As immersive experiences in the metaverse become more sophisticated, so does the threat landscape.
A 
Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Category Archives: Cyber Security, Quantum, Hacks, Fraud Alerts, Risks, InsurTech
Hackers Access Personal Details of Tens of Thousands of Revolut Customers
TechCrunch | Carly Page | Sep 20, 2022
Fintech startup Revolut has confirmed it was hit by a highly targeted cyberattack that allowed hackers to access the personal details of tens of thousands of customers.
- Response: Revolut spokesperson Michael Bodansky told TechCrunch:
- an “unauthorized third party obtained access to the details of a small percentage (0.16%) of our customers for a short period of time.” Revolut discovered the malicious access late on September 11 and isolated the attack by the following morning. We immediately identified and isolated the attack to effectively limit its impact and have contacted those customers affected. Customers who have not received an email have not been impacted."
See: Revolut executive resigns amid growing tensions with the FCA over banking license
- In a message sent to affected customers posted to Reddit, the company said that “no card details, PINs or passwords were accessed.” However, the breach disclosure states that hackers likely accessed partial card payment data, along with customers’ names, addresses, email addresses and phone numbers.
- How many customers: first spotted by Bleeping Computer, the company says 50,150 customers were impacted by the breach, including 20,687 customers in the European Economic Area and 379 Lithuanian citizens.
- How did it happen: The disclosure states that the threat actor used social engineering methods to gain access to the Revolut database, which typically involves persuading an employee to hand over sensitive information such as their password. This has become a popular tactic in recent attacks against a number of well-known companies, including Twilio, Mailchimp and Okta.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Digital Identity Protection is Critical for Metaverse Innovation
MIT Tech Review | Sep 12, 2022
As immersive experiences in the metaverse become more sophisticated, so does the threat landscape.
Current state: If today’s metaverse were a shopping mall, you could visit any number of department stores, each with its own rich selection of products and experiences.
- You could pop into virtual platforms like Roblox to buy a new outfit for your avatar or stop by Decentraland to gauge the latest valuation of digital real estate.
- You couldn’t, however, take your Roblox avatar into Decentraland or to a VR movie on another brand’s platform. The hallways, elevators, kiosks, and reference maps—the infrastructure that makes it possible to carry your shopping bags from store to store—are still being built.
See: Liquid Avatar Releases Update to It’s Feature Rich Self-Sovereign Identity Mobile App
- Another unfinished element of the metaverse is its security: the guards, the CCTV cameras, the shoplifting alarms. Common cybersecurity protocols—the technologies equivalent to the “https” of today’s internet—are still a work in progress in the metaverse. So too are the governance standards that will protect your privacy, property—and perhaps most importantly—identity.
Threats and opportunities: Even in today’s 2D version of the internet, digital identity is a complicated affair.
- Phishing has become so sophisticated that an email from your bank, a call from your auto insurer, or even a text message from your mother may not be what it seems. The immersive nature of the metaverse, however, may set the stage for even more elaborate forms of identity theft or mimicry.
- Identity protection will be a critical part of successful business operations in the metaverse—and it’s an especially important consideration for those getting in on the ground floor.
- David Truog, vice president and principal analyst at Forrester, points out that the metaverse will be the next iteration of the internet—and like the early web, it will go through some growing pains.
- In the metaverse, the role of cybersecurity in establishing similar interactions will be “an order of magnitude or two” more important, says Truog. As such, first movers in the space are in a unique position to anticipate security gaps and build in safeguards from the get-go.
See:
7 Essential Ingredients of an (Open) Metaverse Framework
Metaverse Continuum: Digital experiences and interconnected future
Jeff Schilling, global chief information security officer, Teleperformance:
The threat of social engineering will potentially be even more effective in a 3D world, where deepfakes will be prevalent and an imposter is even more capable of tricking victims. No matter the medium— telephone or metaverse—the best way to resist social engineering is by having a foolproof way to validate who is on the other end of the conversation.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
The ‘Merge’ Is here | 3 ways scammers will try to fool you
CNBC Crypto World | MacKenzie Sigalos | Sep 14, 2022
Image: Unsplash/Zoltan Tasi
The 'Merge' Is Here and it May Just Stoke some Institutional Interest (or not)
- The reduced supply of the cryptocurrency, which some investors say could be a boon to the price, is the result of a new verification model that replaces miners with “validators.”
- The real investor draw is the slashing of energy usage, especially as bitcoin mining continues to face blowback for its growing power consumption. According to one estimate on the Ethereum Foundation’s blog, the merge will result in a reduction of at least 99.95% in total energy use.
