Corporate Account Take-Over (“CATO”)
What is it?
Corporate Account Takeover is when cyber-thieves gain control of a company’s bank account by stealing the valid online banking credentials. Although there are several methods being employed to steal credentials, the most prevalent involves malware that infects the computer workstations and laptops.
A business can become infected with malware via infected documents attached to an e-mail or a link contained within an e-mail that connects to an infected web site. In addition, malware can be downloaded to users’ workstations and laptops by visiting legitimate websites – especially social networking sites – and clicking on the documents, videos or photos posted there. This malware can also spread across a company’s internal network.
The malware installs key logging software on the computer, which allows the perpetrator to capture a user’s credentials as they are entered at the financial institution’s web site. Sophisticated versions of this malware can even capture token‐generated passwords, alter the display of the financial institution’s web site to the user, and/or display a fake web page indicating that the financial institution’s web site is down. In this last case, the perpetrator can access the company’s account online without the possibility that the real user will log in to the web site.
Once installed, the malware provides the information that enables the cyber-thieves to impersonate the business in online banking sessions. To the financial institution, the credentials look just like the legitimate user. The perpetrator has access to and can review the account details of the business, including account activity and patterns, and ACH and wire transfer origination parameters (such as file size and frequency limits, and Standard Entry Class [SEC] Codes).
The cyber-thieves use the sessions to initiate funds transfers, by ACH or wire transfer, to the bank accounts of associates within the U.S. These accounts may be newly opened by accomplices or unwitting “money mules” for the express purpose of receiving and laundering these funds. The accomplices or mules withdraw the entire balances shortly after receiving the money, and then send the funds overseas via over-the-counter wire transfer or other common money transfer services.
Why are smaller businesses targeted?
The cyber-thieves appear to be targeting small- to medium-sized businesses, as well as smaller government agencies and nonprofits, for several reasons:
- Many small businesses and organizations have the capability to initiate funds transfers – ACH credits and wire transfers – via online banking (individual consumers generally do not have this capability except for payees set up in online bill payment systems)
- Small businesses often do not have the same level of resources as larger companies to defend their information technology systems
- Many small businesses do not utilize additional banking services, such as password-generating tokens, and do not monitor and reconcile their accounts on a frequent or daily basis
- Small businesses bank with a wide variety of financial institutions with varying degrees of IT resources and sophistication
- Some financial institutions may not offer or require services that would defend against corporate account takeover
Computer Security Tools and Practices
- Install a dedicated, actively managed firewall. A firewall limits the potential for unauthorized access to a network and computers.
- Install commercial anti-virus software on all computer systems.
- Ensure virus protection and security software are updated regularly.
- Ensure computers are patched regularly, particularly operating system and key applications, with security patches.
- Consider installing spyware detection programs.
- Be suspicious of e-mails purporting to be from a financial institution, government department or other agency requesting account information, account verification or banking access credentials such as usernames, passwords, PIN codes and similar information. If you are not certain of the source, do not click any links.
- Create strong passwords with at least 12 characters that include a combination of mixed case letters, numbers and special characters.
- Prohibit the use of “shared” usernames and passwords for online banking systems.
- Use a different password for each website that is accessed.
- Change the password several times each year.
- Never share username and password information with third-party providers.
- Limit administrative rights on users’ workstations.
- Carry out all online banking activities from a stand-alone computer system from which e-mail and Web browsing are not possible.
- Verify use of a secure session (“https”) in the browser for all online banking.
- Avoid using an automatic login features that save usernames and passwords for online banking.
- Never leave a computer unattended while using any online banking or investing service.
- Never access bank, brokerage or other financial services information at Internet cafes, public libraries, etc. Unauthorized software may have been installed to trap account number and sign on information leaving the customer vulnerable to possible fraud.
- Clear your browser cache in order to eliminate copies of web pages that have been stored on your hard drive.
Note any changes in the performance of your computer such as:
- A dramatic loss of speed.
- Changes in the way things appear.
- Computer locks up so the user is unable to perform any functions.
- Unexpected rebooting or restarting of your computer.
- An unexpected request for a one time password (or token) in the middle of an online session.
- Unusual pop-up messages.
- New or unexpected toolbars and/or icons.
- Inability to shut down or restart.
Employee Education is Essential, but is Missing the Mark
Ninety two percent of respondents to a recent survey indicated employee education of small business employees was effective in reducing the threat of account takeover. However, nearly 80 percent of respondents to a small business survey said they had no formal internet security policy, with almost half indicating they provide no internet safety training to employees.
How do I protect myself and my small business?
The best way to protect against corporate account takeover is a strong partnership with your financial institution. Work with your bank to understand security measures needed within the business and to establish safeguards on the accounts that can help the bank identify and prevent unauthorized access to your funds.
A shared responsibility between the bank and the business is the most effective way to prevent corporate account takeover. Consider these tips to ensure your business is well prepared:
- Educate your employees. You and your employees are the first line of defense against corporate account takeover. A strong security program paired with employee education about the warning signs, safe practices, and responses to a suspected takeover are essential to protecting your company and customers.
- Protect your online environment. It is important to protect your cyber environment just as you would your cash and physical location. Do not use unprotected internet connections. Encrypt sensitive data and keep updated virus protections on your computer. Use complex passwords and change them periodically.
- Partner with your bank to prevent unauthorized transactions. Talk to your banker about programs that safeguard you from unauthorized transactions. Positive Pay and other services offer call backs, device authentication, multi-person approval processes and batch limits help protect you from fraud.
- Pay attention to suspicious activity and react quickly. Look out for unexplained account or network activity, pop ups, and suspicious emails. If detected, immediately contact your financial institution, stop all online activity and remove any systems that may have been compromised. Keep records of what happened.
- Understand your responsibilities and liabilities. The account agreement with your bank will detail what commercially reasonable security measures are required in your business. It is critical that you understand and implement the security safeguards in the agreement. If you don’t, you could be liable for losses resulting from a takeover. Talk to your banker if you have any questions about your responsibilities.
Recommendations for Victims
- Immediately cease all activity from computer systems that may be compromised. Disconnect the internet or other network connections to isolate the system from remote access.
- Immediately contact your financial institution so that they can disable online access to accounts, change online banking passwords, open new account(s) as appropriate, request the financial institution’s agent review all recent transactions and electronic authorizations on the account, and ensure that no one has requested an address change, title change, PIN change or ordered new cards, checks or other account documents be sent to another address.
- Maintain a written chronology of what happened, what was lost and the steps taken to report the incident to the various agencies, banks and firms impacted. Be sure to record the date, time, contact telephone number, person spoken to, and any relevant report or reference number and instructions.
- File a police report and provide the facts and circumstances surrounding the loss. Obtain a police report number with the date, time, department, location and officer’s name taking the report or involved in the subsequent investigation. Having a police report on file will often facilitate dealing with insurance companies, banks, and other establishments that may be the recipient of fraudulent activity. The police report may initiate a law enforcement investigation into the loss with the goal of identifying, arresting and prosecuting the offender and possibly recovering losses.
This document is for information purposes and is not intended to provide legal advice.
The guidance included is not an exhaustive list of actions, and security threats change constantly.
For more information:
Contact your Vantage Bank Texas Treasury Management Department