16 ms·

Bank Not Responsible for Letting Hackers Steal $300K From Customer

93 points by locopati 15y ago

ck2 15y ago
ACH is still stuck in the 1970's (along with banking mentality). You should definitely be able to whitelist and blacklist ACH transactions on your bank account but nope, anyone can just take the magic digits off the bottom off any one of your checks and help themselves. But why the heck doesn't a bank have software that sets off alerts when more than $100k is drawn from an account, even $10k transactions have to be reported to the government, so why not also notify the customer and bank management? Also, why in 2011 does it take 5 days officially to clear ACH?
- raganwald 15y ago
  According to the OP, the transfers did set off alarms in the bank, but the bank chose to ignore them.
  - zacharycohn 15y ago
    I don't think they CHOSE to ignore them, it was more that their response was not the best. (It trigger challenge/response questions versus the better option of a manual review)
- dminor 15y ago
  Most banks do have something in place for whitelisting transfers, but adding new recipients is often protected by the same regime that the Zeus bot controllers have already broken.
- kevinpet 15y ago
  It takes 5 days to clear ACH because "hey we took this money, you have 5 days to let us know if that's okay" is the authentication.
  - ck2 15y ago
    Except when you transfer money into paypal, they make you wait 5 days but I see the bank clear the money in 24-48 hours
crikli 15y ago
I'm ambivalent about this one. On one hand, I hate banks. They treated me like shit when I was penniless, now that I have a couple to rub together they won't let me cash a check without trying to suck-up their way into some new type of account. Ocean Bank failed to protect their customer's money; I don't to see the difference between the FDIC protection afforded depositors in case of physical robbery and the protection that depositors should have from digital robbery. On the other hand, there's no law, case or otherwise, that makes the bank specifically liable. So the judge has no basis on which to hold the bank accountable. They "should" be liable, but it's an ethics issue, not a legality issue. I'm not about to expect a bank to be ethical. This kind of thing makes me thankful for Wells Fargo. Their fraud/theft detection system is tops and has saved us from fraudulent charges in at least two instances.
- ktsmith 15y ago
  The article states that the banks automated systems were triggered for suspicious activity and the bank ignored them. One would think that at the very least that would make the bank negligent. Of course there is probably more to it than that.
- cheez 15y ago
  > They treated me like shit when I was penniless, now that I have a couple to rub together they won't let me cash a check without trying to suck-up their way into some new type of account. Haha, I thought it was just me. "Why are you people being so nice to me all of a sudden???" With regards to the article, I think that they ignored the alarms is important. I once took out $5K cash for a transaction where I had to show some money and an internal this-is-not-normal alarm went off. While it was an inconvenience, I'm glad that the bank did not let me walk out with the money without checking up on me. So I think that the bank from the article was very irresponsible. I hope that the soon-to-be-ex-customer of the bank publicizes this issue with the media even more. This is the only check on their carelessness.
  - crikli 15y ago
    > I once took out $5K cash for a transaction where I had to show some money and an internal this-is-not-normal alarm went off. While it was an inconvenience, I'm glad that the bank did not let me walk out with the money without checking up on me. So I think that the bank from the article was very irresponsible. I agree 100%; I know it can be done because I've had similar experiences with WF. We have been traveling and I've gotten phone calls from them within 5 minutes of a transaction saying, "hey, we just want to make sure this is legit." The fact that they ignored the alarms is important and I agree, negligent. But it doesn't look like it was enough for the judge to find them liable and more importantly, make it stick and not get flipped on appeal.
dminor 15y ago
Of course (most) banks don't look very hard for suspicious money transfers - they don't share much of the risk if a business account is hacked.
utefan001 15y ago
US banks need 2 factor authentication. Do any banks on the east coast offer this?
- deleted 15y ago
  [deleted]
- gte910h 15y ago
  RBC does, but they use the RSA SecureID thingy that's been in some form compromised in American defense contractors.
raganwald 15y ago
