Through a previously unreported vulnerability, attackers could run any code on an AWS SageMaker Jupyter Notebook Instance across accounts, access the Notebook Instance metadata endpoint, and steal the access token for the attached role.

Lightspin, the multi-layer cloud security platform that prioritizes and remediates critical vulnerabilities across hybrid cloud and Kubernetes environments, announced today the discovery of a cross-account access vulnerability discovered in AWS’s SageMaker Jupyter Notebook Instance. 

Lightspin’s research team found this vulnerability as part of its ongoing research into security in data science tools. The team investigated Amazon’s SageMaker which is a fully managed machine learning (ML) service in AWS. Amazon SageMaker helps data scientists and developers to prepare, build, train, and deploy high-quality machine learning (ML) models quickly by bringing together a broad set of capabilities purpose-built for ML. SageMaker launched in 2017 and is used by some of the world’s leading global enterprises, meaning any discovery of areas of exploitation could have widespread impact.

The research team investigated the potential vulnerabilities that could be attached to Amazon’s SageMaker, and more specifically the Jupyter Notebook Instances. During their research, the team found that potential attackers had been able to run any code on an AWS SageMaker Jupyter Notebook Instance across accounts. This allowed them to access the Notebook Instance metadata endpoint and steal access tokens for the attached role. Using the access token, the attacker could have read data from S3 buckets, created VPC endpoints, and taken more potentially harmful actions that were allowed by the SageMaker execution role and the “AmazonSageMakerFullAccess” policy.

Since the discovery of this vulnerability, the Lightspin team contacted the AWS Security team to alert them of the findings. As of this writing, the vulnerability has since been remediated.

"It is nearly impossible for a company to have complete security control when a single app flaw can leave a door open to cyberattacks," said Gafnit Amiga, Director of Research at Lightspin. "We believe in advanced research of managed services in order to enhance the product's detection capabilities and to improve the resilience of the cloud providers for everyone."

 Business diversification and effective integration of acquired assets enabled the Bank to double its net profit compared with the same period of 2020. 

Key results:

• Net profit in 9M 2021 amounted to a record high of RUB 41 billion with a return on equity (ROE) of 32%.
• Net interest income amounted to RUB 83 billion, up 41% year-on-year, while net interest margin reached 7.5%.
• Net fee and commission income grew by 32% to RUB 24 billion.
• Cost of risk declined to 2.8%.
• The Bank’s assets in the first nine months of 2021 grew by 29% to RUB 1.9 trillion (against RUB 1.6 trillion as at 31.12.2020)
• The retail net loan portfolio increased by 56% over 9M 2021 to RUB 464 billion (against RUB 298 billion as at 31.12.2020), driven mainly by growth in the Halva portfolio, mortgage loans and the addition of Vostochny Bank’s retail portfolio.
• The corporate net loan portfolio grew by 72% from the beginning of the year to RUB 596 billion (against RUB 347 billion as at 31.12.2020), mainly due to increased lending to some of the largest corporations.
• The share of Stage 3 loans in the gross loan portfolio stood at 2.1% with non-performing loan coverage of 178%.
• Client current accounts and term deposits increased by 25% from the beginning of the year to RUB 1,249 billion (against RUB 999 billion as at 31.12.2020), which reflects trust in the Bank on the part of large corporate clients and retail customers alike.
• The Bank’s equity capital grew by 19% in 9M 2021 to RUB 224 billion (against RUB 188 billion as at 31.12.2020), while capital adequacy ratios as at 1 October were as follows: N1.1, 9.6%; N1.2, 10.8%; N1.0, 12.7%, exceeding the regulator’s minimal levels for systemically important credit institutions.

