Connect with us

Financial News

Ransomware is Indiscriminatory – Prepare for Everything to Fail

Published

on

Rick Vanover

Ransomware attacks continue to grow in frequency. As well as being more common, ransomware is also getting more potent. As per Veeam’s 2023 Ransomware Trends Report, 21% of companies paid the ransom but could not recover their data. The threat landscape is as volatile as it has ever been. There are more attacks taking place. They are more diverse. And they can have grave consequences for the companies they affect.

On the other hand, rather than tremble with fear at the awesome power of the cyber-attacks waiting to be deployed against them, organizations must focus on what they can control – their defence. Protecting your business against cyber-attacks requires following some fundamental and consistent principles – no matter what is thrown at you.

The ransomware wild west

There is a lawless and brutal feeling about businesses’ current cyber landscape. It is difficult for governments to hold cyber criminals to account, and companies are often keen to minimize public attention towards an incident that has compromised them. This contributes to a situation where almost all the focus is on the victim (the business) rather than the criminal (the attacker).

Furthermore, ransomware – and most contemporary cybercrime – is almost indiscriminatory for those who suffer. The fact is that every business is a target. Yes, hacktivist organisations such as Anonymous use organised cyber-attacks to exercise social justice and call out businesses or governments they view as immoral, unlawful, or dangerous. But even the most philanthropic and virtuous companies can find themselves begging a cybercriminal gang to restore their data and systems while a hefty ransom is demanded.

You often see a comparison made between cyber-attacks and fishing. Hence, the term ‘phishing’ refers to using an email or text as bait to trick a victim into ‘biting’ – in this case, clicking on the link and unwittingly downloading malware onto their device. With ransomware especially, we are now seeing industrial-scale attacks being carried out, which are more analogous to trawler fishing. This isn’t one guy with a rod casting out to get a bite off one or two fish. It’s AI-infused algorithms programmed to target everyone and everything – playing a blind numbers game to catch whatever it can.

This indiscriminate nature is compounded by cyber-attacks being generally difficult to contain. For example, cyber warfare between nation-states threatens every organisation – not just those deemed to be in the firing line. We saw this with the NotPetya attack in 2017 – an attack on a specific utility company – which impacted multiple unrelated organisations through an entirely organic chaos spread. Attack types also continue to evolve. For example, the LokiLocker attack was one of the first reported ransomware strains to include a disk wiper functionality. This means organisations are not only held to ransom by having services suspended and threats of data extortion. Now, they are being threatened with losing vast swathes of data entirely if they do not pay up.

Consistent principles of defence

There is some good news for businesses. No matter how scalable, spreadable, or malicious an attack is, these various evolutions can be viewed as attackers simply using bigger guns and more of them. The fundamental principles of preparing your defences against even the most sophisticated and powerful ransomware stay relatively the same.

First, practice impeccable digital hygiene. All employees must be trained to identify suspicious content and be warned of the impact that malpractice using work devices can have. For all the might at the hands of cybercriminals, in many ways, their biggest weapons are unsuspecting employees who give them the keys to the back door of an enterprise network. Given the scattergun approach now adopted by many cyber-attacks, criminals are not necessarily targeting your organisation specifically. But you’ll become a victim if you prove to be an easy hit.

With that said, all businesses must prepare for their defences to fail – no matter how robust you might think they are. Concepts such as zero trust and deploying techniques such as two-factor authentication can be useful for restricting an attacker’s access to data by taking over one individual’s workstation. Ultimately, the best way to protect data is to ensure that it has been securely backed up and fully recoverable before an incident occurs. Follow the 3-2-1-1-0 backup rule, which states there should always be at least three copies of data on at least two different types of media, at least one off-site and one immutable or offline, with zero unverified backups or errors.

While the headlines and constant discussion around cybersecurity and ransomware can be daunting, it’s important to remember that the fundamental actions required to protect data remain the same. Data Protection and Ransomware Recovery strategies ensure businesses can protect all data from cyber-attacks, server outages, accidental loss, and deletion across physical, virtual, cloud, SaaS, and Kubernetes environments. Investing in a data protection strategy and taking advantage of a solution that enables continuous backup and Disaster Recovery (DR) can give businesses peace of mind that should the worst happen, they never need to pay the ransom.

