 13 jurisdictions amounted to USD 688 billion in 2024 (GASA, 2024b).
- Singapore:
  - Number of scams and cybercrime cases reported: 28,751 cases between January and June 2024 (Singapore Police Force, 2024).
  - Losses: around Singapore Dollar 385 million between January and June 2024.
  - Industry survey findings: 65 percent of Singaporeans face scams at least once per month; 68 percent of scam victims chose not to report their experience to law enforcement (GASA, 2024c).
  - As of 2025, total scam cases and losses have fallen and remained a key priority for the government (Singapore Police Force, 2025).
- India:
  - Authorities reported a total of 65,893 cases registered under cybercrimes where nearly 26.5 percent of cases (17,470 cases) were fraud-related (National Crime Records Bureau, 2022).
  - Reserve Bank of India noted online payment fraud grew INR14½ billion in the year ended March 2024; as of March 2025, online fraud declined (RBI, 2024; RBI, 2025).
- Mainland China:
  - No direct data on cyber-enabled fraud available; an approximation uses Macao, China data, which has shown a sharp increase.
  - Media report: in 2023, the Ministry of Public Security was reported to have solved 437,000 cases of telecom network fraud.

### Broader regional comparisons
- Europe: moderate increase in cyber-enabled fraud largely based on Germany, Italy, and Poland data. Europol observed millions of victims across the European Union are attacked and exploited daily (Europol, 2024). ENISA analyzed 488 publicly related incidents affecting the finance sector where the share of banks was 46 percent (ENISA, 2024).
- North America: sharp increase in cyber-enabled fraud. FBI IC3 has received over 9 million complaints since 2000, averaging more than 2,000 complaints per day (FBI, 2024). Cryptocurrency-related complaints grew between 2017 to 2023 with a sharper increase between 2021 to 2023 (FBI, 2023a). Canadian Anti-Fraud Center received over 91,000 reports in 2022 and estimated only 5 to 10 percent of fraud and cybercrime are reported (CAFC, 2023).

### Payment-related fraud: overview and financial-stability implications
- Payment-related fraud spans wholesale and retail perspectives; wholesale payments fraud related to endpoint security has potential financial stability implications and calls for a strategy and toolkit to address such threats (CPMI, 2019; CPMI, 2018).
- Digital fraud (credit transfers, card-based payments, other instruments) raises supervisory and financial stability implications, including:
  - Financial losses to banks.
  - Reputation risks to banks and supervisors (BCBS, 2023).
- UNODC identified payment and money transfer infrastructures as an important conduit for transnational organized crime, cyber-enabled fraud, and underground banking, involving networks of money mules, virtual-asset service providers, and third-party payment applications established and controlled by organized crime actors (UNODC, 2024, p. 26).