INAL, but in dealing with some banking software, the situation was explained to me as "Devil take the hindmost." In other words, no bank wants to be the one that implements the worst security, or security that is dramatically worse than "average," whatever that might be. So for example if all the banks offer four digit PINs, there's not much need to offer six, eight, or ten digit PINs. But if a sufficiently large number of banks start offering ten digit PINs, no bank wants to be left behind, because at some point a customer will sue them and claim that they knowingly have lower standards. This is purely anecdotal, but this is how it was explained to me when the product managers for a new product were trying to balance ease of use and accessibility against strength of security.
russell 15y ago
IANAL, but I would suspect that the construction company has a mediocre/inexperienced lawyer. Maybe this could be covered by check forgery statutes or something that works by analogy. Back in the last century a friend of mine won a case in CA where he was actually negligent himself. He was remoddeling his house and set up an account that the contractor could draw on. The contractor took the money and ran. My friend sued the bank for negligence. He won because the contractor had pulled the same scam before at the same bank. Maybe this guy sued in the wrong court. US District court vs Maine state court.
AJ007 15y ago
This is very common. By law, a bank is not responsible for theft from commercial bank accounts. Personal accounts however, are protected. From what I've seen based on other cases: #1. Never use a small/local bank. These guys are the worst and have generally pathetic or rarely enforced security policies in place. #2. Do your banking off a boot disk if your not certain about your system's integrity. (Why are you using a questionable machine in the first place is a whole other story.) #3. Try to avoid letting your business checking account get unnecessarily fat. The fact is banks lose money. Going back to #1, most of the at risk banks in the United States are the small local ones (The FDIC is still regularly seizing banks.) Forget hackers, you could very well have $300k "stolen" out of your bank account if the FDIC shuts your bank down one Friday afternoon. If you want to read more about this, I'd recommend krebsonsecurity.com. Brian Krebs has done a great job of covering this issue for quite some time -- in fact he has his own opinion of this court case written up now.
- utefan001 15y ago
  #4 Don't trust Florida based companies. Words to live by! http://www.oceanbank.com/contact-us.html http://www.oceanbank.com/contact-us.html
- keltex 15y ago
  Clark Howard (the consumer radio personality) recommends that businesses use a separate computer for all bank related transactions. And that computer isn't used for email or other web access. You should also contact your bank and request double or dual authentication on any wires. If your bank doesn't offer this, then get a different bank. http://www.clarkhoward.com/news/clarkhoward/business-entrepreneurs/simple-computer-safeguards-for-small-business/nFD8/ http://www.clarkhoward.com/news/clarkhoward/business-entrepr...
  - chriserin 15y ago
    And the convenience of online banking just lost all of its convenience. I'd rather just drive to the bank to conduct all transfers... seems safer.
mediasavvy 15y ago
Clearly the bank's customer has some responsibility here. But it's not clear that the bank gave its customers the backup they needed in the event that an account is compromised. And accounts will be compromised. Only the bank can improve the security of large electronic transactions. And if the bank is not held responsible, they have no incentive to do so.
- chriserin 15y ago
  Bank customers that hear about this have an incentive to change banks though.
run4yourlives 15y ago
If you actually RTFA, it was the client that was hacked, not the bank. The client's passwords were compromised, and then the bank's services were accessed normally with the compromised passwords. The client's logic is that the bank should take the loss for this. I know we all hate the banks but seriously? You get hacked and suddenly the service I provide to you being compromised is my fault? Sorry, the judge is right here.
- enjo 15y ago
  Maybe banks should be responsible for stronger protection than a simple password?
  - run4yourlives 15y ago
    Maybe, but if you're okay with that when you do business with them, you can't exactly complain about it when things go wrong.
    - lukeschlather 15y ago
      Expecting people who know nothing about security to make an informed decision is unreasonable. It's much like expecting people to choose a building that won't fall over in an earthquake when they aren't architects - the responsibility lies with the architect for claiming that the security is good enough, not with the customer for trusting the expert.
      - run4yourlives 15y ago