- Bank of America said in a note on Sept. 9, that the significant reduction in energy consumption post-merge “may enable some institutional investors to purchase the token that were previously prohibited from purchasing tokens that run on blockchains leveraging proof of work (PoW) consensus mechanisms.”
See: (Expected) Life After the Merge
- Institutional money is key to the maturation of digital assets. Research firm Fundstrat wrote in a note that a successful merge would cement ethereum as the “premier blockchain network.”
- With the upgrade, ethereum won’t become faster, cheaper or more scalable. One developer even told CNBC that:
If the user experience feels the same, that will be one sign that the merge was a total success.
Continue to the full article --> here
Cointelegraph | Felix Ng | | Sep 13, 2022
Besides fake ETH 2.0 tokens and malicious token airdrops, crypto users should also be on the lookout for staking pools offering attractive staking yields.
Fraudulent staking pools
- Many Ether (ETH) holders, joining a staking pool will be their only way of reaping yield from staking rewards if they don’t have the 32 ETH required to become an independent validator.
- Pooled staking providers “carry their own risk” as it often requires users to deposit and give up control of their ETH. Upstart staking providers, which “may offer very attractive terms” could perform “sudden rug pulls” that would affect those participating in the pool.
See: Caution: Binance Chain Red Alarm System Flags 50 New Projects as Potential Scams
Upgrade scam
- One of the more imminent threats involves scammers attempting to trick users into signing fraudulent transactions or parting with their private keys under the guise of migrating to the new Ethereum chain.
- “We’ll likely see scammers try to get users to sign fraudulent transactions and/or leak private keys based on some false pretense that the user needs to do something to migrate chains.”
Fake airdrops
- Another likely attack vector will come in the form of “fake airdrops,” added Bassi — convincing users to sign transaction messages or visit phishing sites in order to receive a bogus airdrop.
- “Those airdrops will likely redirect users to a phishing site where they may be fleeced out of their ETH, private keys, and/or crafted transaction signing attempts.”
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
World Bank Report: Critiques FATFs Work on National Risk Assessments
The Compliance Lady | Sep 9, 2022
𝗪𝗢𝗥𝗟𝗗 𝗕𝗔𝗡𝗞 𝘃. 𝗙𝗔𝗧𝗙: It is always interesting to come across a study that critiques FATF’s work. In a recent report the World Bank takes a closer look at National Risk Assessments (NRAs). For those not familiar with NRAs, the Financial Action Task Force (FATF) requires nations to demonstrate an understanding of the money laundering risks they face in the country by conducting National Risk Assessments.
See: Opinion: Rising cost of compliance may lead to consolidation
- World Bank researchers examined eight of the most advanced nations’ (Canada, Italy, Japan, the Netherlands, Singapore, Switzerland, the UK, and the US) NRAs in order to test their knowledge of those fundamental concepts and to draw lessons from them for national governments.
- A deeply flawed methodology is what they found. The eight NRAs show very different conceptualizations, analytic approaches, and products. Each raises serious issues regarding the risk assessment methodology.
- For example, most relied largely on expert opinion, which they solicited in ways that are inconsistent with the well-developed methodology for making use of expert opinion.
- They misinterpreted data from suspicious activity reports and failed to provide risk assessments relevant for policy makers.
- The report concludes with a set of recommendations for policymakers and NRAs regarding improving risk assessments.
Continue to the full article --> here
Download the 45 page PDF report --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Coinberry Sues 50 Users who Exploited Software Glitch to Acquire $3 million Without Paying
FP | Ethan Lou | Sep 8, 2022
Image: Unsplash/Tech Daily
WonderFi’s Coinberry exchange lost 120 bitcoins and has yet to recover more than two-thirds of it
- The Toronto cryptocurrency marketplace Coinberry, owned by Kevin O’Leary-backed WonderFi Technologies Inc., says it has lost some $3 million in bitcoin due to a software glitch and has yet to claw back two-thirds of it from hundreds of customers.
- Glitch: Coinberry in 2020 underwent a software upgrade and accidentally let people buy bitcoin with Canadian dollars that had yet to be properly transferred to their accounts. Customers could initiate an Interac e-transfer, get the amount credited to their Coinberry accounts, buy bitcoin and transfer the coins out, and then cancel the original e-transfer, retaining their own funds and getting free bitcoin, Coinberry’s lawsuit read.