### Jurisdictional findings on payment-related fraud (selected)
- Canada:
  - Reported losses increased sharply between 2020 to 2022 and amounted to around Canadian Dollar (CAD) 500 million in Canada in 2022 (CAFC, 2023).
  - CAFC noted CAD530 million in losses in 2022, the highest fraud losses on record.
  - Cryptocurrency losses grew from CAD8.2 million in 2019 to CAD22.5 million in 2020 and to nearly CAD126 million in 2022.
  - Wire transfer was the top form of payment method used in Canada; e-transfers also grew as a popular payment method used in fraud.
- Europe (EEA):
  - Value of fraudulent payment transactions reported by the financial services sector: EUR 4.3 billion in 2022.
  - Major forms of payment methods used in fraud: credit transfers and cards.
  - As of the first half of 2023, the amount was nearly EUR 2 billion; authorities view the general outlook for overall payment fraud as appearing stable (EBA and ECB, 2024).
  - Declines in card fraud linked to strong customer authentication (SCA) and card security codes; concerns remain about higher fraud rates in instant payments and complex social-engineering fraud types.
  - Ongoing efforts: daily payment limits, payee verification, improved fraud monitoring, considerations to strengthen legal framework under Payment Services Directive 3 and Payment Systems Regulation (EBA, 2024).
  - Development of a fraud taxonomy by the Euro Banking Association to capture and categorize fraud scenarios related to account-to-account and card payments.
- India:
  - Card and online/internet cases form a large share of total banking fraud cases.
  - Online payment fraud reported as INR14½ billion in the year ended March 2024 (media reports citing RBI statistics).
  - Authorities implementing central bank guidelines, a Central Payments Fraud Information Registry, and an artificial intelligence and machine learning model to help detect mule accounts.
  - Measures to compensate customers for small-value digital fraud proposed as of February 2026.
- United Kingdom:
  - Card and payments form the largest share of fraud.
  - Authorized push payments (APP) volumes increased by 12 percent since 2022, while losses fell by 12 percent in the same period (The Payment Systems Regulator, 2024).
  - Industry studies: 77 percent of APP fraud in the first half of 2023 originated online (UK Finance, 2024).
  - Legislative reforms include the Online Safety Bill, Financial Services and Markets Act, and Economic Crime and Corporate Transparency Bill.
  - The UK introduced a mandatory reimbursement scheme for authorized push payment fraud victims in certain circumstances (Braithwaite, 2024).
- United States:
  - Card and electronic payments are the major types of payment-related fraud that have been gradually growing.
  - Losses from Internet crime reached USD 16.6 billion in 2024 (FBI, 2024).
  - Cyber-enabled fraud represented around 83 percent of all losses reported to the IC3 in 2024, with investments—particularly crypto investments—being the major type of crime; investment scams targeted at elders continued to be the costliest in terms of financial losses (FBI, 2023a; FBI, 2023b; FBI, 2024).
  - Historical studies found credit card was the most common payment method for financial fraud; a shift from in-person fraud towards remote fraud and increased use of microchip-based cards and authenticated card payments were noted (DeLiema et. al., 2017; Board of Governors of the Federal Reserve System, 2018).

### Key statistics and trends (preserve exact figures)
- USD 688 billion: estimated total economic impact across 13 Asian jurisdictions in 2024 (GASA, 2024b).
- Singapore: 28,751 cases; Singapore Dollar 385 million losses (Jan–Jun 2024).
- Singapore survey: 65 percent face scams at least once per month; 68 percent of scam victims chose not to report.
- India: 65,893 cybercrime cases registered; 26.5 percent (17,470 cases) fraud-related (National Crime Records Bureau, 2022).
- Canada: CAD530 million in losses in 2022; cryptocurrency losses CAD8.2 million (2019), CAD22.5 million (2020), nearly CAD126 million (2022).
- EU/EEA: EUR 4.3 billion fraudulent payment transactions in 2022; nearly EUR 2 billion in H1 2023.
- India online payment fraud: INR14½ billion in year ended March 2024 (media reports citing RBI).
- UK APP volumes: increased by 12 percent since 2022; losses fell by 12 percent in same period.
- United States: USD 16.6 billion losses from Internet crime in 2024; IC3 has received over 9 million complaints since 2000, averaging more than 2,000 complaints per day.
- Cyber-enabled fraud represented around 83 percent of all losses reported to the IC3 in 2024.

### Country-specific actions and policy measures identified
- Strengthen legal basis and regulatory framework to protect consumers on data privacy, liability-sharing, and recovery of financial losses.
- Formulate a ‘whole-of-society’ approach including national strategies to fight digital fraud.
- Develop and adopt a fraud taxonomy to capture and categorize fraud scenarios.
- Establish fraud risk management frameworks across organizations.
- Identify and eliminate mule accounts; deploy AI/ML detection models for mule accounts.
- Strengthen measures against payment fraud (e.g., SCA, daily payment limits, payee verification, fraud monitoring).
- Establish anti-scam centers and/or central fraud registries to facilitate victim reporting.
- Enable cross-sectoral co-operation among public authorities and the private sector.
- Consider mandatory reimbursement schemes for authorized push payment fraud victims in certain circumstances.