Highlights during the reporting period:

• The number of the Bank’s retail clients increased to 12 million (+43% against 8.3 million as at 31.12.2020)
• In April, Sovcombank purchased Vostochny Bank from its key shareholders and completed the consolidation of 100% of its shares by November 2021. As a result, Vostochny Bank’s loan book (RUB 72 billion after provisions as at 30.09.2021) and its 700,000 card clients were transferred to Sovcombank.
• This year Sovcombank inked several other deals to acquire financial assets: the Bank announced the purchase of the National Factoring Company and Vostochny Capital asset management company (renamed Sovcombank Asset Management)
• In April 2021, Sovcombank Group subsidiary RTS-Tender completed the purchase of a 100% stake in JSC Economic Development Centre, the operator of the B2B-Center electronic platform, a commercial e-procurement marketplace.
• The Bank’s credit rating was upgraded by the Expert RA ratings agency to ruAA (February 2021) and by the ACRA ratings agency to AA- (April 2021). The international agency Fitch Ratings confirmed the Bank’s rating at BB+ with a stable outlook (September 2021), while Standard & Poor’s confirmed Sovcombank’s rating at BB with a positive outlook (October 2021).
• In January the Bank placed social Eurobonds worth USD 300 million in line with ICMA principles. This was the first social Eurobond issue by a Russian issuer in the CIS countries.

Retail business. The Bank continues to demonstrate solid growth in assets and profits across all business lines: its retail net loan portfolio reached RUB 464 billion. The Halva instalment card showed the highest growth rate in retail, up by 128% to RUB 124 billion. This was due to a combination of organic growth, the acquisition of Vostochny Bank’s credit card portfolio and the expansion of the mortgage portfolio by 57% to RUB 124 billion in the first nine months of 2021. Retail profit before tax more than doubled (+126%) year-on-year, reaching RUB 27 billion.

Sergey Khotimskiy, Sovcombank’s First Deputy Chairman of the Management Board, said: “This year, we have managed to demonstrate very solid growth in assets and profits in both retail and our corporate business thanks to our teams’ effective efforts and the very wide range of banking products in our portfolio. We’re also very pleased with the results of our acquisition of Vostochny Bank, as over 90% of the bank’s clients have switched to Sovcombank, and they are now enjoying all of the opportunities and bonuses of having a Halva instalment card.”

Corporate business. Corporate lending was one of the main drivers of growth in the Bank’s assets and profits in 2021. Over the first nine months of the year, the corporate net loan portfolio increased by 72% to RUB 596 billion. Profit before tax in the corporate segment grew by 19% to RUB 12 billion. Corporate clients’ current-account and term deposits increased by 28% to RUB 650 billion. The corporate credit portfolio is of high quality: the share of Stage 3 loans in the gross loan portfolio amounted to 1.3% with non-performing loan coverage of 222%.

Over the first 10 months of 2021 Sovcombank’s corporate investment business was the market leader in organizing bond placements for companies in Russia’s real sector. For the second straight year Sovcombank took first place in “The best Russian bank in the CIS syndication market” category at the Loans Cbonds Awards 2021. Sovcombank remains one of the most active players in the syndicated loan market in Russia and the CIS countries. 

Highlights after the reporting period:

• In November 2021, Sovcombank placed an issue of perpetual subordinated Eurobonds in the amount of USD 300 million with a coupon rate of 7.6% per annum.

PJSC Sovcombank is a universal bank and one of the 10 largest banks in the country (with assets of RUB 1.9 trillion according to IFRS). The Bank employs 22,600 people in 2,629 offices located in 1,050 communities in 78 regions of Russia. The Bank serves 12.1 million customers, including 11.3 million borrowers, 600,000 depositors and 200,000 legal entities. Sovcombank has been assigned the following ratings from international agencies: a BB rating with a positive outlook from Standard & Poor’s, a Ba1 rating with a stable outlook from Moody’s and a BB+ rating with a stable outlook from Fitch Ratings. Its credit ratings from Russian agencies include an AA- rating with a stable outlook from ACRA, a ruАА rating with a stable outlook from Expert RA and an AA- rating with a stable outlook from National Credit Ratings agency.

Leveraging Sustainalytics’ ESG research and ratings, investment analysts and portfolio managers can integrate ESG considerations into their investment decision-making

Verity, a leading provider of research management software, data and analytics, today announced that Sustainalytics’ ESG Research and Ratings reports are now available through the Verity Platform. Sustainalytics is a Morningstar Company and a leading global provider of ESG research, ratings and data. Verity was formed as a result of the strategic merger between MackeyRMS and InsiderScore.

Further enhancing the Verity Platform’s robust ESG capabilities, the addition of Sustainalytics’ ESG Risk Ratings and Controversies Research reports empowers Verity users with a wide range of ESG information including ESG ratings, trends, actionable controversies, analytics, and more.

