Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/4/2011
02:23 PM
50%
50%

75% Of SMB Banking Fraud Occurs Online

Most scams involved online account takeover or theft, according to a study commissioned by security vendor Guardian Analytics and conducted by Ponemon Institute.

Three out of four small and midsize businesses that encountered banking fraud during the past year were victimized online, according to a new study.

Well over half -- 56% -- of those companies experienced some form of banking-related scam during the previous 12 months, according to the report. About 75% of those cases involved online account takeover or other Web-based fraud. Some 61% of SMBs that fell prey to bank fraud were victimized more than once.

The 2011 Business Banking Trust Study, commissioned by security vendor Guardian Analytics and conducted by Ponemon Institute, included 533 businesses with fewer than 200 employees and average annual revenue of $21.6 million. All respondents were owners or senior executives with access to their company's corporate bank accounts. Guardian Analytics CEO Terry Austin noted that the current fraud numbers -- particularly in the online security arena -- showed remarkably little change from the 2010 version, the first year that Guardian sponsored the study. Last year's study found the same rate of Web-based fraud -- 75% of all cases occurred online.

"What we highlighted in 2010 was that the fraud problem was bigger than we expected and having a pretty substantial impact on businesses and the banks that serve them, and it hasn't gotten any better," said Guardian Analytics CEO Terry Austin. "In some cases it has gotten worse, but it certainly hasn't improved over the [last] 12 months."

Small and midsize businesses that manage their money with smaller banks aren't any more likely to run into fraud -- it occurred just as often at midsize or large financial institutions. The study also found that 78% of bank scams involving SMB accounts weren't discovered until after funds were transferred outside of the institution.

"The banks have not stepped up and adopted the techniques and the technology that is available to them in a broad enough fashion to make any material difference," Austin said. He added that some banks are doing a better job combating online crime than others, but the segment overall is losing the fight with fraudsters. "As an industry, the needle hasn't really moved."

Some 31% of the victimized SMBs included in the study said their bank didn't compensate them for fraud-related losses, while another 29% were only partially paid back. Just 8% of those surveyed said their bank fully covered their fraud-related losses.

Austin said the real onus in online banking security lies with the institutions rather than businesses that may not have the resources or expertise to contend with fallout from the Zeus botnet and other threats. While Austin's company recommends SMBs take certain steps to protect their company accounts online, he acknowledges that some of the practices -- such as designating a dedicated PC to be used only for banking -- may not be realistic for the smallest of businesses. He also notes that the technique most commonly used by SMBs in the study -- 78% perform monthly account reconciliations to check for fraud -- correlates closely to the finding that banks are only uncovering scams after the money is stolen.

"Businesses expect their banks to take responsibility for this," Austin said, adding that the banks themselves usually have deeper resources and better technology access than their small business customers. "Expecting [SMBs] to become security experts and adopt a wide array of techniques is pretty unrealistic."

Adding another potential wrinkle in online banking security for SMBs: More than one-third (38%) of respondents said they access their company's accounts on a tablet or smartphone, up from 23% in the 2010 version of the study.

"[Mobile] is a new and pronounced vulnerability, primarily because it's more frequent access and more variability in the endpoint device being used to access the system," Austin said. Mobile adoption further fuels Austin's view that banks need to focus on account protection from a server and back-end perspective, rather than worrying about every potential endpoint. "They need to be examining all of the information about the individual user as they access online banking -- that is the best and most effective way of protecting against fraudulent activity."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.