Bank Not Responsible for Letting Hackers Steal $300K From Customer

http://www.wired.com/threatlevel/2011/06/bank-ach-theft/

by locopati • 15 years ago

93 87 15 years ago

ck22• 15 years ago

ACH is still stuck in the 1970's (along with banking mentality).

You should definitely be able to whitelist and blacklist ACH transactions on your bank account but nope, anyone can just take the magic digits off the bottom off any one of your checks and help themselves.

But why the heck doesn't a bank have software that sets off alerts when more than $100k is drawn from an account, even $10k transactions have to be reported to the government, so why not also notify the customer and bank management?

Also, why in 2011 does it take 5 days officially to clear ACH?

raganwald2• 15 years ago

According to the OP, the transfers did set off alarms in the bank, but the bank chose to ignore them.

zacharycohn• 15 years ago

I don't think they CHOSE to ignore them, it was more that their response was not the best. (It trigger challenge/response questions versus the better option of a manual review)

dminor2• 15 years ago

Most banks do have something in place for whitelisting transfers, but adding new recipients is often protected by the same regime that the Zeus bot controllers have already broken.

kevinpet• 15 years ago

It takes 5 days to clear ACH because "hey we took this money, you have 5 days to let us know if that's okay" is the authentication.

ck22• 15 years ago

Except when you transfer money into paypal, they make you wait 5 days but I see the bank clear the money in 24-48 hours

crikli2• 15 years ago

I'm ambivalent about this one.

On one hand, I hate banks. They treated me like shit when I was penniless, now that I have a couple to rub together they won't let me cash a check without trying to suck-up their way into some new type of account. Ocean Bank failed to protect their customer's money; I don't to see the difference between the FDIC protection afforded depositors in case of physical robbery and the protection that depositors should have from digital robbery.

On the other hand, there's no law, case or otherwise, that makes the bank specifically liable. So the judge has no basis on which to hold the bank accountable.

They "should" be liable, but it's an ethics issue, not a legality issue. I'm not about to expect a bank to be ethical.

This kind of thing makes me thankful for Wells Fargo. Their fraud/theft detection system is tops and has saved us from fraudulent charges in at least two instances.

ktsmith• 15 years ago

The article states that the banks automated systems were triggered for suspicious activity and the bank ignored them. One would think that at the very least that would make the bank negligent. Of course there is probably more to it than that.

cheez• 15 years ago

> They treated me like shit when I was penniless, now that I have a couple to rub together they won't let me cash a check without trying to suck-up their way into some new type of account.

Haha, I thought it was just me. "Why are you people being so nice to me all of a sudden???"

With regards to the article, I think that they ignored the alarms is important. I once took out $5K cash for a transaction where I had to show some money and an internal this-is-not-normal alarm went off. While it was an inconvenience, I'm glad that the bank did not let me walk out with the money without checking up on me. So I think that the bank from the article was very irresponsible.

I hope that the soon-to-be-ex-customer of the bank publicizes this issue with the media even more. This is the only check on their carelessness.

crikli2• 15 years ago

> I once took out $5K cash for a transaction where I had to show some money and an internal this-is-not-normal alarm went off. While it was an inconvenience, I'm glad that the bank did not let me walk out with the money without checking up on me. So I think that the bank from the article was very irresponsible.

I agree 100%; I know it can be done because I've had similar experiences with WF. We have been traveling and I've gotten phone calls from them within 5 minutes of a transaction saying, "hey, we just want to make sure this is legit."

The fact that they ignored the alarms is important and I agree, negligent. But it doesn't look like it was enough for the judge to find them liable and more importantly, make it stick and not get flipped on appeal.

yangez• 15 years ago

In this case the "physical robbery" parallel would be losing your key to a safety deposit box, and then suing the bank when your stuff is stolen. Don't get me wrong, I don't love banks either, but here the bank's security didn't get compromised.

Kadrith• 15 years ago

I think it may be more like, you lost your key and the person finding it went to the bank. While there they presented ID, per the banks normal process, and even though the presented ID was suspicious the bank allowed the transaction to continue.

dminor2• 15 years ago

Of course (most) banks don't look very hard for suspicious money transfers - they don't share much of the risk if a business account is hacked.

utefan0012• 15 years ago

US banks need 2 factor authentication. Do any banks on the east coast offer this?

raganwald2• 15 years ago

INAL, but in dealing with some banking software, the situation was explained to me as "Devil take the hindmost." In other words, no bank wants to be the one that implements the worst security, or security that is dramatically worse than "average," whatever that might be.

So for example if all the banks offer four digit PINs, there's not much need to offer six, eight, or ten digit PINs. But if a sufficiently large number of banks start offering ten digit PINs, no bank wants to be left behind, because at some point a customer will sue them and claim that they knowingly have lower standards.

This is purely anecdotal, but this is how it was explained to me when the product managers for a new product were trying to balance ease of use and accessibility against strength of security.

russell• 15 years ago

IANAL, but I would suspect that the construction company has a mediocre/inexperienced lawyer. Maybe this could be covered by check forgery statutes or something that works by analogy. Back in the last century a friend of mine won a case in CA where he was actually negligent himself. He was remoddeling his house and set up an account that the contractor could draw on. The contractor took the money and ran. My friend sued the bank for negligence. He won because the contractor had pulled the same scam before at the same bank.

