2 replies

$\"user-pic\"$

sleze69

January 29, 2010 7:30 AM

Well, if someone walked into the bank with a fake ID and withdrew the money from the teller, who would be at fault? Hilary Machinery or Plains Capital Bank? That is essentially what happened here (albeit virtually).

I think I just realized the first chink in the armor of small community banks. I know my credit union's website is definitely less advanced than the major banks' sites that I do business with.

$\"user-pic\"$

idip

January 29, 2010 9:13 AM

Don't forget they had her username and login, which means... someone stole her wallet? (ID analogy) without her knowledge and then... gave it back after they had the information they needed?

Sounds like she was a victim of a phishing attempt but didn't think anything of it.

January 29, 2010 11:34 PM

$\"user-pic\"$

Tied To The Whippin' Post

Did you read the article? It's not a her - the company name is Hilary Machinery, not a woman with the first name of Hilary. It's not a case of someone stealing a wallet, it's a case of a hacker getting a hold of the login credentials that the company used to access it's bank account and using those ill-gotten credentials to initiate fund transfers/payments to payees that were located overseas. The payees were not companies or individuals that Hilary Machinery had ever done business with and the amounts of the payments were well above amounts that are normal for transactions that Hilary Machinery usually made to it's payees.

January 28, 2010 10:12 PM

$\"user-pic\"$

fpage77

If Hillary Machinery's accountant wasn't installing spyware loaded software this wouldn't have happened. The account login information didn't just float down on magical fairy wings into the hands of the criminals. I doubt a account would just respond to a phishing email asking for credentials. I vote keylogger got on their computer. If what I'm guessing is cause it's Hillary Machinery fault

January 29, 2010 11:03 AM

10 replies

$\"user-pic\"$

knoxblox

So you're saying, basically, that when the bank says, \"Here, put your money in our bank, and we'll safeguard it\", and some guy VIRTUALLY sneaks into the bank with a VIRTUAL fake mustache on, and says, \"Yes, I'm Hillary Machinery. May I withdraw all my money please?\", and the bank gives it to them, then it's Hillary Machinery's fault for not coming along with the impersonator to say, \"Look out, that's not me.\"

That's what I'm gathering from your statement.

$\"user-pic\"$

January 29, 2010 7:19 AM

Who says they didn't obtain the credentials from the bank by exploiting their weak security in some other way?

January 29, 2010 11:13 AM

$\"user-pic\"$

Carmeysays...

Thank you. +1 There have been many other stories about this in the news happening at other institutions with lax security.

$\"user-pic\"$

idip

January 29, 2010 9:14 AM

That would mean their entire system is compromised and they would be seeing a whole lot of Hillary Machinerys complaining... not just one.

$\"user-pic\"$

kujospam

January 30, 2010 8:47 PM

+1

$\"user-pic\"$

FooSchnickens - Full of SCAR

January 29, 2010 1:26 PM

Or it could mean that people have just now figured out how to do it and we may see more incidents like this in the future. This could be the bank's way of dealing with the issue after they realized their system isn't that safe after all.

$\"user-pic\"$

PlsLetMePst

January 29, 2010 6:15 AM

wrong. look for \"man in the middle\" attacks.

plus, i didnt know banks in USA were not using smartcard logon...

cheap and easy to implement. and cant be cloned.

January 29, 2010 10:44 AM

$\"user-pic\"$

jvanbrecht

You are incorrect. Generally 1 time passwords (not sure why you use the term smartcards.. since those have nothing to do with security, its just a name given to devices to provide some intelligence, I am guessing you mean secureid tokens or similar paper based, think bingo type cards).

However, back to the original point, 1 time passwords have a time frame, usually 60 seconds, in that time, if someone is currently sniffing, or monitoring the user via spyware/trojans/whatever, using well known exploits in various browser and dns protocols by redirecting the user to an identical looking bank website, obscuring the url with a dns exploit so that while the browser still shows the banks url, the site itself is no way related, there is a 60 second window for hackers to grab the credentials, and the 1 time password.