Continue Reading

Financial

UAE MOVES TOWARDS A MORE COMPLIANCE-FOCUSED TAX LANDSCAPE WITH RECENT VAT REFORMS: DHRUVA

Published

on

Person wearing a dark gray business suit with a white dress shirt and a textured purple tie, standing against a plain gray background

Dhruva, a premier tax advisory firm with deep expertise across the Middle East, India, and Asia, stated that the UAE’s latest amendments to the VAT Law and the Tax Procedures Law, issued by the Federal Tax Authority (FTA) which are effective from 1 January 2026, represent a significant shift toward a more structured, and risk-focused tax environment. These amendments are expected to reinforce responsible compliance behaviors and reduce administrative friction for UAE businesses.

Dhruva noted that one of the most practical and welcoming changes is that it eliminates the requirement for taxpayers to self-issue tax invoices for imports subject to the reverse charge mechanism, which provides a lot of ease to businesses. Post series of amendments and clarifications issued by the FTA in 2025 in relation to self-issuance of tax invoices for imports, while a general exception was granted for such requirement for import of services, the same were required in case of import of goods for record-keeping purposes.  This often-added administrative complexity without impacting the actual tax liability or input tax entitlement. Under the updated rules, taxable businesses have removed the obligation entirely, and hence, businesses will only need to maintain standard supporting documentation, such as invoices, contracts, and transaction records.

However, the firm highlighted that while some administrative burdens are being eased, compliance expectations are tightening elsewhere.  One of the amendments gives the FTA authority to deny input tax recovery in cases linked to tax evasion – where a taxpayer knew or, critically, should have known, that a supply or its broader supply chain was connected to tax evasion.  The law clarifies that taxpayers will be deemed to have been aware if they fail to verify the validity and integrity of the supply in accordance with procedures to be issued by the FTA.

Dhruva explained that historically, the responsibility to account for VAT rested primarily with the supplier, and recipients focused mainly on validating the tax invoice and meeting standard input-tax recovery conditions. In practice, however, the FTA has often linked a recipient’s input-tax eligibility to the supplier’s discharge of output VAT, denying recovery where gaps existed. The latest amendment now formally embeds this position in law, imposing additional due-diligence obligations on the recipient.

Ujjwal Pawra, Partner at Dhruva Consultants, commented, “This is a significant change. It is a clear message that the right to input tax recovery comes with the responsibility to validate the integrity of one’s suppliers and supply chain. Businesses must now demonstrate that they exercised practical, documented, and consistent due diligence. Clean invoices alone are no longer enough; what matters is a clean process.”

While the procedures and conditions are awaited, Dhruva advised that companies reassess onboarding procedures, supplier-vetting protocols, and documentation trails to ensure they align with the FTA’s expected standards. 

Another material operational change is the introduction of a defined timeframe to act on credit balances. Under the amended framework, businesses will generally have up to five years from the end of the relevant tax period to request a refund of a credit balance or use that balance to settle tax liabilities, with targeted flexibility in specified cases where credits arise late in the cycle.

Transitional relief is also available for certain older credits around the changeover, which can help businesses address legacy positions in an orderly way. Dhruva said these changes reduce the risk of credits remaining unresolved on the balance sheet, improve cash flow planning, and encourage clearer internal ownership of refund positions.

Ujjwal further added, “The UAE has introduced a more robust operating framework for credit balances and refunds in line with international best practices. The message is simple: know your credits, map the deadlines, and file claims that are clear, complete, consistent, and easy to validate.”

Dhruva advised UAE businesses to act now with a finance-led approach. This starts with building a central credit-balance register by tax type and tax period, assigning an accountable owner, and tracking action dates so credits are either utilised or claimed in time. Businesses should also treat refund submissions as audit-ready files by preparing reconciliations, supporting documents, and a concise explanation of how the credit arose and why the amount is correct before submitting, rather than rebuilding the file after queries begin. In parallel, companies should prioritise older credit positions to assess whether they fall within the transitional relief window and avoid last-minute filings.

The firm also advised businesses to monitor any binding directions issued by the FTA and align their tax positions, documentation, and system settings accordingly to minimize interpretational differences and strengthen consistency over time.

Continue Reading

Financial

5 SMART WAYS UAE TRAVELERS CAN PROTECT THEIR FINANCES THIS FESTIVE SEASON

Published

on

Person wearing a dark business suit and light checkered dress shirt, standing against a plain light gray background.