Maybe this guy sued in the wrong court. US District court vs Maine state court.

AJ007• 15 years ago

This is very common. By law, a bank is not responsible for theft from commercial bank accounts. Personal accounts however, are protected.

From what I've seen based on other cases:

#1. Never use a small/local bank. These guys are the worst and have generally pathetic or rarely enforced security policies in place.

#2. Do your banking off a boot disk if your not certain about your system's integrity. (Why are you using a questionable machine in the first place is a whole other story.)

#3. Try to avoid letting your business checking account get unnecessarily fat.

The fact is banks lose money. Going back to #1, most of the at risk banks in the United States are the small local ones (The FDIC is still regularly seizing banks.) Forget hackers, you could very well have $300k "stolen" out of your bank account if the FDIC shuts your bank down one Friday afternoon.

If you want to read more about this, I'd recommend krebsonsecurity.com. Brian Krebs has done a great job of covering this issue for quite some time -- in fact he has his own opinion of this court case written up now.

utefan0012• 15 years ago

#4 Don't trust Florida based companies. Words to live by!

http://www.oceanbank.com/contact-us.html

keltex• 15 years ago

Clark Howard (the consumer radio personality) recommends that businesses use a separate computer for all bank related transactions. And that computer isn't used for email or other web access.

You should also contact your bank and request double or dual authentication on any wires. If your bank doesn't offer this, then get a different bank.

http://www.clarkhoward.com/news/clarkhoward/business-entrepr...

chriserin5• 15 years ago

And the convenience of online banking just lost all of its convenience. I'd rather just drive to the bank to conduct all transfers... seems safer.

run4yourlives12• 15 years ago

You could probably just use a bank that utilizes tokens or some other two factor authentication.

cbr• 15 years ago

> you could very well have $300k "stolen" out of your bank account if the FDIC shuts your bank down one Friday

I thought that was the whole point of the FDIC? That we don't lose our bank account contents if our bank dies.

william42• 15 years ago

The FDIC only protects your bank account up to a certain limit.

tptacek15• 15 years ago

Is it not that simple. Commercial accounts do not have the same protections as personal accounts, but under UCC § 4A-202:

[... presuming a relationship between customer and bank, then..] a payment order received by the receiving bank is effective as the order of the customer, whether or not authorized, if (i) the security procedure is a commercially reasonable method of providing security against unauthorized payment orders [... so long as the bank is acting in good faith.]

And then, in the very next clause:

(c) Commercial reasonableness of a security procedure is a question of law to be determined by considering the wishes of the customer expressed to the bank, the circumstances of the customer known to the bank, including the size, type, and frequency of payment orders normally issued by the customer to the bank, alternative security procedures offered to the customer, and security procedures in general use by customers and receiving banks similarly situated.

The stuff this bank didn't do that it was supposed to do appears to be spelled out directly in the UCC, but the bank got off because the court chose to find a fine-print clause that waived these rules enforceable.

mediasavvy• 15 years ago

Clearly the bank's customer has some responsibility here.

But it's not clear that the bank gave its customers the backup they needed in the event that an account is compromised. And accounts will be compromised.

Only the bank can improve the security of large electronic transactions. And if the bank is not held responsible, they have no incentive to do so.

chriserin5• 15 years ago

Bank customers that hear about this have an incentive to change banks though.

run4yourlives12• 15 years ago

If you actually RTFA, it was the client that was hacked, not the bank. The client's passwords were compromised, and then the bank's services were accessed normally with the compromised passwords.

The client's logic is that the bank should take the loss for this. I know we all hate the banks but seriously? You get hacked and suddenly the service I provide to you being compromised is my fault?

Sorry, the judge is right here.

enjo• 15 years ago

Maybe banks should be responsible for stronger protection than a simple password?

run4yourlives12• 15 years ago

Maybe, but if you're okay with that when you do business with them, you can't exactly complain about it when things go wrong.

rick888• 15 years ago

If I shot you, would it be your fault because you weren't wearing a bullet-proof vest?

chriserin5• 15 years ago

Along those same lines, if a hacker took advantage of a vulnerability in the banks application, but only after gaining access to that vulnerability through credentials stolen from a client/customer, is the client responsible for weak credentials protection in that instance as well?

This is a slippery slope.

tptacek15• 15 years ago

A bank is in a better position to protect electronic access to the account than the consumer is. This bank provides simple username/password authentication to an Internet service that allows transfers of hundreds of thousands of dollars at a time to entities that a business has never worked with in the past. Offering that service with that level of protection without assuming any liability for the result is borderline negligent.

Macha2• 15 years ago

So? Linode is in a better position to prevent misuse of my VPS than I am. They can cut it off from the network and they have staff which would notice if it suddenly sent 40,000 emails. Does that make them liable if my server gets rooted because of software I install (say Apache 1.3.1 or something) and whoever rooted it installed a mail server on it to send spam from?

run4yourlives12• 15 years ago

There is nothing that the bank was doing that was so far from the normal practice of securing a website that constitutes negligence. They were even following a published standard.