At the same time, when someone tries to login an fails due to the time expiring, they are almost guaranteed to try again before realising something is wrong.. That increases the exposure window.

$\"user-pic\"$

dreamcatcher2

January 29, 2010 1:09 AM

I think the question is not \"whose 'fault' is the loss\" so much as \"do we want better security or not?\" The fact is, bank customers are not in a position in which they can completely secure themselves. Only banks have the ability to increase the security of our funds by a significant degree.

It's quite rare for significant amounts of money to be stolen through credit card fraud, because the banks are responsible for that fraud. Therefore, they deploy adequate yet convenient security measures. Can you imagine anything less secure than a credit card? All anybody needs to buy something using my credit card is an easily-stolen 16-digit number. And yet most credit card fraud is rapidly cut off, because all those banks have elaborate fraud-detection mechanisms from companies like Fair Isaac.

See a market problem, solve it with a market solution. If banks are liable for more fraud, we will see much less fraud than we do today.

January 28, 2010 11:55 PM

$\"user-pic\"$

ariven

I dunno about them not responding to a phishing email, I have met some pretty lacking accountants..

January 28, 2010 10:50 PM

$\"user-pic\"$

Aesteval

And if the bank didn't accept EMAIL (an easily spoofable method of communication) as a verification method to bypass a security method this would have never happened either.

February 6, 2010 12:11 AM

$\"user-pic\"$

bwcbwc

This is a key point. They bank should not be authenticating new computer access based on email requests (phishing) just as the customers shouldn't be logging into the \"bank\" based on emails from the bank.

Hard to tell who leaked the login credentials on this one without more information, it could be spyware, phishing or any of a dozen other means. But the bank definitely failed in their response to the emails.

January 28, 2010 10:14 PM

$\"user-pic\"$

hahamaximus

The IP address should have been a HUGE red flag for the bank, but with so many \"bots\" on unprotected computers this could have easily be routed via US IP addresses.

The fact that the computers were able to register themselves for the account prior to the transactions should have been another red flag, at a minimum suspending activity once it was noted as \"unusual\" for the account from the computers in question.

3 replies

$\"user-pic\"$

sp00nix

January 29, 2010 8:40 AM

If i log in from a different machine/IP then i did the last time, it prompts me for extra security questions.

$\"user-pic\"$

mcgs999

January 29, 2010 7:32 AM

agreed 100% - anytime i log in from an IP that is not my standard 2 or 3, my bank calls me with a verification code.

$\"user-pic\"$

wickedpixel

January 29, 2010 1:50 AM

I totally agree. I use a proxy server at work for variously website testing activities and once forgot to turn it off before logging into my etrade account. Within minutes my account locked up and prompted me to call customer service. When I called they told me that someone had logged into my account from Croatia (which was where my proxy was connected through) and they had frozen the account as a security measure. Once I explained what had happened and verified my identity they promptly unlocked the account. I don't see why this isn't standard practice.

January 28, 2010 10:20 PM

$\"user-pic\"$

scoosdad

Good grief, if I so much as reboot my router and get a new dynamic IP address but still in the same range as the one before it, Bank of America makes me jump through huge security hoops to log into my account the next time.

3 replies

$\"user-pic\"$

Conformist138

January 29, 2010 6:16 AM

Agreed, Bank of America usually jumps on these things. It's about the only thing they're good at (probably thinking, \"If anyone is going to rob our customers, it's going to be us!\"). They locked my account and made me call them after I bought my laptop. $600 was high enough over my normal transactions to make them nervous. I'm glad, I'd rather be annoyed with a phone call than get robbed AND sued!

$\"user-pic\"$

trujunglist

January 29, 2010 5:03 PM

I love the slogan, I hope B of A adopts it

$\"user-pic\"$

Noir

January 29, 2010 8:40 AM

BOA: If anyone is going to rob our customers, it's going to be us!

