Courtesy of the American Bankers Association
Corporate account takeover is a type of fraud where thieves steal business’ valid online banking credentials or hijack browser sessions to access a customer’s account. Once the cyber thief gains access to an account, they can conduct unauthorized transactions, including transferring funds from the company, creating and adding fake employees to payroll, stealing sensitive customer information that may not be recoverable, changing contact information, and gathering information on the account’s history to commit other crimes.
In the beginning, banks were targeted for this fraud; however, as banks have strengthened their security, the cyber thieves set their sights on a new target: the corporate customer. Cyber thieves target employees and businesses of all sizes through phishing and other social engineering attacks with the goal of enticing them to download and spread malicious viruses.
Corporate account takeover is a growing threat for small businesses. In 2011, 72 percent of data breach cases affected businesses with 100 employees or less. It is important that businesses understand and prepare for this risk. Use these tips from the American Bankers Association to avoid corporate account takeover:
1. Beware of phishing and malware. Cyber thieves target employees through phishing, phone calls, and even social networks. It is common for thieves to send emails posing as a bank, delivery company, court or the Better Business Bureau. Once the email is opened, malware is loaded on the computer which then records login credentials and passcodes and reports them back to the criminals.
2. Educate your employees. You and your employees are the first line of defense against corporate account takeover. A strong security program paired with employee education about the warning signs, safe practices, and responses to a suspected takeover are essential to protecting your company and customers. Ninety two percent of respondents to a recent survey indicated employee education of small business employees was effective in reducing the threat of account takeover. However, nearly 80 percent of respondents to a small business survey said they had no formal internet security policy, with almost half indicating they provide no internet safety training to employees3.
3. Partner with your bank to prevent unauthorized transactions. The best way to protect against corporate account takeover is a strong partnership with your financial institution. Work with your bank to understand security measures needed within the business and to establish safeguards on the accounts that can help the bank identify and prevent unauthorized access to your funds. Talk to your banker about programs that safeguard you from unauthorized transactions. Positive Pay and other services offer call backs, device authentication, multi-person approval processes and batch limits help protect you from fraud.
4. Protect your online environment. It is important to protect your cyber environment just as you would your cash and physical location. Do not use unprotected internet connections. Encrypt sensitive data and keep updated virus protections on your computer. Use complex passwords and change them periodically.
5. Pay attention to suspicious activity and react quickly. Look out for unexplained account or network activity, pop ups and suspicious emails. If detected, immediately contact your financial institution, stop all online activity and remove any systems that may have been compromised. Keep records of what happened.
6. Understand your responsibilities and liabilities. The account agreement with your bank will detail what commercially reasonable security measures are required in your business. It is critical that you understand and implement the security safeguards in the agreement. If you don’t, you could be liable for losses resulting from a takeover. Talk to your banker if you have any questions about your responsibilities.
For more information, visit the ABA’s Internet Security site for publications related to phishing, identity theft and more or review the ABA’s Small Business Guide to Corporate Account Takeover.