Robbers down the line

Experi-Metal regularly received emails from the Dallas-based bank with instructions. So controller Keith Maslowski was not surprised in early 2009 when one arrived that directed him to fill out a Comerica business connect customer form. He typed in his user name,password and pin number from a token at 7.35am on January 22,three weeks into his employers 50th anniversary year. Less than seven hours later,Experi-Metals coffers were empty.

By 2.02pm,93 payment orders had been issued in Mr Maslowskis name,sending 1.9m to accounts in Russia,Estonia and other places where Experi-Metal had never done business. The company lost all 560,000 in its main accounts,though court records would show it had sent such wire transfers only twice in the previous two years.

Four hours into the rout the alarm was finally raised by another bank that was processing some of the transactions. Still,a further hour and a half passed before Comerica stopped the transfers,US district judge Patrick Duggan found after a trial in Detroit last year.

With a few keystrokes,Experi-Metal was caught in a Darwinian abyss that could have led to its demise: the company was a victim of cybercrime and the bank entrusted with its funds had no obvious legal obligation to make restitution. Cyberthieves have cost US companies and their banks more than 15bn in the past five years,the Federal Deposit Insurance Corporation found in a recent study,and account takeovers such as at Experi-Metal are growing more common.

Companies are forced to swallow about half the aggregate losses from attacks on their bank accounts,according to previously undisclosed research by a banking trade group and dozens of interviews by the Financial Times. Yet regulators say banks could have prevented most of the crime if available security software had been put in place.

New US guidelines directing all banks to increase security came into effect this week,designed especially to help protect commercial accounts. But as 2011 drew to a close they had not yet fully sunk in or convinced banks to raise the bar against criminals as needed,regulators warn.

American regulatory authorities and law enforcement agencies increasingly see financial institutions as part of the problem in the failure to rein in internet fraud. Though security overall is improving and the banks own systems are rarely penetrated,many have opted not to scan for even obvious fraud being perpetrated on their customers,such as is signalled by unusual,rapid-fire transfers to unfamiliar locations.

Bank security veterans say one reason for the protection shortfall is that US banks do not have to pay full restitution to commercial enterprises. They are not going to spend more to stop fraud than it costs them when fraud happens, says one vendor who has supplied detection systems,mainly to medium-sized banks. She suggests that most banks would have to spend 1m for adequate protection.

Individual Americans are protected by Regulation E of the federal banking code and are liable for a maximum 500 if a cyberthief strikes. Companies have no such guarantees. A small company may not be able to survive even one significant cyber-attack, Gordon Snow,FBI assistant director,testified before a congressional financial services committee in September.

Other countries vary but often afford greater protection; in the UK,companies are absolved as long as they are not negligent and ensure they report unauthorised transfers within two days.

In the US,corporate customer liability is governed by the uniform commercial code,which,despite its name,varies slightly from state to state. Companies are responsible for stolen funds if they have agreed to a security procedure with the bank,the bank followed it and the procedure was commercially reasonable. US courts have usually upheld that reasonableness.

All told,US companies and their banks lost more than 2bn in 2010,according to the latest FDIC figures. That is a big drop from the peak of 8bn in 2006. But the banks battering by the overall economic crisis means the hit to their earnings is felt all the more acutely 8211; and such losses cannot generally be recouped from insurance or covered by banks reserves.

Moreover,the number of attacks is rising as scammers go after smaller businesses and smaller banks,where security is often weaker,says William Nelson,chief executive of the Financial Services Information Sharing and Analysis Center,a non-profit group set up to share information on cyberthreats among banks,security companies and government officials.

No official statistics show which types of bank are better at protecting customers and most banks contacted declined to discuss security matters on the record. But background interviews with executives and other data point to clear patterns.

Big banks generally do a better job of security and often recompense their commercial customers when they slip up,each paying out what insiders and analysts say are as much as hundreds of millions of dollars every year. Those settlements also allow them to avoid court fights that could detail weaknesses in their security systems.

The American Bankers Association,the industrys main trade group,found in a survey last May of 77 financial institutions that companies had to cover half their losses in aggregate. A poll breakdown provided to the Financial Times also suggests that the biggest banks accept a much greater share of losses than did banks such as Comerica,which has 61bn in assets.