Hey, I like that slogan!

January 28, 2010 10:32 PM

$\"user-pic\"$

sonneillon

Hrmmm, the bank is suing her in state court. I think this is a Federal matter because the money crossed state lines. I think she is being sued from the wrong court.

It's a shitty thing for BOA to do but I'm not sure if they are liable for more than their FDIC insurance.

I think this really depends on Federal regulations and I have no idea about the regs.

13 replies

$\"user-pic\"$

January 29, 2010 7:36 AM

What are you guys talking about? The bank isn't suing the foreigners that stole the money. They are suing the customer. There is a good chance that when the machinery company opened an account at the bank they signed something that said all litigation between them would be resolved in the bank's home state.

January 29, 2010 10:36 AM

$\"user-pic\"$

FacebookAppMaker

Exactly. Not only that, if they were suing the customer for money, then, possibly, it would be in federal court. However, they are bringing the business to court in order for the judge to rule they are not responsible for making up the rest of the moneys.

$\"user-pic\"$

Crim Law Geek

January 29, 2010 1:49 AM

That would matter more if it were a criminal matter. In civil matters, simply put, the thing that matters most is the \"residence\" of the parties (yes, there are exceptions). Presumably, both the bank and Hillary \"reside\" in the same state. Even if not, they did business in a particular state (Hillary's). And even if neither was the case, an out-of-state plaintiff can sue a defendant in the defendant's state without requiring federal venue.

The case _could_ be transferred to Federal court if the suit rests on a Federal law, or if the parties are in different states and the plaintiff seeks a certain minimum amount ($75K I think).

IANAL (for the next few weeks), don't rely on anything you read on the internets, etc, etc.

January 29, 2010 12:14 PM

$\"user-pic\"$

Daemon Xar

Citizenship is what matters, not residence. Residence is important for venue. But otherwise accurate.

Good luck on the bar.

$\"user-pic\"$

Crim Law Geek

January 29, 2010 3:44 PM

Yes, the rules read \"citizenship\", but in practicality, that means residency, particularly when it comes to parties who are both in the United States, or when it comes to corporations that do business in multiple states.

I already passed the New York bar on my first try, just waiting to be interviewed and sworn in. Thank you though!

$\"user-pic\"$

sonneillon

January 29, 2010 2:55 AM

But isn't this a criminal case involving the 800k worth of funds?

$\"user-pic\"$

mac-phisto

January 29, 2010 7:31 AM

there may be a separate criminal investigation, but this is a civil suit. private citizens/companies cannot bring forth criminal cases in US courts - only the gov't can.

$\"user-pic\"$

divedeep

January 29, 2010 1:37 AM

According to the article, the case was filed in the U.S. District Court of Western Texas, which is a federal court.

January 29, 2010 12:38 AM

$\"user-pic\"$

Elcheecho

does it count as state lines if it's electronic transfer of $$, and went straight out of the country? if i'm in Missouri and sell a digital file to someone in canada, is that interstate commerce?

$\"user-pic\"$

sonneillon

January 29, 2010 2:57 AM

I assumed so but I honestly have no idea. As much as doing it over the phone.

January 28, 2010 11:01 PM

$\"user-pic\"$

sonneillon

I realized my mistake after I posted. My kingdom for an edit button.

January 28, 2010 10:44 PM

$\"user-pic\"$

GearheadGeek

While there might be a woman named Hillary involved somewhere, I'm guessing that \"Hillary Machinery\" is an it, not a she, and I don't think Bank of America is involved at all.

January 28, 2010 10:40 PM

$\"user-pic\"$

Coles_Law

Not BOA-plainscapital bank. Other than that, good points.