        ? You're suggesting that if I place a lock on your door, and you and I both agree that it is adequate, that it is my fault that you lose your keys and have your TV stolen because I should have known that a lock is not good enough and you should have had an alarm system as well.... Seriously, have some bit of personal responsibility.
        tptacek 15y ago
trotsky 15y ago
If my credit card company can manage to shut down my credit card and not reinstate it until they talk to me because I make $300 worth of charges on vacation, it should be reasonable to expect a bank to provide that kind of anti fraud protection on commercial accounts. The difference is who is liable - if the banks were liable like they are with credit cards they'd certainly be much more diligent. Banks, after all, pushed online banking with minimal client protections because it was cheaper than paying staff. The risks may have been minimal when online banking rolled out, but the world has changed significantly in the last five years. The client is not secure, and it is borderline unreasonable to expect them all to be in this day and age. Pretty much any client machine will fall to a persistent targeted attack. Two factor authentication should be mandatory for electronic transfers outside of the institution.
- run4yourlives 15y ago
  With Credit Cards, the end merchant is liable, not the bank, which is why they have no issue with stop payments and such. In this case, the plaintiff is asking the bank to assume liability because he got hacked. That's a bit of a stretch.
  - chriserin 15y ago
    Why is it a stretch? The bank is liable for funds stolen through a bank robbery, a much more aggressive criminal action. Why is the bank supposed to protect your funds in one instance but not another?
    - Macha 15y ago
      Because one happens because the bank didn't secure their vault enough and one happens because the client didn't secure their computers enough.
    - run4yourlives 15y ago
      There is a difference in the fact that the bank is fully aware that the robbery is not a normal transaction. The bank cannot be expected to be aware of normal transactions conducted with a fraudulent intent. Assuming they take some precautions (like they do if the suddenly see 15 quick purchases from Russia when you live in Oregon), there's only so much liability they can be expected to shoulder.
ImJasonH 15y ago
Mitchell and Webb have a great bit on this: http://www.youtube.com/watch?v=CS9ptA3Ya9E http://www.youtube.com/watch?v=CS9ptA3Ya9E
lawnchair_larry 15y ago
It's the bank's fault simply because this system has been broken for at least a decade, they know damn well it is broken, but they don't make as much profit if they invest in fixing it. This won't change until it becomes more expensive for them to leave it unfixed - either by market forces, or by regulation.
bugsy 15y ago
This was a bank robbery, and the customer is just out the loss for money taken from the bank? That's a novel legal argument.
oasisbob 15y ago
Some background: unlike PCI, which has very large specs for how to protect cardholder data, banks have very little mandated requirements for protecting online banking. Really the only guidance they've received is the document "Authentication in an Internet Banking Environment", released by the FFIEC in 2005. [1] The mandate boils down to: "Financial institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services. The authentication techniques employed by the financial institution should be appropriate to the risks associated with those products and services." So, if a FI provides basic personal online banking -- with no money transfer abilities -- perhaps a username/password pair combined with pretend-MFA ("What's your favorite secret color?") is appropriate. If you allow your customers to originate ACH or wire transfers, it's simply negligent to not provide true MFA, and their auditors should have caught this earlier. [1] http://www.ffiec.gov/pdf/authentication_guidance.pdf http://www.ffiec.gov/pdf/authentication_guidance.pdf
Derbasti 15y ago
Banks in Germany are required to use two-step authentification and one-time passwords for money transfers. Measures like this would have prevented that 'hack'. I actually lived in the US for a while and the so called security of American banks was completely incredible to me. It is true, Steam, Battle.net and Google accounts are significantly better protcted than the US bank accounts I had access to.
danneu 15y ago
I actually find this ruling fair. FTA: "But [the judge] nonetheless concluded that the law does not require the bank to implement the “best” security measures available and that the bank is clear to customers when they sign up about the level of security it provides and the amount of liability it will assume if money is stolen from a customer account."
deleted 15y ago
[deleted]