In 2020, assets under management by funds applying ESG and sustainability topped $1 trillion, demonstrating just how embedded ESG strategies have become within the investment process. The need for trusted, reliable, and timely research and ratings around ESG has never been higher. Last year, Verity introduced ESG Scorecards, enabling users to streamline investment selection, monitoring and reporting for ESG-focused portfolios.

“As the demand for timely and reliable ESG data continues to rise, we are proud to provide our customers with Sustainalytics industry-leading ESG research, ratings and data,” said Andrew Robson, CEO at Verity. “The addition of Sustainalytics’ insights combined with our ESG Scorecards enables our customers to more effectively incorporate ESG considerations into their portfolios. The flexibility of our workflow engine and dashboard toolkits, combined with Sustainalytics research and data sets, provide customers with best-in-class reporting, workflow and analytic capabilities and further delivers on our product vision to create the industry’s only one-stop, fully inclusive, end-to-end research platform.”

“We are excited to work with the team at Verity as they rollout our ESG research, ratings, and data to their community of users,” said Tim Langer, Director of Client Relations at Sustainalytics. “Both Verity and Sustainalytics are committed to expanding investor access to valuable ESG information, and we look forward to the success of our relationship.”

Sustainalytics’ ESG Risk Ratings help investors to identify and understand financially material ESG risks in their portfolio companies and how that risk might affect performance. The ratings measure a company’s exposure to industry-specific material ESG risks and how well a company is managing those risks. This multi-dimensional way of measuring ESG risk combines the concepts of management and exposure to arrive at an absolute assessment of ESG risk that is comparable for companies in different industries. The firm’s Controversies Research helps investors to identify companies involved in ESG-related incidents. These incidents are evaluated through a framework that considers the severity of incidents, a company’s accountability and whether it is part of a pattern of misconduct.

“We are thrilled to partner with Sustainalytics to provide our customers best-in-class ESG workflows and data integrations,” said Will Keuper, VP Product at Verity.  “Our clients demand actionable and flexible reporting to satisfy evolving investor and regulatory requirements, and the addition of Sustainalytics data sets will further enhance our market-leading portfolio monitoring, reporting and idea generation capabilities.”

UA Multimedia, Inc. (OTC Pink: UAMM), a holding company and solution provider in the area of blockchain, cryptocurrency, fintech, decentralized finance (DeFi), NFT and metaverse, announces the upcoming launch of its Decentralized Exchange (DEX).

A DEX is a decentralized permissionless cryptocurrency exchange that allows users to trade various tokens directly without going through a middleman like those from centralized exchanges (CEX).

Centralized exchanges such as Coinbase, Binance or Kraken are owned by a central entity. They require users to provide personal information to open an account. Their funds are held by the company. Trades are done by listing the customers’ orders in the orderbook. The exchange then proceed to match buyers with sellers.

Unlike CEX, DEX similar to Uniswap uses smart contracts deployed on a blockchain. The exchange run on a network of independent computers which execute the rules automatically. There is no central entity controlling the user accounts, therefore, it is not necessary to open an account. Trades are done directly from the users’ own digital wallets thus allowing them to keep full control over their funds.

The DEX will list over 100 cryptocurrencies initially. It will work with a wide range of wallets and interface to major exchanges such as Binance, Huobi, OKEx to provide liquidity.

The development of the decentralized exchange is in its final phase which will be followed by testing. The Company expects to launch a beta version around the middle of this month.

The Company is also working on the launch of a DEX native coin.  It will be launched and listed on at least one exchange this month with more to follow in Q1 2022.

Additional details of the exchange, development of the NFT marketplace and other crypto related initiatives will be forthcoming.

“Cryptocurrency is a multi-trillion dollars market with DeFi activities surging steadily on a regular basis,” said Michael Lajtay, interim CEO of UA Multimedia. “We are excited to expand our presence in this space by introducing a decentralized exchange that will offer simple and seamless trading experience for cryptocurrency traders worldwide.”