January 28, 2010 10:39 PM

$\"user-pic\"$

FDCPAGuy

I agree with you that it seems to be an improper venue but the plaintiff in this case is not BOA

January 28, 2010 10:47 PM

$\"user-pic\"$

Aesteval

But it may not be an improper venue because the bank isn't suing the customer for the money. The bank is suing for a judgement stating that their security means are adequate and it's not through their fault that the money was lost. It's a lawsuit to absolve themselves from responsibility.

January 28, 2010 11:04 PM

$\"user-pic\"$

sonneillon

true, but that should still be for a federal court to decide. I suppose it might be appealed that way anyways.

January 28, 2010 11:21 PM

$\"user-pic\"$

Aesteval

Yeah, it's probably going to bounce all over the place in the process. It looks like it should be an interesting case.

January 28, 2010 10:41 PM

$\"user-pic\"$

Bohemian

But if people make one debt or credit card transaction while on vacation they frequently get their card and or account locked. If banks put the brakes on an account for a $20 out of state transaction what this bank let go looks awfully careless.

January 29, 2010 11:52 AM

1 replies

$\"user-pic\"$

subsider34

On the other hand, this is a business account, not a personal one.

January 28, 2010 10:43 PM

$\"user-pic\"$

H3ion

I don't understand what security this bank had in place. We use wire transfers quite often and if an unsuspected phone number shows on the bank's caller ID, I get the third degree. This is on top of a multi-digit PIN and a name that has to match what they have exactly (for example, Philip, not Phil).

This sounds like a declaratory judgment suit and there's no reason for that to be brought in a federal court. Somebody must have insurance for this loss.

January 29, 2010 11:02 AM

2 replies

$\"user-pic\"$

Sudonum

I agree, I have accounts in 5 different banks. I can't transfer any money between them without first setting up the accounts by doing one of those multiple small amount transfers that have to be verified. And even then I can only do online transfers between accounts where I am the account owner of both accounts. These accounts are with BofA, Schwab, Capital One, and couple of local banks here in Louisiana.

Any transfers between accounts where I am not the account owner of both accounts requires a physical trip into the bank. Or in the case of my local banks, a personal phone call because I know the managers, followed up by a trip to the bank at a later date.

$\"user-pic\"$

H3ion

January 29, 2010 1:21 AM

My bad. It is in federal court, although I don't think it had to be.

January 28, 2010 10:47 PM

$\"user-pic\"$

Eyebrows McGee (now with more baby!)

That's it. I'm banking with Banklestar Galactica.

4 replies

$\"user-pic\"$

crouton976

January 29, 2010 3:29 PM

No, no, no... you need to start banking with Bank of Nicolae... see, your money is safe... right there... in his shirt pocket...

$\"user-pic\"$

NeverLetMeDown

January 29, 2010 9:31 AM

If they offer to give you a free toaster when you open an account, just say no.

$\"user-pic\"$

January 29, 2010 7:39 AM

I just ordered the Battlestar Galactica series off Amazon a few weeks ago (still not here =( ). I'm told it's really good.

$\"user-pic\"$

TurnkeyDB

January 29, 2010 3:53 AM

If they've already recovered 600k doesn't that imply they are responsible sort of by default?

January 28, 2010 11:01 PM

$\"user-pic\"$

Gorbachev

Business must be bad for bankers in Lubbock, TX.

To completely destroy your credibility with existing and prospective customers for $200K has to mean the $200K is money they simply can't afford to lose.

If I was a customer with that bank, I'd close my accounts tomorrow morning.

2 replies

$\"user-pic\"$

Dean806

January 29, 2010 5:30 PM

I was a customer of that bank, and I closed my account last year.

January 28, 2010 11:59 PM

$\"user-pic\"$

Buckus

Banks have insurance for this kind of problem. No doubt that suing the customer who is the victim is going to see a lot of accounts closed. They may ultimately win the lawsuit, but close down since all the business customers will come knocking, asking for cashier's checks and walking to the bank down the street. I'd close my account post-haste if I did business with them.