### Conclusion: implications for monitoring and stability
- Cyber events in the financial sector have grown by tenfold; cyber-enabled fraud has nearly tripled in the past decade.
- Incidents are heterogeneous institutionally and geographically; non-G-SIBs account for the majority of cases, indicating potential gaps in cyber preparedness among smaller and less-resourced institutions.
- Advanced and highly digitalized economies report more incidents, likely reflecting greater exposure, digital integration, and stronger reporting mechanisms.
- Data breaches remain the most common outcome, particularly in securities, insurance, and payments sectors.
- Geopolitical tensions increasingly shape attack motivations, with several incidents exhibiting characteristics of state-linked operations.
- Financial stability implications from digital fraud include financial losses to banks and reputational risks to banks and supervisors (BCBS, 2023).
- Rapid growth of digital payments and cryptoassets, and movement of funds between traditional and crypto parts of the financial system, warrant close monitoring of evolving risks in the threat landscape.

*IMF Working Paper — "The Rise of Cyber Events and Digital Fraud in the Financial Sector", chapter 3: Asia Cyber-Related Fraud*

### References

### References

### Key thematic clusters in the literature cited
- Digital fraud and payment-system vulnerabilities:
  - Basel Committee on Banking Supervision (2023). Digital Fraud and Banking: Supervisory and Financial Stability Implications, Discussion Paper, November.
  - Board of Governors of the Federal Reserve System (2018). Changes in U.S. Payments Fraud from 2012 to 2016: Evidence from the Federal Reserve Payments Study, October.
  - European Banking Authority (EBA) (2024). EBA Opinion on New Types of Payment Fraud and Possible Mitigants, 29 April.
  - EBA and ECB (2024). 2024 Report on Payment Fraud.
  - EBA and ECB (2025). 2025 Report on Payment Fraud.
  - European Payments Council (EPC) (2024). 2024 Payment Threats and Fraud Trends Report, 22 November.
  - The Payment Systems Regulator (2024). Authorized Push Payment (APP) Scams Performance Report, July.
  - UK Finance (2023). 2023 Half Year Fraud Update.
  - Braithwaite, J (2024). Authorized Push Payment Bank Fraud: What Does an Effective Regulatory Response Look Like? Journal of Financial Regulation, Vol. 10, No. 2, pp.174-193.
  - De Ruijter, M (2025). Effectiveness of Fraud Interventions: Combining Systemic and Individual Interventions, Journal of Payments Strategy & Systems, Vol. 19, No. 4, pp. 356-363.
  - Van Praag, E. (2025). The Future of European Payments: Faster, Cheaper, More Digital and More European: With No One Left Behind, Journal of Payments Strategy & Systems, Vol. 18, No. 4, pp. 327-341.

- Cyber incidents, cyber risk, and systemic/financial stability implications:
  - Doerr, S., L. Gambacorta., T. Leach., B. Legros., and D. Whyte (2022). Cyber Risk in Central Banking (BIS Working Paper No. 1039).
  - International Monetary Fund (IMF) (2024). Global Financial Stability Report: The Last Mile—Financial Vulnerabilities and Risks, Chapter 3: Cyber Risk: A Growing Concern for Macrofinancial Stability.
  - Financial Stability Board (2023). Enhancing Third-Party Risk Management and Oversight: A Toolkit for Financial Institutions and Financial Authorities, December.
  - Gaidosch, T., E. Islam., T. Khiaonarong., R. Ravikumar., and C. Wilson (2026). Good Practices in Cyber Risk Regulation and Supervision. Departmental Paper, Monetary and Capital Markets Department, International Monetary Fund.
  - Ravikumar, R (2025). Strengthening Cybersecurity: Lessons from the Cybersecurity Survey, IMF Technical Notes and Manuals, TNM/2025/06.
  - World Bank. (2025). Cyber Risks in Fast Payment Systems.
  - European Union Agency for Cybersecurity (ENISA) (2024). ENISA Threat Landscape: Finance Sector, January 2023 to June 2024.
  - Nordic Financial CERT (2024). Cyber Threat Landscape for the Nordic Financial Sector 2024.

