Prepare for cyber banking disruptions, but don’t panic
A Bermuda cybersecurity executive is advising locals to prepare for a cyberattack or technical failure in much the same way they do for hurricanes or other natural disasters.
“Cyber preparedness really isn’t that different,” said Michael Perkins, founder of Bermuda-based Northrock Cyber-Risk & Compliance.
He said having a small working account at a second bank is a sensible precaution, although it won’t necessarily help if the disruption affects shared payment networks or telecommunications infrastructure.
Mr Perkins said the key risk for households is not being able to use your money, rather than losing it.
“Your money might be perfectly safe in the bank, but that does not help much if you can’t buy groceries, purchase fuel or withdraw cash,” he said.
His advice followed that of Nikhil Rathi, chief executive of the UK regulator, the Financial Conduct Authority, who told The Sunday Times last month that people should think about how they would access their money if their main bank’s services went down.
Mr Rathi spoke several days after a power failure at a Google Cloud facility near London disrupted Revolut services, along with services at major UK banks such as Lloyds, HSBC and Halifax, among others.
He told the British newspaper: “We are not going to be able to avoid some of these incidents happening.”
According to Reuters, on October 15, Bank of England deputy Governor Sarah Breeden warned that banks needed stronger recovery plans to withstand cyberattacks, including those enabled by artificial intelligence.
“It’s not enough now to assume that the cyber attackers won’t get through,” she said.
Mr Perkins said the UK advice was relevant locally, where customers have fewer banks to choose from.
However, he cautioned against making major financial decisions out of fear of a cyberattack, including moving significant wealth into gold.
“We are talking about preparing for a temporary disruption, not the collapse of the financial system,” he said.
He recommended keeping a modest amount of cash securely, having another payment option where practical and maintaining several days’ supplies of food, water, medication and other essentials.
Preparedness does not mean expecting a crisis, Mr Perkins said.
“Don’t panic, but don’t make your ability to care for your family entirely dependent on one electronic system working perfectly,” he said.
However, Neville Grant, chief executive of the Bermuda Bankers Association, said being locked out of a single account is not a major concern in Bermuda.
“Bermuda has historically been double-banked by most customers,” he said, noting that businesses often use multiple banks because local interbank clearing is not instant.
“For the speed of processing and for the convenience of customers, most commercial customers have accounts at multiple local banks,” he said.
He said the Bermuda Monetary Authority’s Operational Resilience and Outsourcing Code requires banks to plan for disruptions, take steps to prevent them and maintain important services.
The code has been published but will not go into force until next January.
“Banks used alternative processes to keep payments moving during the Government cyberattack,” he pointed out.