January 28, 2010 11:25 PM

$\"user-pic\"$

Trick

The bank must have horrible council. I can't believe it thought it would be a good idea to expose their own weakness while demonstrating that they will harass good customers with lots of money all the while hoping none of this becomes public...

Once they lose the case they should sue the law firm that told them this route is a good idea!

2 replies

$\"user-pic\"$

divedeep

January 29, 2010 1:33 AM

The bank's council wouldn't be doing its job if they didn't protect the banks interests. I know that on its face this sounds like a stick-it-to-the-little-guy type of situation. However, a bank customer has to be vigilant against fraudulent transfers just the same as a bank does. The bank (through its lawyers) is asking the court to determine if the bank's security was in line with industry standards.

$\"user-pic\"$

carlogesualdo

January 31, 2010 4:14 PM

It's all the business they do with Texas Tech - which, as we all know, lost its mind just before their bowl game this year. It's like a cancer. It's sad. I used to be a really proud customer of PNB (before they changed it to Plains Capital and I moved away). If I was still a customer now, I'd yank my money for sure just for treating a customer this way. You don't kick a victim while she's down.

January 28, 2010 11:26 PM

$\"user-pic\"$

markd

I live in Lubbock and PCB is a pretty large bank. They are National, and while they started in Lubbock, they've expanded to Dallas and Austin.
I used to be a customer (couple years ago) and their process for granting access, if it hasn't changed, actually requires you to contact customer service. That means an actual human looked at it and granted access.
Of course we don't know enough information to really *JUDGE* who's at fault.

My personal opinion though, is that PCB should have caught this. I recall that one time I had incorrectly setup a large transfer to ING as a recurring instead of one time. PCB contacted me before they approved the transfer. Seems like if they could do that for a small consumer like me, they could reasonably do that for a big business customer that carried 800K+ in their account.

Are we going to have to get bank account theft insurance now? OOOH OOH, let me start the patent! The money's all mine!

January 28, 2010 11:32 PM

$\"user-pic\"$

markd

Also, for those interested, one of the local tv news sites is www.kcbd.com. A quick search for 'plains capital bank' shows that they received TARP money, so @gorbachev, maybe the bank is having problems. ;)

Generally speaking, Lubbock has been pretty resistant to the recession.

January 28, 2010 11:49 PM

$\"user-pic\"$

mkel2000

Before retiring several years ago from a Law Enforcement career I investigated several cases similar to this one. Based on this story, the crooks are becoming bolder by transferring the stolen funds directly to off-shore banks instead of funneling them through unsuspecting \"employees\" here in the U.S. It is likely that Hillary is like most US businesses and is still using computers with Windows XP and Internet Explorer 6, both extremely vulnerable to attacks. Once compromised, it is very easy for the hacker to obtain the proper credentials to access an online bank account. This type of crime will continue until banks who offer online banking transactions also provide secure token logons to their accounts. With a secure token device, the customer has a small token that generates a random number every 60 seconds. The bank's server generates the same random number at the same interval. If the number isn't entered within the 60 second time frame that matches the server's number, the login won't work until a new number that matches the current server number is entered. Even if intercepted, it is unlikely that the hacker could use the information quickly enough to gain access. Maybe if the banks spent a little less on bad investments and more on improving their security this type of theft would be much less common.

January 29, 2010 11:36 AM

2 replies

$\"user-pic\"$

HogwartsProfessor

Hmmm. Interesting to a crime writer. Thanks for the info.

Although for book purposes, holding up the joint with big black guns is still much more dramatic!

January 29, 2010 11:08 AM

$\"user-pic\"$

jvanbrecht

Actually, using current exploits, it is still very easy to compromise an account that uses tokens.

Consider this.. and these are real world examples I have come across (I work in IT security)

A blend well known easily performed exploits.

1) There is a current DNS exploit mixed with a browser vulnerability, while the address bar will show www.bank.com in the url, the actual site will be www.hacker-site.romania.com or whatever that looks identical to the banks.