- Illicit finance, crypto-related incidents, and underground markets:
  - Chainalysis (2024). Funds Stolen from Crypto Platforms Fall more than 50% in 2023, but Hacking Remains a Significant Threat as Number of Incidents Rises, January 24.
  - FBI (2023a). Cryptocurrency Fraud Report 2023, Internet Crime Complaint Center.
  - FATF—Interpol—Egmont Group (2023). Illicit Financial Flows from Cyber-Enabled Fraud, FATF, Paris, France.
  - FATF (2025). Cyber-Enabled Fraud—Digitalization and Money Laundering, Terrorist Financing and Proliferation Financing Risks, February.
  - UNODC (2024). Transnational Organized Crime and the Convergence of Cyber-Enabled Fraud, Underground Banking and Technological Innovation in Southeast Asia: A Shifting Threat Landscape, Technical Policy Brief, October.
  - UNODC (2025). Inflection Point: Global Implications of Scam Centers, Underground Banking and Illicit Online Marketplaces in Southeast Asia, Technical Policy Brief, April.
  - Interpol (2024). Interpol Global Financial Fraud Assessment, Interpol General Secretariat, France.
  - Global Anti-Scam Alliance (GASA) (2024a). Global State of Scams Report 2024; GASA (2024b). Asia Scam Report 2024; GASA (2024c). The State of Scams in Singapore 2024.

- Crime statistics, reports on scams, victimization, and measurement:
  - Canadian Anti-Fraud Centre (CAFC) (2023). Annual Report 2022.
  - FBI (2013). Internet Crime Report 2013, Internet Crime Complaint Center.
  - FBI (2018). Internet Crime Report 2018, Internet Crime Complaint Center.
  - FBI (2024). Internet Crime Report 2024, Internet Crime Complaint Center.
  - FBI (2023b). Elder Fraud Report 2023, Internet Crime Complaint Center.
  - Houtti, M., A. Roy., V. N. R. Gangula., and A. M. Walker. (2024). A Survey of Scam Exposure, Victimization, Types, Vectors, and Reporting in 12 Countries, Journal of Online Trust and Safety, July, pp. 1-26.
  - DeLiema, M., G. Mottola., and M. Deevy (2017). Findings from a Pilot Study to Measure Financial Fraud in the United States, Stanford Center on Longevity and FINRA Investor Education Foundation, February.
  - National Crime Agency (2024) National Economic Crime Center Annual Report 2023-2024.
  - National Crime Records Bureau (2022). Crime in India 2022, Statistics Volume II.
  - National Crime Records Bureau (2016). Crime in India 2016, Statistics.

- Operational guidance, toolkits, and sectoral practices:
  - Committee on Payments and Market Infrastructures (CPMI) (2018). Reducing the Risk of Wholesale Payments Fraud Related to Endpoint Security, May.
  - CPMI (2019). Reducing the Risk of Wholesale Payments Fraud Related to Endpoint Security: A Toolkit, October.
  - Financial Stability Board (2023). Enhancing Third-Party Risk Management and Oversight: A Toolkit for Financial Institutions and Financial Authorities, December.
  - International Organization of Securities Commissions (2016). Cyber Security in Securities Markets – An International Perspective (FR02/2016). IOSCO.
  - Hayashi, F., R. J. Sullivan., and S. E. Weiner (2003). A Guide to the ATM and Debit Card Industry, Federal Reserve Bank of Kansas City.
  - Hayashi, F. (2025). Did Card-Present Fraud Rates Decline in the United States After the Migration to Chip Cards? Federal Reserve Bank of Kansas City, Payment Systems Research Briefing, February 12.