• Experian reveals how UK business credit scores have fared from the start of the pandemic to September 2021
• South-West ranks highest, while the retail sector shows resilience

New research from Experian, which analyses 2.2 million UK businesses, has revealed that, on average, businesses’ credit scores are recovering well from the impact of COVID-19.

Using Experian’s Commercial Delphi Score calculator, business credit score levels were back up to the pre-pandemic average of 44 by September 2021, compared to a score of 40 throughout most of lockdown.

A business credit score is the measure of a business's creditworthiness, which is made up from a number of factors to understand the financial position of a business and its level of financial risk. The score ranges from 0 to 100, with 0 representing a high risk and 100 representing a low risk. It’s one indicator lenders use to assess businesses seeking growth funding.

Looking at how business credit scores have changed by industry during the period in question, the retail sector, for one, has shown resilience, pivoting to digital platforms, and continuing to serve consumers despite restrictions and challenges presented by not only the pandemic, but also issues with global supply chains and labour shortages.

While credit scores in this sector are still, on average, below pre-pandemic levels, the average jumped sharply in September 2021 and now stands at 31 – a 19.2% increase compared to the same period in 2020.  

Conversely, the travel sector, which has been hit hardest by lockdown restrictions, has fared worse. Average scores hit a new low of 30.5 in September 2021 – a drop of 30.7% compared to March 2020.

When we look at average scores by region, the South West has led the way, buoyed by an influx of tourism through the summer months, averaging at 49.8 between March 2020 and September 2021.

East Midlands also performed well – averaging 45.6 over the same time period. By August 2021, organisations in the North East of England had collectively reached a business credit score of 44, matching its pre-pandemic levels, and since then improved its score to 45 in September 2021.

London businesses were least impacted by the Covid-19 pandemic, despite having the lowest average scores across the UK. Average scores remained consistent at 26 throughout the first lockdown in 2020, only dropping a single point to 25 in December. The capital remained at this level throughout the 2021 winter lockdown but has since recovered to its pre-pandemic level.

London is generally considered a start-up hotspot, so it’s likely that the average age of many of these businesses is lower than other parts of the country. More established companies tend to have a more detailed credit history, translating into a more positive credit score. Meanwhile, younger businesses usually score lower.

James McGarva, Managing Director of Business Information Services at Experian, said: “The UK business sector can be proud of what it has achieved over the last 18 months. Despite ongoing pressures presented not only by the impact of COVID-19, but also other well-documented macroeconomic pressures such as labour shortages and global supply chain issues, the ability of businesses to adapt has been impressive.

“By looking at business credit scores on a national scale, we can see how many businesses’ financial circumstances are improving, presenting a lower risk for lenders and therefore enhancing their prospects of getting access to the finance they need to thrive. We would encourage all businesses to keep a check on their credit histories and take steps to improve their scores where possible.”

• Being SOC2-compliant, LogFlow keeps data security and integrity front and center
• LogFlow’s InstaStore and built-in insurance solves data risks associated with machine data pipelines

LOGIQ.AI, a leading provider of data management, analytics, and observability solutions for IT, DevOps, and SecOps teams, has today launched LogFlow, an Observability Data Pipeline as a Service (DPaaS). LogFlow is an innovative paradigm in machine data management that enables enterprises to unleash the true potential of machine data by connecting it to SMEs on-demand.

Global data creation and replication is growing at a CAGR of 23% (IDC), and 70% of organizations will shift focus to provide more context for data analytics (Gartner). New tooling is needed to optimize data volume and improve data quality. LogFlow solves these data challenges at both the core and the edge.

Greg O'Reilly, Observability Consultant at Visibility Platforms, said, "LogFlow enables our customers to take a whole new approach to observability data; one that helps regain control and unblock vendor or cost limitation. We're opening up discussions between ITOps and Security teams for the first time with a unified solution that keeps data secure, compliant, manageable, and readily available to those who need it on the front lines."

The Block and Drop problem

Contemporary data pipelines suffer from ingest-egress mismatches. "Enterprises have unfortunately been sold "block" and "drop" as intelligent features to counter back pressure and upstream unavailability in data pipelines", said Ranjan Parthasarathy, Co-founder, CEO of LOGIQ.AI. "Block and drop is data loss in disguise. Imagine losing a vital signature in your log stream that points to impending ransomware starting to spread. Don't introduce new business risks by buying into block and drop."