The small sample,of fewer than 1 per cent of US banks,apparently captured institutions that were luckier than most. The two survey respondents with confirmed account takeover fraud and more than 100bn in assets apiece accepted just 240,000 in combined losses over a recent 18-month stretch,leaving their customers out of pocket by only 86,000. But at most smaller banks,the proportions were reversed. Those with 50bn-100bn in assets,for example,took about 470,000 in losses and left customers to bear 1.4m.

The FDIC and the Federal Reserve have told lenders to stop relying on tokens,passwords and cookies,the small data files left on computers to authenticate them on future visits,and instead embrace layered security including software that flags unusual behaviour 8211; such as multiple transfers within minutes to new recipients. The guidelines can figure in regulators inspections of the banks,but officials say they do not expect every institution to have met the January deadline and are instead looking for a good-faith effort.

A survey by Guardian Analytics,a banking technology specialist,that was shared during a closed-door security conference in November in Washington showed not everyone was equipped to make that effort. About 40 per cent of the banks polled did not even know they would soon be required to spot anomalies in transactions. There seems to be some misunderstanding, the FDICs Jeffrey Kopchik told bankers at the conference. That is concerning to me and I think all of the agencies.

In most past cases of high-frequency transfers to new places,if banks had taken what we would consider a cursory look at transactions,they would have seen that the money going out the door was completely anomalous.

That was certainly true of Experi-Metal,which sued Comerica in 2009. Experi-Metal had signed up with the countrys 31st-biggest bank when its longtime personal banker took a job there. Neither side would comment for this article,but in court they agreed that they had had good relations until the January day when it all went wrong.

In the end,the case pivoted on whether Comericas practices were commercially reasonable,whether any reasonable practice must include forthright behaviour or fair dealing and whether Comericas general defences and response on the day were so lax as to be objectively unfair.

Experi-Metals expert witness on bank security testified that most banks could spot anomalies a point that Comerica disputed. Comerica said it should not have been expected to do as good a job as the biggest institutions. It said it had no obligation to monitor what was happening in customer accounts.

Comericas employees did not purposefully allow any fraudulent wires to leave the bank once the fraud was confirmed, it wrote in a pre-trial filing,adding that the bank was entitled to rely on its customer Experi-Metals assurance that it would keep confidential its login ID,password and secure token number.

The judge disagreed,stating that though the regulatory guidance then in effect did not require better monitoring,Comerica was not acting in good faith if it merely had a pure heart and empty head. Citing numerous oddities about the transactions and the slow reaction when JPMorgan Chase 8211; a way station for a half-dozen transfers en route to customer accounts of Alfa-Bank in Moscow 8211; called with suspicions,the judge concluded that he was inclined to find that a bank dealing fairly with its customer,under these circumstances,would have detected and/or stopped the fraudulent wire activity earlier. He ordered Comerica to reimburse Experi-Metal the full amount,which it did in August.

Most businesses are unaware that they do not have the same protection as consumers. Just 18 per cent of 1,000 small companies knew the truth in one recent survey by Actimize,a banking security company. Analysts say that those unaware of the risks are less likely to insist on precautions,such as mandatory phone calls to confirm every wire.

Often,companies find out that they are liable only when they have been robbed. When cyberthieves hit,banks make their own position clear,leading to some pretty tense discussions,says Kevin Gibson at Synovus Bank of Columbus,Georgia,which has about 30bn in assets. It is a hard pill to swallow to our customers.

Mr Gibson says his banks accounts were pilfered once or twice a week for a period in 2010. But since asking business customers to download new security software and adding internal monitoring a year ago,the bank has had no intrusions.

Executives at the largest US banks say they operate case by case but tend to cover losses most extensively for their biggest,most valuable customers,even though those companies could often take the hit better than small firms. It is almost as if they are extending a version of the too big to fail doctrine,which Washington applied in bailing out the banks three years ago.

Put it this way, says a security executive at one big bank. If you are a large,long-term customer,you are going to get the benefit of the doubt.

2012 The Financial Times Limited