Security Tips For Your Business

What would you do if you suddenly noticed that huge chunks of money had been drained from your business account into overseas accounts? Unfortunately, online criminals are using increasingly sophisticated techniques to commit payments fraud against commercial business accounts. Let's take a closer look at corporate account takeover, how federal regulators and financial institutions are collaborating to help you to prevent it from happening to your business, and finally your responsibility to protect yourself.

Corporate account takeover is a type of fraud where thieves gain access to a business' finances to make unauthorized transactions, including transferring funds from the company, creating and adding new fake employees to payroll, and stealing sensitive customer information that may not be recoverable. Thousands of businesses have fallen victim to this type of fraud, and the losses have ranged from a few thousand to several million dollars.

Regulation E
Consumer bank accounts enjoy a certain level of protection that business bank accounts do not. Under Regulation E, there are liability limitations for unauthorized electronic fund transfers affecting consumer bank accounts. Business bank accounts do not get this kind or protection. So when business accounts are compromised, they often lose all or at least some of their money.

Customer vs. Bank
A good example of this is the court case between Patco Construction Company and their financial institution Ocean Bank. Patco computers had become infected with malware allowing fraudsters to make six wire transfers using the Automated Clearing House (ACH) transfer system amounting to more than $588,000. Only $243,000 of the stolen money was recovered. What ensued was a three-year court battle between the company and their financial institution to decide who was at fault. In the end, both were losers. Businesses and banks aren't only losing millions to fraud; they are losing millions more in legal costs, productivity losses and negative PR. The only winners in these cases are the cyber criminals.

What regulators & banks are doing to prevent corporate account takeover
In an effort to protect both consumers and businesses from financial fraud, the Federal Financial Institutions Examination Council (FFIEC) has implemented and will continue to establish new security guidelines for financial institutions. These guidelines enforce the implementation of a layered security approach, risk assessments and customer security education and awareness. You can learn more about this from your financial institution.

Who's responsible?
The question remains, "In light of the increasing and more sophisticated cyber threats, who is ultimately responsible for ensuring the security of your bank account?" The financial institution must protect their online banking technology and ensure the security of online transactions, but what responsibility does the customer have to protect their own computing systems against attack? Today security is a shared responsibility between the financial institution and the customer.

As in the case of Patco Construction, corporate account takeover attacks today are typically perpetrated quietly by the introduction of malware through a simple phishing email, a deceptive social engineering ploy, or an infected website. For a business that has low resistance to such methods of attack, the malware introduced onto its system may remain undetected for weeks or even months.

How do I protect myself and my business?
The best way to protect against corporate account takeover is a strong partnership with your financial institution. Work with your bank to understand security measures needed within the business and to establish safeguards on the accounts that can help the bank identify and prevent unauthorized access to your funds.

A shared responsibility between the bank and the business is the most effective way to prevent corporate account takeover.

Stay informed about defenses to Corporate Account Takeover. Since cyber threats change rapidly, it's imperative that you stay informed about evolving threats and adjust your security measures accordingly.

You and your employees are the first line of defense against corporate account takeover. A strong security program along with employee education about the warning signs, safe practices, and responses to a suspected takeover are essential to protecting your company and customers.

If you are a customer of the Fist National Bank & Trust, we have provided a best practices guide for our Cash Management module of our Online Banking Application. Please reference this guide for some additional tips, as well as specific safeguards available to you when using our product.

Interested in using our Cash Management module? Contact Us today to speak with a customer service representative.

ACH transactions and wire transfers are the fastest way to move funds to another business, person, or other recipient. Both ACH (automated clearing house) transactions and wire transfers are forms of electronic fund transfers (EFTs). Wire transfers typically involve larger sums of money and are transferred between banks. ACH transfers are scheduled transactions, like online bill payments, that typically involve smaller amounts of money.

Unfortunately, cyber criminals have discovered how to steal your hard-earned money. They use a variety of tools including phishing emails, compromised legitimate websites, fake friend requests on social sites, and malware to obtain your bank logon credentials. Once they have them; they can use them to transfer money out of your bank account and into theirs. They often target small-to-medium-sized businesses because these businesses often do not use dual controls on their accounts nor have they adopted a strong information security posture.

Establishing a strong information security posture is not a “one-size-fits-all” solution, and it's not as simple as installing a firewall or having anti-virus protection. Each organization has unique business functions that require appropriate security measures to be in place to, not only protect your organization from fraud, but to comply with industry standards, ever-changing federal regulations and state privacy laws.