By Hennie du Plessis, Senior Vice President, Payment Services, Middle East and Africa at IDEMIA Secure Transactions (IST)

The festive season is one of the busiest periods of the year for UAE travelers. From year end getaways and family visits, to overseas shopping and digital gifting, consumers increasingly rely on contactless cards and mobile wallets to make payments quickly and conveniently.

Beyond higher spending, the festive season also acts as a real stress test for digital payment ecosystems. Transaction volumes peak, payment environments become less familiar, and consumers move rapidly across borders. This combination of factors increases exposure to fraud if the right safeguards are not in place. As digital payments scale, security becomes a critical enabler of trust.

According to IDEMIA Secure Transactions’ latest Global Consumer Payment Survey, which included UAE respondents aged 18 to 71, more than 8 in ten consumers have already adopted digital cards with biometric features, while 92 percent express interest in numberless cards. These figures reflect a growing expectation for payment experiences that combine speed, simplicity, and security.

With contactless payments now accounting for 84 percent of face-to-face transactions in the UAE and mobile wallet usage surpassing 50 percent, the festive season is a critical moment for travelers to reassess how they protect their finances while on the move.

1. Avoid Public Wi-Fi for Payment Activity

Festive travel often means relying on airport or hotel Wi-Fi, but unsecured networks remain a common entry point for cybercriminals. Accessing banking apps or making purchases over public Wi-Fi can expose sensitive information at interception. Travelers should use mobile data or a trusted VPN when handling financial transactions. A few moments of convenience are never worth the risk of compromised financial data, especially during peak travel periods.

2. Use Secure Digital Payment Solutions

Not all payment tools offer the same level of protection. Today, tokenization has become a global industry standard for securing digital transactions, replacing sensitive card details with unique digital tokens that are useless if intercepted. Mobile wallets such as Apple Pay, Google Pay, and Samsung Pay already rely on this technology.

Beyond protecting data in transit, tokenization also limits exposure in the event of merchant-side data breaches, as real card numbers are never stored or shared. Tokens are typically device-specific and transaction-bound, adding an additional layer of protection even if credentials are compromised elsewhere.

IDEMIA Secure Transactions plays a key role in enabling tokenized payments at scale, supporting secure transactions across in-store, online and in-app environments through its EMVCo-certified Token Platform. Digital co-badged cards offer global compatibility without sacrificing local functionality. By ensuring that real card numbers are never shared, tokenization significantly reduces fraud risk while preserving a smooth user experience. In addition, digital wallets can be remotely suspended if a device is lost or stolen, offering travelers greater control and peace of mind while abroad.

3. Decline Dynamic Currency Conversion

While shopping abroad during the festive season, merchants often offer travelers the option to pay in AED. This practice, known as dynamic currency conversion, typically includes hidden markups and unfavorable exchange rates. Paying in the local currency allows banks to apply more transparent conversion rates, helping consumers avoid unnecessary costs. This simple choice can make a meaningful difference for frequent travelers and international shoppers alike.

Another possibility for travelers is to use the Tap to Phone technology provided by some banks and supported by IST. Instead of having to switch cards across borders, it enables the travelers to modify their card features, such as credit/debit options and the currency used for transactions, with a simple tap on a smartphone via their banking app. This simple habit can save money and ensure better financial clarity while greatly facilitating international card usage.

4. Enable Real Time Alerts and Card Controls

With spending increasing during the festive period, real time monitoring is essential. Many UAE banks and fintech platforms offer instant transaction alerts, spending limits and location-based restrictions that allow consumers to monitor activity as it happens.

Crucially, modern security no longer has to come at the expense of convenience. These tools enhance protection while maintaining the fast, frictionless payment experiences that consumers expect, particularly in a market where one-click and contactless payments are widely adopted. This aligns with consumer expectations, as 96 percent of UAE users prefer simplified one click payment experiences. Real time controls enhance security without adding friction.

5. Secure Devices Before You Travel

Smartphones now function as wallets, boarding passes and identity tools. Before travelling, users should update device software, enable biometric authentication and avoid storing sensitive information in unsecured apps. Travelers should also activate remote lock and wipe functionality, ensure cloud backups are enabled, and avoid carrying all payment methods on a single device. Keeping at least one physical card separate from the phone provides an important fallback. While digital wallets rely on encrypted token technology, 29 percent of surveyed users still express concerns about digital card security, and 43 percent do not fully understand how these tools work. Basic preparation can significantly reduce risk and soothe concerns.

