Banking Law

Fort Worth-based OmniAmerican Bank was the target of a sophisticated band of cyber crooks recently, which hacked into the bank's system, "stole account numbers, created new PINs, fabricated debit cards, then withdrew cash from ATMs in Eastern Europe, including Russia and Ukraine, as well as Britain, Canada and New York."

"It was a pretty sophisticated scheme," said Tim Carter, president of the Fort Worth-based bank.

The amount stolen is not yet known, he said, describing it only as "minimal." No depositors will lose money, he said.

Fewer than 100 accounts, some of them dormant, were compromised, all with a daily withdrawal limit of less than $1,000, he said.

According to a security expert from McAfee, Michael Carmichael, this type of breach is "a commonplace occurrence," although banks are reluctant to publicize these incidents.

Carmichael gave some props to the bad boys who hit OmniBank.

"If you look at the sophistication of it -- going in, modifying PINs, issuing cards -- this is not a kid out there," he said. "This appears to be something set up. Time was involved in executing it."

Carmichael said the group could have originated in Russia, although similar skilled hackers are now being found in Asia, particularly China.

Whoever they are, he said, "they're elite, more elegant, and it's difficult for banks and many enterprises to keep pace with their activities.

"Banks are under a great amount of pressure to balance risk and shareholder value," said Carmichael, speaking from Las Vegas, where he is attending a conference. "They could do more, [but they] have a hard time justifying the cost until an incident occurs."

We've frequently ranted about the kleptocracies that have emerged out of the ruins of the former Soviet Empire. They're the breeding ground of tech-savvy, amoral cyber thieves. While such gangs might make nice fodder for pulp fiction and the movies, in real life they're presenting an increasing to risk to banks everywhere, including, obviously, Cowtown, USA. I doubt that the directors and senior management of OmniAmerican Bank will have a tough time justifying additional expenditures on Internet security in light of this ""incident." Although relatively few accounts were hit, and the amount stolen was "minimal," the costs of the breach to the bank may be substantial. According to the press report, letters were sent to all debit card holders notifying them of the breach and the bank is issuing 40,000 new debit cards with a revised PIN, to prevent future fraud. That's got to hurt. Moreover, there is a hit to reputation that flows simply from the publicity of the incident.

On the other hand, if Carmichael is correct, and these types of intrusions (which he indicated can happen in "any number of ways") are "commonplace," then banks can learn something from how OmniAmerican appears to have handled the breach. It seems to have acted with reasonable dispatch to minimize the damage.

After discovering the fraudulent activity Friday afternoon, OmniAmerican placed temporary limits on some ATM and debit-card transactions and suspended some electronic banking services, which were restored Sunday, Carter said. At no time were customer deposits at risk, he stressed. "We reduced by half the dollar amount that could be withdrawn and limited [access] to Texas. We cut out anything outside Texas," Carter said.

The unauthorized withdrawals were stopped Friday, and bank employees worked over the weekend to deal with the damage, he said.

The bank learned of the breach from customers inquiring about unusual activity in their accounts, from internal monitoring and from a law-enforcement agency, which Carter declined to name.

My guess, without any personal knowledge, is that the unnamed law-enforcement agency is the US Secret Service. It's involved in monitoring international cyber crooks who are using their technical skills to go where the money is: in US banks.

The bank appears to have reacted quickly and efficiently once it discovered the breach. I'm certain that they've closed the door through which the crooks entered the bank's system this time; however, rest assured that these organized, sophisticated, "elite" criminals are already patiently knocking on other doors at other targets of opportunity.

It's a fact of life.