See: Kevin O’Leary-backed WonderFi acquires Coinberry for $38.5 million
- Coinberry’s lawsuit, filed in June, targets 50 customers of 500 who took advantage of vulnerability and also names the world’s biggest crypto exchange, Binance, because some people had allegedly transferred their ill-gotten bitcoin to that platform.
- Coinberry said its list of bitcoin misappropriation does not include people who have taken and not yet returned amounts under $5,000, valued in May 2020.
- “Coinberry was able to secure the return of approximately 37 of the misappropriated bitcoins from 270 of the affected registered users.” That leaves 83 bitcoins outstanding from about 270 other users.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
Top Professional and Financial Risks for Fintech Companies
Marsh | Aug 19, 2022
Fintech companies are subject to some of the same consumer and investor protection regulations as traditional financial institutions, but must balance compliance requirements with the need to innovate, grow, and develop new products. Meanwhile, privacy risks and ever-growing cyber challenges can contribute to significant economic loss and reputational damage, straining fintech’s day-to-day operations and threatening the assets of both companies and executives.
As the risks for fintech companies continue to evolve, those that are unable to adapt may face obstacles in their business models. Marsh can help you identify your most pressing challenges and determine the most effective strategy to mitigate and manage your risks.
External Risks
- Investors
- Customers
- Regulators
- Competitors
- Extortionists
Internal Risks
- Employee theft
- Computer crime
- Data breaches
- Technology error & ommissions
Links you may be interested in:
Cato Analysis: SECs Proposed Climate‐risk Disclosure
SWIFT publishes “Follow the Money” report to aid comprehension of money laundering risks underpinning large-scale cyber-heists
New
- IT security, privacy, and cyber risk
- Regulatory and compliance risk
- Consumer class-action & professional services risk
- Intellectual property risk
- M&A risk
- Risk of theft and fraud through electronic and non-electronic means
- Employment practices liability including allegations of third party discrimination against customers or clients
Unique risk profiles require tailored risk management programs
More than other industries, individual fintechs differ extensively depending on their subsector, and require innovative solutions to address their unique risk profiles. For example, a payments platform and a neobank touch different types of customers, hold different amounts of personally identifiable information, and are subject to different regulatory oversight; these distinctions drive varying risk transfer decisions. Thoroughly understanding the individual circumstances of each fintech company is crucial to the development of a suitable risk management and insurance program.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
5 Billion Profiles: Class Action Lawsuit Accuses Oracle of Privacy Breach and “Global Surveillance”
A class action lawsuit is accusing Oracle of conducting global surveillance, essentially attempting to create detailed shopping and spending profiles of the world’s entire population.
The suit accuses Oracle of creating profiles for five billion people worldwide, attaching things like purchase records and GPS locations to their name and contact information. While social media platforms usually dominate the conversation about global surveillance, the Oracle Data Marketplace and the company’s BlueKai service have quietly become one of the world’s largest sources of the sort of personal information that “data brokers” sell for targeted advertising purposes.
See: Modernizing Privacy Law in Canada – Striking the Right Balance
Class action lawsuit
- The class action lawsuit points to Oracle marketing materials claiming to provide dossiers on five billion individuals, generating some $42.4 billion in annual revenue for the company.
- The suit alleges that these profiles tie names, home addresses, emails to a worrying amount of information: purchases online and in the real world, physical movements in the real world, income, interests and political views, and detailed accounts of online activity.
- One illustrative detail provided is the profile of a man in Germany who had a €10 bet on an esports betting site logged in his profile.
- The class action lawsuit has been filed in California and alleges violations of Federal Electronic Communications Privacy Act, the Constitution of the State of California, the California Invasion of Privacy Act, competition law, and common law.
- The suit seeks to force Oracle to stop collecting this data and to make restitution to those who have had profiles created, due to being created without the subject’s knowledge or consent.
See: Insurance Industry Sitting on Treasure Trove of Big Data, As Regulators Wrestle Data Privacy
- People are not even aware of what Oracle (and similar brokers) are doing, they have no material relationship with these companies and cannot possibly be giving consent to have these marketing profiles developed.
- The damage Oracle has done is beyond invasion of personal privacy. It cites “Project Alamo,” a 220-million person database created using Oracle services, as an example of micro-targeted voter suppression that may have impacted the outcome of the 2016 presidential election.
- It also raises fears about the potential use of these marketing databases by law enforcement organizations in the wake of the Roe v. Wade repeal, as a means to surveil the visitors of services such as Planned Parenthood.
Continue to the full article --> here
View the 69 page PDF complaint --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|---|---|---|
| | |