InstaStore

LogFlow eliminates block and drop by storing 100% of streaming data in InstaStore, a storage innovation that enables object storage as primary storage. In InstaStore, data is fully indexed and searchable in real-time. LogFlow also stores its indexes in InstaStore, giving a genuinely scalable platform with cleanly decoupled storage and compute. LogFlow ingests data even when upstream targets are down. Due to its indexing capabilities, it provides fine-grained data replays.

"InstaStore introduces a new paradigm for data agility that eliminates data loss and the need for storage tiering and data rehydration. Organizations can now unlock productivity, cost reduction, and compliance like never before.", said Jay Swamidass, Head of Sales - APAC and EMEA at LOGIQ.AI.

Accelerating machine intelligence

LogFlow's native support for open standards makes it easy to collect machine data from any source. Similar to network flows, LogFlow manages data with its flow-level routing table.

"LogFlow filters unwanted data and detects security events in-flight. Users can route streams, control EPS and run fine grained data replays.", said Tito George, Co-founder of LOGIQ.AI. "InstaStore's indexing and columnar data layouts enable faster querying, unlike archive formats like gzip."

Data routing isn't the real problem

Open-source tools like Fluent Bit and Logstash can already route data between various sources and target systems and allow routing raw archives to object stores. The complex problems to solve are:

• Controlling data volume and sprawl.
• Preventing data loss.
• Ensuring data reusability with fine-grained control.
• Business continuity during upstream failures.

Theodore Caroll, Head of Sales – Americas at LOGIQ.AI said, "There's no technical reason to accept anything less than 100% data availability. Your data is your only true fortress in responding to threats and adverse business events. Businesses need a system like LogFlow that ensures full data replay is continuously and infinitely available."

LogFlow's log management and SIEM capabilities provide built-in insurance against upstream failures. Businesses can run it in parallel with their existing systems. If upstream systems become unavailable, LogFlow can continue to provide crucial forensics.

Built for the enterprise

LogFlow's built-in "Rule Packs" have over 2000 rules that filter, tag, extract, and rewrite data for popular customer environments and workloads. LogFlow's SIEM Rule Packs also allow security event detection and tagging.

LOGIQ.AI's LogFlow brings complete control over observability data pipelines and delivers high-value, high-quality data to teams that need it in real-time, all the time. For the first time, organizations can fully control data collection, consolidation, retention, manipulation, and upstream data flow management.

A quarter of CEOs (25%) think being realistic is the most important characteristic of a successful business leader, according to ECI Partners’ new Growth Characteristics report, released today.

The research found that being realistic is even more essential for leaders of larger companies, with 35% of CEOs in businesses with 500 or more employees citing it as the most essential trait when it comes to being a successful business leader.

Realism was closely followed by being logical (24%) and loyal (19%) as the most important traits of a successful CEO.

ECI, the growth-focused private equity firm, surveyed over 500 fast-growth SME business leaders as part of its Growth Characteristics report in order to define what makes a successful CEO as well as to understand current challenges and growth opportunities.

Interestingly, less than one in ten (8%) stated that being enthusiastic or inspirational was a key characteristic for being a business leader, and only 15% of business leaders cited the importance of being vision-led.

Leaders may recognise that, more than just being figureheads, their focus needs to be on delivering demonstrable results, a viewpoint which may have been exacerbated by the pandemic, with businesses needing to be realistic about what could be achieved in trying circumstances.

Tom Wrenn, Managing Partner at ECI Partners said:

“Businesses have contended with a wide range of new challenges in the last two years and strong leadership has been crucial to help businesses both survive and thrive. The personalities, behaviours and attributes of business leaders will have played a major part in how businesses and teams have responded to these challenges and how they’re positioning themselves for the future.”

Joanna Swash, Group CEO at the ECI-backed leading outsourced communications company, Moneypenny added:

“I’m not surprised that the three most important characteristics are to be ‘realistic, logical and loyal’ and for me, I’d summarise these under the ‘authentic leader’ banner, which I am passionate about.

