Why are smaller businesses and organizations targeted?

The cyber-thieves appear to be targeting small- to medium-sized businesses, as well as smaller government agencies and nonprofits, for several reasons:

• Many small businesses and organizations have the capability to initiate funds transfers – ACH credits and wire transfers – via online banking (individual consumers generally do not have this capability except for payees set up in online bill payment systems);
• This funds transfer capability is often related to a small business’ origination of payroll payments;
• In corporate account takeover, the cyber-thieves may add fictitious names to a payroll file (directed to the accounts of money mules), and/or initiate payroll payments off-cycle to avoid daily origination limits.
• Small businesses often do not have the same level of resources as larger companies to defend their information technology systems.
• Many small businesses do not monitor and reconcile their accounts on a frequent or daily basis;
• Small businesses bank with a wide variety of financial institutions with varying degrees of IT resources and sophistication.

Prevention, detection & reporting for business customers account control

• Reconcile all banking transactions on a daily basis.
• Initiate ACH and wire transfer payments under dual control, with a transaction originator and a separate transaction authorizer.
• Utilize routine reporting on transactions
• Perform periodic risk assessment of the banking products/services you use; including; regular reviews of user access levels, dollar limits and activity.
• Immediately report any suspicious transactions to the financial institution
• Stay in touch with other businesses and industry sources to share information regarding suspected fraud activity

Computer security tools & practices

• Install a dedicated, actively managed firewall. A firewall limits the potential for unauthorized access to a network and computers.
• Install commercial anti-virus software on all computer systems.
• Ensure virus protection and security software are updated regularly.
• Ensure computers are patched regularly, particularly operating system and key applications, with security patches.
• Consider installing spyware detection programs.
• Be suspicious of e-mails purporting to be from a financial institution, government department or other agency requesting account information, account verification or banking access credentials such as usernames, passwords, PIN codes and similar information. If you are not certain of the source, do not click any links.
• Create strong passwords.
• Prohibit the use of “shared” usernames and passwords for online banking systems.
• Use a different password for each website that is accessed.
• Change the password several times each year.
• Never share username and password information with third-party providers.
• Limit administrative rights on users’ workstations.
• Carry out all online banking activities from a stand-alone computer system from which e-mail and Web browsing are not possible.
• Verify use of a secure session (“https”) in the browser for all online banking.
• Avoid using an automatic login features that save usernames and passwords for online banking.
• Never leave a computer unattended while using any online banking or investing service.
• Never access bank, brokerage or other financial services information at Internet cafes, public libraries, etc. Unauthorized software may have been installed to trap account number and sign on information leaving the customer vulnerable to possible fraud.

Recommendations for corporate account takeover victims

• Immediately cease all activity from computer systems that may be compromised. Disconnect the Ethernet or other network connections to isolate the system from remote access.
• Immediately contact your financial institution and request assistance with the following actions:
  • Disable online access to accounts.
  • Change online banking passwords.
  • Open new account(s) as appropriate.
  • Request the financial institution’s agent review all recent transactions and electronic authorizations on the account.
  • Ensure that no one has requested an address change, title change, PIN change or ordered new cards, checks or other account documents be sent to another address.
• Maintain a written chronology of what happened, what was lost and the steps taken to report the incident to the various agencies, banks and firms impacted. Be sure to record the date, time, contact telephone number, person spoken to, and any relevant report or reference number and instructions.
• Many small businesses do not monitor and reconcile their accounts on a frequent or daily basis;
• File a police report and provide the facts and circumstances surrounding the loss. Obtain a police report number with the date, time, department, location and officer’s name taking the report or involved in the subsequent investigation. Having a police report on file will often facilitate dealing with insurance companies, banks, and other establishments that may be the recipient of fraudulent activity. The police report may initiate a law enforcement investigation into the loss with the goal of identifying, arresting and prosecuting the offender and possibly recovering losses.