93 points by locopati 15y ago

ck2 15y ago

ACH is still stuck in the 1970's (along with banking mentality). You should definitely be able to whitelist and blacklist ACH transactions on your bank account but nope, anyone can just take the magic digits off the bottom off any one of your checks and help themselves. But why the heck doesn't a bank have software that sets off alerts when more than $100k is drawn from an account, even $10k transactions have to be reported to the government, so why not also notify the customer and bank management? Also, why in 2011 does it take 5 days officially to clear ACH?

raganwald 15y ago
According to the OP, the transfers did set off alarms in the bank, but the bank chose to ignore them.
- zacharycohn 15y ago
  I don't think they CHOSE to ignore them, it was more that their response was not the best. (It trigger challenge/response questions versus the better option of a manual review)
dminor 15y ago
Most banks do have something in place for whitelisting transfers, but adding new recipients is often protected by the same regime that the Zeus bot controllers have already broken.
kevinpet 15y ago
It takes 5 days to clear ACH because "hey we took this money, you have 5 days to let us know if that's okay" is the authentication.
- ck2 15y ago
  Except when you transfer money into paypal, they make you wait 5 days but I see the bank clear the money in 24-48 hours

crikli 15y ago

I'm ambivalent about this one. On one hand, I hate banks. They treated me like shit when I was penniless, now that I have a couple to rub together they won't let me cash a check without trying to suck-up their way into some new type of account. Ocean Bank failed to protect their customer's money; I don't to see the difference between the FDIC protection afforded depositors in case of physical robbery and the protection that depositors should have from digital robbery. On the other hand, there's no law, case or otherwise, that makes the bank specifically liable. So the judge has no basis on which to hold the bank accountable. They "should" be liable, but it's an ethics issue, not a legality issue. I'm not about to expect a bank to be ethical. This kind of thing makes me thankful for Wells Fargo. Their fraud/theft detection system is tops and has saved us from fraudulent charges in at least two instances.

ktsmith 15y ago
The article states that the banks automated systems were triggered for suspicious activity and the bank ignored them. One would think that at the very least that would make the bank negligent. Of course there is probably more to it than that.
cheez 15y ago
> They treated me like shit when I was penniless, now that I have a couple to rub together they won't let me cash a check without trying to suck-up their way into some new type of account. Haha, I thought it was just me. "Why are you people being so nice to me all of a sudden???" With regards to the article, I think that they ignored the alarms is important. I once took out $5K cash for a transaction where I had to show some money and an internal this-is-not-normal alarm went off. While it was an inconvenience, I'm glad that the bank did not let me walk out with the money without checking up on me. So I think that the bank from the article was very irresponsible. I hope that the soon-to-be-ex-customer of the bank publicizes this issue with the media even more. This is the only check on their carelessness.
- crikli 15y ago
  > I once took out $5K cash for a transaction where I had to show some money and an internal this-is-not-normal alarm went off. While it was an inconvenience, I'm glad that the bank did not let me walk out with the money without checking up on me. So I think that the bank from the article was very irresponsible. I agree 100%; I know it can be done because I've had similar experiences with WF. We have been traveling and I've gotten phone calls from them within 5 minutes of a transaction saying, "hey, we just want to make sure this is legit." The fact that they ignored the alarms is important and I agree, negligent. But it doesn't look like it was enough for the judge to find them liable and more importantly, make it stick and not get flipped on appeal.

dminor 15y ago

Of course (most) banks don't look very hard for suspicious money transfers - they don't share much of the risk if a business account is hacked.

utefan001 15y ago

US banks need 2 factor authentication. Do any banks on the east coast offer this?

deleted 15y ago
[deleted]
gte910h 15y ago
RBC does, but they use the RSA SecureID thingy that's been in some form compromised in American defense contractors.

