November 03, 2009, 6:40 PM — Cyberthieves are hacking into small- and medium-sized organizations every week and stealing millions of dollars in an ongoing scam that has moved about US$100 million out of U.S. bank accounts, the U.S. Federal Bureau of Investigation warned Tuesday.
It's now one of the top problems being addressed by the National Cyber Forensics and Training Alliance (NCFTA), which works with the FBI and industry to share information about cyber attacks, according to NCFTA Executive Director Ron Plesco. "Every year there seems to be a trend and this has been the trend this year," he said.
There has been a "significant increase" in what's known as ACH (automated clearinghouse) fraud over the past few months, much of it targeting small businesses, municipal governments and schools, the FBI said in an alert posted to its Web site.
The criminals can move thousands or even millions of dollars out of their victims' accounts very quickly, using online banking to add new payees to the organization's bank account and then moving the money overnight. Usually the first step is an e-mail to the company's bookkeeper or financial officer that can include malicious attachments designed to look like Microsoft software patches, or simply links to malicious Web sites. The idea is to get the criminal's keylogging software onto a computer with online banking access and then steal login credentials.
Once they have access to the bank account, the hackers set up ACH transfers to money mules -- typically innocent victims who think they're doing payroll processing for international companies -- who then transfer the money overseas via services such as Western Union and Moneygram.
In one case, the criminals even launched a distributed denial-of-service attack against an ACH processor to prevent the bank from recalling transfers before the money mules could move them overseas.
Once the money is out of the country, it is gone for good.
Criminals prefer smaller organizations such as school boards because they tend to work with smaller regional banks that may not have the fraud detection controls in place to stop these fake ACH transfers. These organizations often publish contact information for financial personnel, or even organizational charts posted to their Web sites, making them easy pickings for fraudsters.
According to a report by the FBI's Internet Crime Complaint Center (IC3), banks and financial service providers are often part of the problem. Based on FBI interviews, the IC3 concluded that "in several cases banks did not have proper firewalls installed, nor anti-virus software on their servers or their desktop computers. The lack of defense-in-depth at the smaller institution/service provider level has created a threat to the ACH system."
The FBI is opening new cases every week on average, the IC3 said. "As of October 2009, there has been approximately $100 million in attempted losses."
The NCFTA is tracking between $1 million and $1.5 million in losses each week to this type of fraud, according to Ron Plesco, the NCFTA's executive director. "That's just from the folks we deal with. We're thinking it's larger than that," he added.
Smaller banks are being hit with this fraud because, unlike the larger national banks, they tend to not have the controls in place to block fraudulent ACH transfers, Plesco said. "It's strategic targeting of what is perceived to be a weakness in controls, whether it's at the small corporation [or at] the small-to-medium bank level."
Banks are covering some ACH losses, but all too often it's the online customer who's left holding the bag.
Karen Earhart found out just how quickly money can vanish on the morning of Oct. 15. Earhart, the administrator of the Plainview Christian Academy in Plainview, Texas, arrived at work that Thursday morning to discover that $43,000 had been moved out of the school's bank account overnight via ACH transfers to eight accounts.
"The hackers added themselves to our payroll," she said. Some of the new payees were real people, but some were at newly opened bank accounts with fake "Russian"-sounding names. The names included words such as "gotcha," "skunk" and "prank," she said.
Typically, when new employees are added to the school's payroll, they must provide a voided check and fill out a payroll authorization form. Earhart was amazed that the hackers were able to add payees online without this documentation -- and that the bank was willing to pay them. "They were willing to send out $10,000 a pop to people who were not authorized to be on our payroll," she said.