As UAE card payments are expected to reach USD 150 billion this year, the festive season highlights the need for secure and user-friendly payment infrastructure. By adopting the right tools and habits, travelers can focus on celebrating rather than dealing with fraud.

For the payments industry, the challenge is clear: security must be built into every transaction in a way that protects users without disrupting their experience. When trust is embedded seamlessly, travelers are free to enjoy the moments that matter most, wherever their journey takes them.

Continue Reading

Financial

DHRUVA URGES UAE BUSINESSES TO ACT NOW ON TRANSFER PRICING RISK

Published

on

Person wearing a dark blue business suit with a white dress shirt and a red tie, standing against a plain light gray background.

Dhruva, a premier tax advisory firm with deep expertise across the Middle East, India, and Asia, is encouraging UAE-headquartered groups and multinational companies operating in the country to place transfer pricing (TP) firmly on their strategic and governance agenda, as the UAE’s corporate tax landscape develops and aligns more closely with international practice.

With corporate tax now in effect, the way organisations price transactions between related parties and connected persons is becoming an important element of tax governance, financial planning and stakeholder confidence. TP is no longer just a specialist topic for tax teams, but an area that benefits from early, well-considered attention at senior management level.

“Transfer pricing has quickly become one of the key components of a modern tax framework in the UAE,” said Kapil Bhatnagar, Partner, Dhruva. “For many organisations, this is still a relatively new area. Our message is a positive one, now is a good time to step back, understand your intra-group arrangements and put in place a clear, well-documented approach. Doing this early can bring greater clarity, predictability and comfort for management, shareholders and other stakeholders.”

Dhruva notes that TP considerations are relevant not only for large global multinationals, but also for UAE-headquartered groups, family businesses, free zone entities and fast-growing regional companies. Any business with cross-border or domestic related-party dealings – such as management fees, services, financing, distribution, manufacturing, or use of intellectual property – can benefit from having a structured view on how these transactions are priced and supported.

Kapil added, “A common question we receive from clients is simply, ‘Where do we start?’ In our experience, the most effective approach is to treat transfer pricing as a practical business project rather than just a technical exercise. It starts with understanding how your group creates value, how responsibilities and risks are shared, and then reflecting that in your pricing, internal policies, and documentation in a consistent way.”

Next steps for UAE organisations

Dhruva’s suggested next steps for UAE organisations focus on helping boards, CEOs, CFOs, and tax leaders move from awareness to practical action on transfer pricing. The first step is to map related-party transactions and understand the big picture. Organisations should identify their main related-party and connected-person transactions, both within the UAE and cross-border, and then group them by type – for example, services, goods, financing, intellectual property or guarantees. From there, they can build a simple, high-level overview of how value flows within the group and where key functions and decision-making actually sit.

The second step is to develop or refine a coherent transfer pricing framework. This involves designing a framework that clearly sets out how different categories of transactions are priced, using appropriate methodologies that reflect the business reality. Internal policies, legal agreements, operational substance and financial outcomes should all be aligned so that they tell a consistent story. It is also important to integrate transfer pricing considerations into budgeting and planning cycles, rather than addressing them only at year-end.

The third step is to strengthen documentation and internal capabilities. Organisations should prepare documentation that explains the group’s business model, value chain and the rationale for its pricing approach in a clear and structured manner. Finance and tax teams need to be equipped with the knowledge and tools to maintain and update this information over time as the business evolves. In addition, a simple governance mechanism should be established to ensure that transfer pricing topics are periodically reviewed at management level and, where relevant, at board level as part of ongoing oversight.

“In many ways, the UAE is at a constructive stage in its tax journey,” Kapil said. “Businesses have the opportunity to put robust, practical transfer pricing foundations in place that reflect how they actually operate. This is not only about compliance – it is about having clarity, supporting informed decision-making and giving confidence to investors, partners and employees.”

Dhruva’s analysis of developments across the wider GCC shows that other regional markets are also expanding their focus on transfer pricing, documentation, and alignment with international standards. For groups operating in more than one jurisdiction, a coordinated regional approach can support consistency and reduce uncertainty.

“Our recommendation to UAE organisations is to use this period to get ready in a thoughtful, structured way. Early movers often find that a well-designed transfer pricing approach supports smoother internal decision-making and provides comfort as the tax environment continues to mature,” concluded Kapil.

Continue Reading

Trending

Copyright © 2023 | The Integrator