raganwald 15y ago

INAL, but in dealing with some banking software, the situation was explained to me as "Devil take the hindmost." In other words, no bank wants to be the one that implements the worst security, or security that is dramatically worse than "average," whatever that might be. So for example if all the banks offer four digit PINs, there's not much need to offer six, eight, or ten digit PINs. But if a sufficiently large number of banks start offering ten digit PINs, no bank wants to be left behind, because at some point a customer will sue them and claim that they knowingly have lower standards. This is purely anecdotal, but this is how it was explained to me when the product managers for a new product were trying to balance ease of use and accessibility against strength of security.

russell 15y ago

IANAL, but I would suspect that the construction company has a mediocre/inexperienced lawyer. Maybe this could be covered by check forgery statutes or something that works by analogy. Back in the last century a friend of mine won a case in CA where he was actually negligent himself. He was remoddeling his house and set up an account that the contractor could draw on. The contractor took the money and ran. My friend sued the bank for negligence. He won because the contractor had pulled the same scam before at the same bank. Maybe this guy sued in the wrong court. US District court vs Maine state court.

AJ007 15y ago

This is very common. By law, a bank is not responsible for theft from commercial bank accounts. Personal accounts however, are protected. From what I've seen based on other cases: #1. Never use a small/local bank. These guys are the worst and have generally pathetic or rarely enforced security policies in place. #2. Do your banking off a boot disk if your not certain about your system's integrity. (Why are you using a questionable machine in the first place is a whole other story.) #3. Try to avoid letting your business checking account get unnecessarily fat. The fact is banks lose money. Going back to #1, most of the at risk banks in the United States are the small local ones (The FDIC is still regularly seizing banks.) Forget hackers, you could very well have $300k "stolen" out of your bank account if the FDIC shuts your bank down one Friday afternoon. If you want to read more about this, I'd recommend krebsonsecurity.com. Brian Krebs has done a great job of covering this issue for quite some time -- in fact he has his own opinion of this court case written up now.

utefan001 15y ago
#4 Don't trust Florida based companies. Words to live by! http://www.oceanbank.com/contact-us.html http://www.oceanbank.com/contact-us.html
keltex 15y ago
Clark Howard (the consumer radio personality) recommends that businesses use a separate computer for all bank related transactions. And that computer isn't used for email or other web access. You should also contact your bank and request double or dual authentication on any wires. If your bank doesn't offer this, then get a different bank. http://www.clarkhoward.com/news/clarkhoward/business-entrepreneurs/simple-computer-safeguards-for-small-business/nFD8/ http://www.clarkhoward.com/news/clarkhoward/business-entrepr...
- chriserin 15y ago
  And the convenience of online banking just lost all of its convenience. I'd rather just drive to the bank to conduct all transfers... seems safer.

mediasavvy 15y ago

Clearly the bank's customer has some responsibility here. But it's not clear that the bank gave its customers the backup they needed in the event that an account is compromised. And accounts will be compromised. Only the bank can improve the security of large electronic transactions. And if the bank is not held responsible, they have no incentive to do so.

chriserin 15y ago
Bank customers that hear about this have an incentive to change banks though.

run4yourlives 15y ago

If you actually RTFA, it was the client that was hacked, not the bank. The client's passwords were compromised, and then the bank's services were accessed normally with the compromised passwords. The client's logic is that the bank should take the loss for this. I know we all hate the banks but seriously? You get hacked and suddenly the service I provide to you being compromised is my fault? Sorry, the judge is right here.

