Intellectual Property Law

Feds Warn Small Businesses to Use Dedicated PC for Online Banking

By Kim Zetter

In the wake of a rash of hacks on computers owned by small businesses, the FBI and the American Banking Association have issued an alert advising businesses to use only a dedicated PC for online banking, according to USA Today.

The alert was issued after numerous small businesses, universities and local governments have been targeted by hackers who installed keystroke loggers on their machines to steal banking credentials and siphon millions of dollars from their bank accounts.

The alert advises businesses to dedicate a single computer for online banking activity that is never used for reading e-mail or surfing anywhere else on the web. Using a dedicated computer would lessen the chance of the computer being infected with malware that can help crooks drain a bank account through wire transfers and automated clearinghouse transfers.

The FBI says thieves have stolen about $40 million in this way in more than than 200 cases they’ve investigated in the last two years involving small to mid-size companies and organizations. Such companies generally do not employ dedicated computer security staff or have extensive knowledge about how to protect themselves with firewalls, anti-virus and other measures and policies.

Often the financial institutions they do business with are small banks and credit unions that don’t employ adequate personnel and measures to detect fraudulent transactions — such as high-value transfers from suspicious IP addresses.

Bank customers with business accounts have fewer protections than customers with personal accounts, which are protected by federal consumer-protection laws. Consumers who report fraudulent activity on their account in a timely manner will generally get their money reimbursed, though it make take time and effort to convince the bank that the transaction was fraudulent.

Business customers are not as lucky and many have found that banks refuse to accept liability for fraudulent money transfers if the bank determines that the customer did not employ adequate security measures, such as a well-configured firewall and up-to-date anti-virus programs.

The Western Beaver County School District in Pennsylvania is one entity that is fighting back against this disparity. It’s suing ESB Bank for allowing thieves to conduct 74 unauthorized cash transfers on its account over four days during the Christmas holidays in 2008. The thieves moved $704,610 out of the account into 42 other accounts spread out in several states and Puerto Rico. The bank was able to reverse some of the transfers involving $263,413, USA Today reports, but lost more than $440,000.

Full post as published by Threat Level on December 31, 2009 (boomark / email).