Protecting yourself or your business from the negative impacts of fraud should be a top priority. Whether your concerns relate to check or electronic payment fraud, the risks continue to grow. What can you do?

Transferring funds, either by ACH or wire, is generally safe when using a financial institution. However, if your computer has become infected with malicious software (malware), cyber criminals can steal usernames and passwords and defeat common methods of user authentication employed by financial institutions. You can protect yourself from malware by adopting safe online practices and keeping your computers and networks secure.

Does your company keep sensitive data — Social Security numbers, credit reports, account numbers, health records, or business secrets? If so, then you’ve probably instituted safeguards to protect that information, whether it’s stored in computers or on paper. That’s not only good business, but may be required by law.

According to the Federal Trade Commission (FTC), the nation’s consumer protection agency, your information security plans also should cover the digital copiers your company uses. If the data on your copiers gets into the wrong hands, it could lead to fraud and identity theft.

Digital Copiers are Computers
Commercial copiers have come a long way. Today’s generation of networked multi-function devices — known as “digital copiers” — are "smart" machines that are used to copy, print, scan, fax and email documents. Digital copiers require hard disk drives to manage incoming jobs and workloads, and to increase the speed of production. But not every copier on the market is digital: generally, copiers intended for business have hard drives, while copiers intended for personal or home office use do not.

The hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails. If you don’t take steps to protect that data, it can be stolen from the hard drive, either by remote access or by extracting the data once the drive has been removed.

Digital copiers store different types of information in different ways. For example, photocopied images are more difficult to access directly from the hard drive than documents that are faxed, scanned or printed on the copier.

The Life-Cycle of a Copier
Copiers often are leased, returned, and then leased again or sold. It’s important to know how to secure data that may be retained on a copier hard drive, and what to do with a hard drive when you return a leased copier or dispose of one you own.

It’s wise to build in data security for each stage of your digital copier’s life-cycle: when you plan to acquire a device, when you buy or lease, while you use it, and when you turn it in or dispose of it.

Before you acquire a copier
Make sure it's included in your organization’s information security policies. Copiers should be managed and maintained by your organization’s IT staff. Employees who have expertise and responsibility for securing your computers and servers also should have responsibility for securing data stored on your digital copiers.

When you buy or lease a copier
Evaluate your options for securing the data on the device. Most manufacturers offer data security features with their copiers, either as standard equipment or as optional add-on kits. Typically, these features involve encryption and overwriting.

Depending on the copier, the overwriting feature may allow a user to overwrite after every job run, periodically to clean out the memory, or on a preset schedule. Users may be able to set the number of times data is overwritten — generally, the more times the data is overwritten, the safer it is from being retrieved. However, for speed and convenience, some printers let you save documents (for example, a personnel leave slip) and print them straight from the printer hard drive without having to retrieve the file from your computer. For copiers that offer this feature, the memory is not overwritten with the rest of the memory. Users should be aware that these documents are still available.

Overwriting is different from deleting or reformatting. Deleting data or reformatting the hard drive doesn’t actually alter or remove the data, but rather alters how the hard drive finds the data and combines it to make files: The data remains and may be recovered through a variety of utility software programs.

Yet another layer of security that can be added involves the ability to lock the hard drives using a passcode; this means that the data is protected, even if the drive is removed from the machine.

Finally, think ahead to how you will dispose of the data that accumulates on the copier over time. Check that your lease contract or purchase agreement states that your company will retain ownership of all hard drives at end-of-life, or that the company providing the copier will overwrite the hard drive.

When you use the copier
Take advantage of all its security features. Securely overwrite the entire hard drive at least once a month.

If your current device doesn’t have security features, think about how you will integrate the next device you lease or purchase into your information security plans. Plan now for how you will dispose of the copier securely. For example, you may want to consider placing a sticker or placard on the machine that says: “Warning: this copier uses a hard drive that must be physically destroyed before turn-in or disposal.” This will inform users of the security issues, and remind them of the appropriate procedures when the machine reaches the end of its usable life.

In addition, your organization’s IT staff should make sure digital copiers connected to your network are securely integrated. Just like computers and servers that store sensitive information, networked copiers should be protected against outside intrusions and attacks.

When you finish using the copier
Check with the manufacturer, dealer, or servicing company for options on securing the hard drive. The company may offer services that will remove the hard drive and return it to you, so you can keep it, dispose of it, or destroy it yourself. Others may overwrite the hard drive for you. Typically, these services involve an additional fee, though you may be able to negotiate for a lower cost if you are leasing or buying a new machine.