Cyber Crime & Bank Fraud

Businesses have little protection against cybercrime and business bank account fraud

Beware - Your business has increased risks and liability for bank fraud losses

While consumer banking accounts are covered under Federal Reserve Regulation E (12 C.F.R. Part 205), which requires banks to provide reimbursement for certain fraud losses, Regulation E does not apply to business accounts. Instead, business and commercial bank accounts are covered by the Uniform Commercial Code (UCC).

Under the UCC, business account holders have shorter reporting timelines, less protections, and significantly higher liability for fraud than consumer banking customers. Additionally, individual banks can elect to shorten the fraud reporting timelines even further, or even disclaim certain obligations altogether, through amendments to their commercial banking agreements.¹

In short, this means much of the responsibility for protection of your business bank account from cyber crime and other fraud rests squarely on you and your business. This responsibility, and liability, particularly extends to safeguarding against ACH and wire transfer fraud, check fraud, account takeover, and protecting your business' banking credentials. Also see Prevention and Victim Assistance for additional information.

Doesn't my bank protect my business bank account?

Not necessarily.  While many banks offer "zero-fraud liability" protection to their consumer banking customers (in addition to the protections under Regulation E), businesses do not commonly enjoy this same benefit. Also, unlike major credit card companies, many banks do not have sophisticated fraud detection systems that can detect and alert business owners to suspicious or unusual activity in their business bank accounts. For example:

“If you go two states over and use your credit card to buy gas, the credit card company calls you to say it’s out of the norm, but most banks have no idea,” said Mark Patterson, whose construction company, Patco, in Sanford, Maine, was robbed of $588,000 in 2009 by ZeuS Trojan, a form of malware. “Our bank had no alarms to say, hey, over five consecutive nights, Patco’s wiring money all over the country — to California, Florida, places we don’t normally send money, and definitely not from an I.P. address outside the U.S.”²

Businesses are frequent victims of bank fraud and cyber crime. In its "2012 Business Banking Trust Study", the Ponemon Institute surveyed business owners and executives of 998 small and medium sized businesses nationwide regarding such commercial banking fraud losses. The results were revealing:

• 74% of the respondents stated their business had experienced online banking fraud.
• 52% reported their business bank accounts had been targets of both successful and unsuccessful fraud incidents in the preceding 12 months.

According to the study, of those businesses that experienced fraud:

• 85% suffered credit or debit card fraud
• 85% suffered unauthorized account access
• 19% suffered unauthorized wire transfers
• 36% also reported that information stolen from their online banking account was used to commit check fraud

When the study specifically addressed the issue of fraud losses and reimbursement, of those who reported suffering fraud incidents, only 16% of the businesses reported that their banks detected and completely stopped the fraud before money was stolen.

Of those cases in which money was stolen:

• 12% reported that their banks were able to recover all of the stolen money
• 20% of the businesses reported that their bank provided full reimbursement of unrecovered funds
• 21% of the businesses reported that their bank provided "some" reimbursement of unrecovered funds
• 59% of the defrauded businesses suffered losses without reimbursement

Cyber thieves can strike fast and hard

In just 20 separate cyber crime incidents reviewed by the FBI, the actual losses to victimized companies totaled $11 million. ³

Some examples:

• The Western Beaver public school district in Pennsylvania filed a lawsuit against its bank after cyber-thieves used malicious software to siphon more than $700,000 from the school's account at ESB. According to the lawsuit, the funds were transferred in 74 separate transactions over a two-day period.
  
  
• Cyber-crooks stole $1.2 million from Unique Industrial Product Co., a Sugar Land, Texas-based plumbing equipment supply company. The company's operations manager said a forensic analysis showed the attackers used malware planted on its computers to initiate 43 transfers out of the company's account within 30 minutes.
  
  
• Fraudsters struck JM Test Systems, an electronics calibration company in Baton Rouge. According to the company's controller, an unauthorized wire transfer of $45,640 was sent from JM's account to a bank in Russia. The company's bank subsequently provided the company with new credentials. But less than a week later, another $51,550 of JM Test's money was transferred to five money mules across the country. The company was able to recover only $7,200 of the stolen money, which was returned only because one mule who was to receive that transfer apparently closed their account before the transfer could be completed. ⁴

In his September 2011 Congressional testimony before the House Financial Services subcommittee, Assistant Director Gordon M. Snow of the FBI's Cyber Security Division stated: "The FBI is currently investigating over 400 reported cases of corporate account takeovers in which cyber criminals have initiated unauthorized ACH and wire transfers from the bank accounts of U.S. businesses. These cases involve the attempted theft of over $255 million and have resulted in the actual loss of approximately $85 million."

"The potential economic consequences are severe. The sting of a cyber crime is not felt equally across the board. A small company may not be able to survive even one significant cyber attack. On the other hand, companies may not even realize that they have been victimized by cyber criminals until weeks, maybe even months later. Victim companies range in size and industry. Often, businesses are unable to recoup their losses, and it may be impossible to estimate their damage. Many companies prefer not to disclose that their systems have been compromised, so they absorb the loss, making it impossible to accurately calculate damages."

Inside a cyber-theft ring

The following graphics, produced by the FBI, provide insight into the hierarchy and operations of common cyber-theft rings.

Pharming

Learn how to protect your business from business identity theft

Need help? Find resources and assistance