“In a fast-paced, high growth business environment, your people need to really believe in you, knowing that your decisions and actions have extremely firm foundations and that you always speak the truth and are not afraid to share both the good and bad news. If this authenticity runs throughout the company culture, then your people will in turn emulate this behaviour, helping them to be the best they can be.”

Homomorphic encryption techniques will be used to ensure robust privacy and security for qTerm’s user’s sensitive data and records

GBT Technologies Inc. (OTC PINK: GTCH) ("GBT”, or the “Company”) is enhancing its qTerm device cybersecurity technology in order to ensure robust privacy and sensitive data protection for its potential users. Due to the rise of sensitive data breach cases in the past few years, GBT decided to add another layer of data protection, developing breakthrough techniques to prevent potential data theft. The enhancements will be performed within the device’s AI computer programs to increase data security for its machine learning and computing environments. GBT's qTerm, a human vitals intelligence device is targeted to measure human vitals with a touch of a finger, and includes AI technology for personal health monitoring. The device is accompanied by a smartphone app and a synchronized widget web application to keep a history and provide health related analytics.

GBT will be implementing Homomorphic Encryption (HE) techniques within its AI environment to enable encrypted data processing without decrypting it first. The qTerm algorithms send data back and forth over encrypted channels. The AI needs to perform computations and analysis and typically the system decrypts the information first, working on it, and re-encrypting it again before sharing it. This creates a potential security risk. HE technology enables robust data protection since the processing is always done with the encrypted data. HE techniques were known to have one major disadvantage, which is a very long processing time compared to decrypted data processing runtime. GBT developed new algorithms that operate with much higher performance enabling fast computations using HE methods. The company plans to implement HE technology within qTerm’s Machine Learning components, mobile and web interface computing environments.

“Our AI engine includes multiple modules that shares digital assets over internal channels. The machine learning sub-systems may communicate sensitive information, for example, sharing users medical/personal information between the data storage module and the data training module. In order to secure data, there are two major operations that are done, encryption and decryption. The encryption typically happens where the sensitive data is first captured, for example after qTerm device recording a user’s vitals. The data is then sent to the AI system for processing on the main data center. At the data center the data needs to be decrypted to work on, and then re-encrypted after completion. The decrypting phase introduces potential data breach risk. Using the HF technique eliminates the need for decryption, and all operations can be performed on the encrypted data which eliminates the major security risk. We plan to develop several types of algorithms in this domain that will use cryptography and mathematical methods to operate directly on encrypted data. In this way we’ll significantly enhance the data’s privacy and security. One of qTerm’s main purposes is to perform as a telemedicine device which communicates with its AI data center. User’s vital information will be sent via a web widget and HE based technology will ensure a high level of data security. AI systems require robust security mechanisms by their nature and by using HE we are preserving data privacy starting at the source. Particularly, with a telemedicine type device, like qTerm, the data will be encrypted and outsourced to its data center environment for processing, all while encrypted. In the past few years there is a constant growing concern about data privacy and security, and implementing new techniques and methods in this domain will ensure highly secured AI operation and computation. We believe that this is especially important for the qTerm’s device as it collects, processes and records sensitive personal and medical information,” said Danny Rittman the Company’s CTO.

There is no guarantee that the Company will be successful in researching, developing or implementing this system. In order to successfully implement this concept, the Company will need to raise adequate capital to support its research and, if successfully researched and fully developed, the Company would need to enter into a strategic relationship with a third party that has experience in manufacturing, selling and distributing this product. There is no guarantee that the Company will be successful in any or all of these critical steps.

Ahead of Small Business Saturday (4th December) data from Tyl by NatWest, an SME payments provider, has shown SME’s transaction values increased by £7.85 on average since the new £100 contactless limit came into effect on October 15th.

Analysing data by key seasonal sectors, those in the floristry industry benefited from an average transaction value rise of £19 from £31 to £50. The clothing retail industry saw an average value rise of £6 from £80 to £86 per transaction.

The findings, based on data looking at the first month of payments across Tyl’s SME customers since the limit increase, indicate it has been helpful in encouraging greater consumer spending with small businesses via digital payments.

Ahead of the crucial festive retail season, the rise is seen as a welcome boost to business, particularly to small independent traders looking to make up for lost earnings over the course of the year and concerned about the ongoing impact of Covid-19.