- Country and law enforcement briefs, government strategy documents, and press coverage:
  - HM Government (2023). Fraud Strategy: Stopping Scams and Protecting the Public, Presented to Parliament by the Secretary of State for the Home Department by Command of His Majesty, May.
  - Singapore Police Force (2024). Mid-Year Scams and Cybercrime Brief 2024.
  - Singapore Police Force (2025). Annual Scam and Cybercrime Brief 2025.
  - Reserve Bank of India (2024). Report on Trend and Progress of Banking in India 2023—24.
  - Reserve Bank of India (2025). Report on Trend and Progress of Banking in India 2024—25.
  - Wall Street Journal. (2024). IMF Warns of Cyber Risks to Financial Sector, April 18.
  - S&P Global Ratings. (2025). Technology Is Delivering for Banks and Societies. Financial Inclusion in Emerging and Frontier Markets. April 8, 2025.
  - McDougall, M., N. Asgari., and A. Livsey (2025). Pension funds dabble in crypto after massive bitcoin rally. Financial Times, January 16.

### Annex I: North American Industry Classification System (NAICS) — background and financial-sector organization
- NAICS overview:
  - "The NAICS is an industry classification system that groups establishments into industries based on the similarity of their production processes."
  - "There are 20 sectors and 1,012 industries in 2022 NAICS United States."
  - NAICS was developed and revised by Mexico's INEGI, Statistics Canada, and the U.S. ECPC (acting on behalf of OMB) to provide common industry definitions for Canada, Mexico, and the United States.

- Purpose and statistical use:
  - NAICS United States is used by U.S. statistical agencies to facilitate the collection, tabulation, presentation, and analysis of data relating to establishments; and to provide uniformity and comparability in the presentation of statistical data describing the U.S. economy.
  - "NAICS United States is designed for statistical purposes." Government agencies' nonstatistical requirements played no role in its development or revision.

- Organization of subsectors in the Finance and Insurance sector:
  - The Finance and Insurance sector comprises establishments primarily engaged in financial transactions and/or facilitating financial transactions.
  - Three principal types of activities identified:
    - Raising funds by taking deposits and/or issuing securities and using raised funds to acquire financial assets (financial intermediation).
    - Pooling of risk by underwriting insurance and annuities.
    - Providing specialized services facilitating or supporting financial intermediation, insurance, and employee benefit programs.
  - Monetary authorities charged with monetary control are included in this sector.

- NAICS subsector codes and definitions (as presented):
  - 521 Monetary Authorities-Central Bank. Functions: issuing currency, managing the Nation's money supply and international reserves, holding deposits that represent the reserves of other banks and other central banks, and acting as a fiscal agent for the central government.
  - 522 Credit Intermediation and Related Activities. Activities: lending funds raised from depositors; lending funds raised from credit market borrowing; or facilitating lending/issuance of credit through mortgage and loan brokerage, clearinghouse and reserve services, and check cashing services.
  - 523 Securities, Commodity Contracts, and Other Financial Investments and Related Activities. Activities: underwriting securities issues and/or making markets for securities and commodities; acting as brokers; providing securities and commodity exchange services; and providing other services such as portfolio management, investment advice, trust, fiduciary, and custody services. Includes establishments operating commodity or securities exchange clearinghouses (including virtual currency trading exchange clearinghouses—Code 523160).
  - 524 Insurance Carriers and Related Activities. Activities: underwriting annuities and insurance policies or facilitating such underwriting by selling insurance policies and providing other insurance and employee benefit related services.
  - 525 Funds, Trusts, and Other Financial Vehicles. Groups legal entities organized to pool securities or other assets on behalf of shareholders or beneficiaries of employee benefit or other trust funds; portfolios customized for diversification, risk, rate of return, and price volatility; entities earn interest, dividends, and other investment income, but have little or no employment and no revenue from the sale of services.

### Notable document identifiers and placement
- Working Paper identification: The Rise of Cyber Events and Digital Fraud in the Financial Sector — Working Paper No. WP/2026/062

*International Monetary Fund — References and Annex I (NAICS) from the source PDF.*

---


_Source: https://www.imf.org/-/media/files/publications/wp/2026/english/wpiea2026062-source-pdf.pdf_