enjo 15y ago
Maybe banks should be responsible for stronger protection than a simple password?
- run4yourlives 15y ago
  Maybe, but if you're okay with that when you do business with them, you can't exactly complain about it when things go wrong.
  - lukeschlather 15y ago
    Expecting people who know nothing about security to make an informed decision is unreasonable. It's much like expecting people to choose a building that won't fall over in an earthquake when they aren't architects - the responsibility lies with the architect for claiming that the security is good enough, not with the customer for trusting the expert.
    - run4yourlives 15y ago
      ? You're suggesting that if I place a lock on your door, and you and I both agree that it is adequate, that it is my fault that you lose your keys and have your TV stolen because I should have known that a lock is not good enough and you should have had an alarm system as well.... Seriously, have some bit of personal responsibility.
      - tptacek 15y ago

trotsky 15y ago

If my credit card company can manage to shut down my credit card and not reinstate it until they talk to me because I make $300 worth of charges on vacation, it should be reasonable to expect a bank to provide that kind of anti fraud protection on commercial accounts. The difference is who is liable - if the banks were liable like they are with credit cards they'd certainly be much more diligent. Banks, after all, pushed online banking with minimal client protections because it was cheaper than paying staff. The risks may have been minimal when online banking rolled out, but the world has changed significantly in the last five years. The client is not secure, and it is borderline unreasonable to expect them all to be in this day and age. Pretty much any client machine will fall to a persistent targeted attack. Two factor authentication should be mandatory for electronic transfers outside of the institution.

run4yourlives 15y ago
With Credit Cards, the end merchant is liable, not the bank, which is why they have no issue with stop payments and such. In this case, the plaintiff is asking the bank to assume liability because he got hacked. That's a bit of a stretch.
- chriserin 15y ago
  Why is it a stretch? The bank is liable for funds stolen through a bank robbery, a much more aggressive criminal action. Why is the bank supposed to protect your funds in one instance but not another?
  - Macha 15y ago
    Because one happens because the bank didn't secure their vault enough and one happens because the client didn't secure their computers enough.
  - run4yourlives 15y ago
    There is a difference in the fact that the bank is fully aware that the robbery is not a normal transaction. The bank cannot be expected to be aware of normal transactions conducted with a fraudulent intent. Assuming they take some precautions (like they do if the suddenly see 15 quick purchases from Russia when you live in Oregon), there's only so much liability they can be expected to shoulder.

ImJasonH 15y ago

Mitchell and Webb have a great bit on this: http://www.youtube.com/watch?v=CS9ptA3Ya9E http://www.youtube.com/watch?v=CS9ptA3Ya9E

lawnchair_larry 15y ago

It's the bank's fault simply because this system has been broken for at least a decade, they know damn well it is broken, but they don't make as much profit if they invest in fixing it. This won't change until it becomes more expensive for them to leave it unfixed - either by market forces, or by regulation.

bugsy 15y ago

This was a bank robbery, and the customer is just out the loss for money taken from the bank? That's a novel legal argument.

oasisbob 15y ago

Some background: unlike PCI, which has very large specs for how to protect cardholder data, banks have very little mandated requirements for protecting online banking. Really the only guidance they've received is the document "Authentication in an Internet Banking Environment", released by the FFIEC in 2005. [1] The mandate boils down to: "Financial institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services. The authentication techniques employed by the financial institution should be appropriate to the risks associated with those products and services." So, if a FI provides basic personal online banking -- with no money transfer abilities -- perhaps a username/password pair combined with pretend-MFA ("What's your favorite secret color?") is appropriate. If you allow your customers to originate ACH or wire transfers, it's simply negligent to not provide true MFA, and their auditors should have caught this earlier. [1] http://www.ffiec.gov/pdf/authentication_guidance.pdf http://www.ffiec.gov/pdf/authentication_guidance.pdf

Derbasti 15y ago

Banks in Germany are required to use two-step authentification and one-time passwords for money transfers. Measures like this would have prevented that 'hack'. I actually lived in the US for a while and the so called security of American banks was completely incredible to me. It is true, Steam, Battle.net and Google accounts are significantly better protcted than the US bank accounts I had access to.

danneu 15y ago

I actually find this ruling fair. FTA: "But [the judge] nonetheless concluded that the law does not require the bank to implement the “best” security measures available and that the bank is clear to customers when they sign up about the level of security it provides and the amount of liability it will assume if money is stolen from a customer account."

deleted 15y ago

[deleted]