Commenting on the findings, Mike Elliff, CEO, Tyl by NatWest said: "With businesses expressing fresh concerns over Covid-19 ahead of the crucial festive period, we must remain committed to supporting SMEs as a central focus of our economic resilience against the pandemic.

“Measures such as the new £100 contactless limit have been heavily welcomed by our customers and we know that Tyl, along with the wider payment industry, has a clear role to play in helping the country’s small business sector to recover and rebuild for the future. With in-person footfall levels yet to return to their pre-Covid high, adopting digital payments is increasingly looking like a vital tool as SMEs navigate the festive trading season.”

“The run up to Christmas is traditionally filled with parties, meals out and last-minute shopping trips. Although this year’s festive season might look slightly different, we’re calling on everybody to show their support by shopping with their local independent stores."

While the true impact of the new limit will take time to emerge, the ongoing effects of the pandemic are continuing to shift consumer payment preferences towards digital methods. Following the new £100 limit, Tyl by NatWest is encouraging business customers to stay vigilant with their fraud prevention systems to protect consumers from greater potential exposure to criminal activity. Paying particular attention to unusually large orders, multiple cards in use by one customer, multiple declined purchases from the same customer, suspicious telephone calls and irregularities in key information such as email addresses with obvious differences to the customer’s name are all important measures advised.

Tyl by NatWest is an innovative payments service designed in partnership with UK SMEs to make it easier for small business customers across the country to receive payments in-store, online and over the phone. Tyl offers next-day settlement for users, helping businesses to manage cash flow during Covid-19 and beyond.

Tyl analysed transactions processed by business customers in the month prior to the new limit being introduced, compared with transactions in the month after the new limit. Average transaction value was calculated by taking the total value of transactions and dividing that by the number of transactions.

New algorithms make it impossible to submit spoof ID documents

Ondato, the leading Compliance-as-a-Service platform, has launched a new AI-enabled ID forensics system that makes it impossible to submit spoof documents, such as altered photos, ID papers, and deep fake videos, as part of any customer on-boarding process.

The current scale of hacking and ID theft means that fraudsters have a better chance of finding a photo that matches their target scam. While these spoof documents may pass an “eye test”, Ondato’s AI algorithms notice any discrepancies in the data and flag them as attempted fraud. By October 2021, nearly 281.5 million people had been affected by some sort of data breach. And in November, a hacker leaked a database for Argentina's entire population - over 45 million individuals - divulging information that could be adapted to spoof less-advanced detection measures. The hacked data is now being sold in private circles.

Ondato’s new spoofing detection product protects legitimate customers by preventing  stolen documents being used without their knowledge in identity theft hacks. Such risks are on the rise. The system automatically and instantly detects attempts to submit altered documents in an attempt to bypass identification measures and open a customer account fraudulently. It provides banks, other financial institutions and any entity obliged to perform KYC processes with the highest available level of protection and the assurance they are on-boarding legitimate customers in full compliance with KYC and AML regulations. 

Liudas Kanapienis, CEO and co-founder of Ondato, says: “ID theft and fraudulent account openings are a major and growing problem for individuals and for financial institutions too. If banks can’t trust customers’ ID documents, then they can’t be confident they are complying with local and international regulations. Ondato solves this challenge with new algorithms and machine learning that provide the most effective level of ID document checks currently available.”

Ondato is using algorithms and machine learning to detect document alterations. The solution detects various combinations of spoof attempts involving replays, reprints, image alterations and physical spoofing.

Ondato’s system checks if a video feed that claims to be the likeness of a new customer is in fact fake images being broadcast from a screen. This replay fraud is detectable in various ways, for example, if the screen has edges or there are flickering patterns. It protects you against live stream forgeries.

Attempts to alter documents are detected from irregularities between font sizes, the distance between letters, and artifacts - inconsistencies within an image's compression as a result of attempted fraud. Image alterations are revealed by pixel distortion analysis that looks for pixels in the wrong places due to photo alteration, and alterations to uploaded files’ metadata.

Ondato also checks for physical spoofing, where alterations are made to part of a document, for example, if another image or part of an image has been glued on or physically printed on a piece of paper. Techniques here include  analysing the image depth, the registry data and  unexpected shadows.