It's unreasonable to expect the bank to be so overly concerned with their customer's security and excuse the business for not being so with their own.

atakan_gurkan• 15 years ago

Bruce Scheiner said this many many times: it is the transactions that needs to be authenticated, not the client. This is what credit card companies do (sometimes overzealously). The transactions mentioned in the article sound very unusual, a trivial authentication mechanism would have caught them.

The judge is right, since he rules by looking at current laws, but the current laws themselves seem out of date.

trotsky• 15 years ago

If my credit card company can manage to shut down my credit card and not reinstate it until they talk to me because I make $300 worth of charges on vacation, it should be reasonable to expect a bank to provide that kind of anti fraud protection on commercial accounts. The difference is who is liable - if the banks were liable like they are with credit cards they'd certainly be much more diligent.

Banks, after all, pushed online banking with minimal client protections because it was cheaper than paying staff.

The risks may have been minimal when online banking rolled out, but the world has changed significantly in the last five years. The client is not secure, and it is borderline unreasonable to expect them all to be in this day and age. Pretty much any client machine will fall to a persistent targeted attack. Two factor authentication should be mandatory for electronic transfers outside of the institution.

run4yourlives12• 15 years ago

With Credit Cards, the end merchant is liable, not the bank, which is why they have no issue with stop payments and such.

In this case, the plaintiff is asking the bank to assume liability because he got hacked. That's a bit of a stretch.

chriserin5• 15 years ago

Why is it a stretch? The bank is liable for funds stolen through a bank robbery, a much more aggressive criminal action. Why is the bank supposed to protect your funds in one instance but not another?

jonprins• 15 years ago

It's kind of crazy. I know that my battle.net account is more secure than a lot of people's online banking credentials: not only do I need a user name and password to access my bnet account, but my account is linked with a mobile app that gives me time-sensitive one-time-use 8-10 security code.

Recently I had to wipe my phone without being able to get the serial number information from the bnet app. It was kind of a pain, but I had to actually scan and send in an image of my drivers license for them to release the old authenticator from my account so I could attach a new one.

Think about that. An online gaming company is more secure about account authorization than a lot of banks are.

seabee• 15 years ago

The law doesn't care about their game's fictional currency. They have more incentive to protect it than a bank has to keep real money as secure as possible.

mahyarm• 15 years ago

Chase is similar. Username and password, and to login from a new device (web, iphone app, etc) requires putting in a time-sensitive code sent to your phone by SMS or email. An actual dedicated mobile app is somewhat a bad design since many people do not have smart phones and it makes it client dependent vs. account dependent.

dlikhten2• 15 years ago

There are things that are baseline law and things that are above-and-beyond. Statistical analysis on usage patterns of your account appear to be above-and-beyond.

Your bank (a decent bank presumably) obviously gives a shit about this because they want customer loyalty which comes with not getting identity stolen and they don't want to pay up. However that is not the law.

There is no industry wide law that requires statistical analysis on financial transactions as a anti-fraud methodology. Frankly this bank may get hit with people pulling business from them because they don't protect their clients, but that is another story.

ImJasonH• 15 years ago

Mitchell and Webb have a great bit on this: http://www.youtube.com/watch?v=CS9ptA3Ya9E

lawnchair_larry• 15 years ago

It's the bank's fault simply because this system has been broken for at least a decade, they know damn well it is broken, but they don't make as much profit if they invest in fixing it.

This won't change until it becomes more expensive for them to leave it unfixed - either by market forces, or by regulation.

bugsy• 15 years ago

This was a bank robbery, and the customer is just out the loss for money taken from the bank? That's a novel legal argument.

oasisbob2• 15 years ago

Some background: unlike PCI, which has very large specs for how to protect cardholder data, banks have very little mandated requirements for protecting online banking.

Really the only guidance they've received is the document "Authentication in an Internet Banking Environment", released by the FFIEC in 2005. [1]

The mandate boils down to: "Financial institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services. The authentication techniques employed by the financial institution should be appropriate to the risks associated with those products and services."

So, if a FI provides basic personal online banking -- with no money transfer abilities -- perhaps a username/password pair combined with pretend-MFA ("What's your favorite secret color?") is appropriate.

If you allow your customers to originate ACH or wire transfers, it's simply negligent to not provide true MFA, and their auditors should have caught this earlier.

[1] http://www.ffiec.gov/pdf/authentication_guidance.pdf

Derbasti• 15 years ago

Banks in Germany are required to use two-step authentification and one-time passwords for money transfers. Measures like this would have prevented that 'hack'.

I actually lived in the US for a while and the so called security of American banks was completely incredible to me. It is true, Steam, Battle.net and Google accounts are significantly better protcted than the US bank accounts I had access to.

danneu• 15 years ago

I actually find this ruling fair.

FTA: "But [the judge] nonetheless concluded that the law does not require the bank to implement the “best” security measures available and that the bank is clear to customers when they sign up about the level of security it provides and the amount of liability it will assume if money is stolen from a customer account."

Bank Not Responsible for Letting Hackers Steal $300K From Customer

Related Stories