While consumer banking accounts are covered under Federal Reserve Regulation E (12 C.F.R. Part 205), which requires banks to provide reimbursement for certain fraud losses, Regulation E does not apply to business accounts. Instead, business and commercial bank accounts are covered by the Uniform Commercial Code (UCC).

Under the UCC, business account holders have shorter reporting timelines, less protections, and significantly higher liability for fraud than consumer banking customers. Additionally, individual banks can elect to shorten the fraud reporting timelines even further, or even disclaim certain obligations altogether, through amendments to their commercial banking agreements.¹

In short, this means much of the responsibility for protection of your business bank account from cyber crime and other fraud rests squarely on you and your business. This responsibility, and liability, particularly extends to safeguarding against ACH and wire transfer fraud, check fraud, account takeover, and protecting your business' banking credentials. Also see Prevention and Victim Assistance for additional information.

Doesn't my bank protect my business bank account?

Not necessarily.  While many banks offer "zero-fraud liability" protection to their consumer banking customers (in addition to the protections under Regulation E), businesses do not commonly enjoy this same benefit. Also, unlike major credit card companies, many banks do not have sophisticated fraud detection systems that can detect and alert business owners to suspicious or unusual activity in their business bank accounts. For example:

“If you go two states over and use your credit card to buy gas, the credit card company calls you to say it’s out of the norm, but most banks have no idea,” said Mark Patterson, whose construction company, Patco, in Sanford, Maine, was robbed of $588,000 in 2009 by ZeuS Trojan, a form of malware. “Our bank had no alarms to say, hey, over five consecutive nights, Patco’s wiring money all over the country — to California, Florida, places we don’t normally send money, and definitely not from an I.P. address outside the U.S.”²

Businesses are frequently victimized by bank fraud and cyber crime. In its "2011 Business Banking Trust Study", the Ponemon Institute surveyed business owners and executives of 533 small and medium sized businesses nationwide regarding such banking fraud losses. The results were revealing:

• 56% of the businesses surveyed had experienced fraud in the preceding 12 months, and 61% of those had been victimized more than once
  
  
• Of those that experienced fraud, 75% suffered online account takeover and/or online fraud
  
  

Fraudulent transaction methods included credit and debit card fraud, check fraud, fraudulent wire transfers, fraudulent ACH, and fraudulent bill pay transfers

When the study addressed the issue of fraudulent electronic transactions and wire transfer fraud:

• Survey respondents reported that their banks detected and stopped the fraud in only 22% of the cases. In 78% of the cases, the business' banks failed to catch the fraud and the money left the account.
  
  
• The business' banks were able to recover all of the stolen money in only 10% of the cases
  
  
• In 60% of the cases, the defrauded businesses suffered losses
  
  

The business' banks were unable to recover funds in 68% of the cases. In respect to the unrecovered funds:

• Only 37% of the businesses surveyed reported that their bank provided some reimbursement of unrecovered funds. 31% reported that they received no reimbursement at all.

Cyber thieves can strike fast and hard

In just 20 separate cyber crime incidents reviewed by the FBI, the actual losses to victimized companies totaled $11 million. ³

Some examples:

• The Western Beaver public school district in Pennsylvania filed a lawsuit against its bank after cyber-thieves used malicious software to siphon more than $700,000 from the school's account at ESB. According to the lawsuit, the funds were transferred in 74 separate transactions over a two-day period.
  
  
• Cyber-crooks stole $1.2 million from Unique Industrial Product Co., a Sugar Land, Texas-based plumbing equipment supply company. The company's operations manager said a forensic analysis showed the attackers used malware planted on its computers to initiate 43 transfers out of the company's account within 30 minutes.
  
  
• Fraudsters struck JM Test Systems, an electronics calibration company in Baton Rouge. According to the company's controller, an unauthorized wire transfer of $45,640 was sent from JM's account to a bank in Russia. The company's bank subsequently provided the company with new credentials. But less than a week later, another $51,550 of JM Test's money was transferred to five money mules across the country. The company was able to recover only $7,200 of the stolen money, which was returned only because one mule who was to receive that transfer apparently closed their account before the transfer could be completed. ⁴

In his September 2011 Congressional testimony before the House Financial Services subcommittee, Assistant Director Gordon M. Snow of the FBI's Cyber Security Division stated: "The FBI is currently investigating over 400 reported cases of corporate account takeovers in which cyber criminals have initiated unauthorized ACH and wire transfers from the bank accounts of U.S. businesses. These cases involve the attempted theft of over $255 million and have resulted in the actual loss of approximately $85 million."

"The potential economic consequences are severe. The sting of a cyber crime is not felt equally across the board. A small company may not be able to survive even one significant cyber attack. On the other hand, companies may not even realize that they have been victimized by cyber criminals until weeks, maybe even months later. Victim companies range in size and industry. Often, businesses are unable to recoup their losses, and it may be impossible to estimate their damage. Many companies prefer not to disclose that their systems have been compromised, so they absorb the loss, making it impossible to accurately calculate damages."

Inside a cyber-theft ring

The following graphics, produced by the FBI, provide insight into the hierarchy and operations of common cyber-theft rings.

Pharming

Learn how to protect your business from business identity theft

Need help? Find resources and assistance