Abstract

This paper examines the current landscape of cybercrime within the financial sector of Kazakhstan, focusing on the period of 2023–2025. As non-cash transactions exceed 85% of the total market, the evolution of fraud mechanisms — specifically phishing and social engineering — presents a critical challenge. The study analyzes statistical trends, evaluates user behavior patterns, and proposes a proactive defense framework based on User Behavior Analysis (UBA) and Artificial Intelligence.

I. Introduction

Kazakhstan has emerged as a regional leader in Fintech integration. However, rapid digitalization has widened the attack surface for cybercriminals. Current data suggests that over 80% of successful banking frauds are not the result of technical system breaches but are achieved through psychological manipulation, known as social engineering.

Statistical Analysis of Fraud Trends (2023–2025)

According to reports from the Ministry of Internal Affairs and the National Bank of Kazakhstan, internet fraud has shown a steady upward trajectory:

Breakdown of Attack Vectors (2024):

· Social Engineering (Phone Calls): 82%

· Phishing Links (SMS/Messengers): 12%

· Malware/Trojans: 4%

· Other: 2%

None

User Behavior Analysis (UBA) Methodology

To counter these threats, banks must transition from reactive to proactive security. The UBA model identifies anomalies by comparing real-time actions against a historical baseline.

Real-Case Scenarios and Defense Mechanisms

A. The "Security Officer" Scheme

Fraudsters utilize IP-spoofing to mimic official bank numbers, creating a sense of urgency. Our analysis shows that 65% of victims compromised their credentials due to high-pressure tactics.

B. Proposed Strategic Defenses

· Liveness Detection: Implementing mandatory "liveness" checks (facial movements) during high-risk transactions to prevent Deepfake-based fraud.

· Transaction Cooling-off Period: A mandatory 2-to-24-hour hold on large transfers to first-time recipients, allowing victims time to realize and report the fraud.

· Dynamic CVV/CVC: Replacing static card codes with time-sensitive digital codes within the banking app.

V. Conclusion

The security of Kazakhstan's digital banking ecosystem depends on a synergy between advanced AI-driven detection (UBA) and public cyber-literacy. While technical barriers are essential, mitigating the "human factor" remains the most effective strategy for long-term fraud prevention.