2) Man in the middle attack using trojans (which again are easy to install without user knowledge through a myriad of browser and OS vulnerabilities, Vista and Windows 7 are no exception) that allows the attacker to watch in real time as the user inputs their credentials and the 1 time password that the token spits out.

3) Hacker site sends credential rejection to the user but at that point, they already have the user id, password and token password, they are able to login as the user within that 60 second window and transfer money overseas. Granted that window can differ depending on when the user chose to input the code, I generally wait for the last 5 seconds before a new code is generated, but tokens can end up out of sync, also some people type slower and need more time so they intentionally wait for the number to change to allow them the full 50 to 60 seconds.

Phishers and Hackers are no longer just sending out blanket phishing emails, they are using targeted attacks after significant research about a particular banks users. They are organized, and extremely sophisticated.

From a banks standpoint, they should (and this is what I preach) never ever trust the end users system. Always assume its compromised and to perform certain adjustments as needed. These are all technical. In many cases, using a mix of random images that only the user would know (although man in the middle attacks easily defeat these), sms messages to a registered phone when a new computer comes online, to access the account, automated phone calls to the registered number with a token that needs to be input into the site prior to the new computer being allowed access. Automatic hold periods on transfers and other such transactions for any transaction that was initiated from a newly registered computer.

I could go on.. but then I would have to send everyone who reads it a very hefty bill :)

If anything, this particular bank sucks when it comes to security, as such, they did not due their due diligence in protecting the users account, hell from what I read, they did not even try, and should be held liable.

January 29, 2010 12:08 AM

$\"user-pic\"$

ShruggingGalt

Umm, banking FAIL. Industry standard is for secure token access, or even better: PIN PLUS token (you have to not only know a login and password, you also have to have the PIN and the given token # at that narrow time window to access certain parts of the website)

January 29, 2010 11:04 AM

1 replies

$\"user-pic\"$

bostonguy

Well, having username + a one-time-tokencode is almost as bad as having a username + password. It's still a single factor.

You should have (at least):

password (Factor 1) ( Something you know)
some king of token that produces 1-time passkeys (Factor 2) (Something you have)

Then there is biometrics (fingerprint, eye-scan, hand geometry, etc) (Something you are)

Although technically, you can argue that biometrics is still just a item, since your body parts are always with you, just harder to steal!

I have a credit-card like device from BofA that produces a new key (when pressing a particular spot on the card). I have my account set to only allow online access when using either that card, or a unique code sent to my cell phone. The BofA site also requires that extra login item to authenticate a new computer, to add a new bill-pay payee, or add a new account to transfer money to.

January 29, 2010 12:48 AM

$\"user-pic\"$

backwerds

Weird instance where legal action and marketing need to have coffee before making a business decision. Legally; they want to declare their business practice safe and that the funds shouldn't be replaced due to bank error (large sums of money to several non-common accounts internationally). But the public relations nightmare this causes is hardly worth the 200k.

I'm not really aware on Texas law (Texas laws in relation to computers/technology are complex and different {see Microsoft Word case}) but I believe FDIC should cover some of that money if it was hacked. However; if the account was hacked due to fault of the operator (installation of malware/spyware, phishing scheme, Nigerian scam), then the operator is at fault; and I don't think the same regulations apply.

Either way, awful decision for a bank to sue on those grounds, especially considering the 200k is a drop in the bucket for a company that claims to have 4billion in assets.

January 29, 2010 12:50 AM

$\"user-pic\"$

keithldick

This is another reason that we should follow Shakespeare's King Henry VI statement: \"The first thing we do, let's kill all the lawyers\"....

The whole problem with this country and the world today is: *MONEY* and how those that have it or access to it can get *More of It*... Thus Law Suits...

It's no longer let us do anything for our fellow man, let's just *Sue Him*...

If it wasn't all about *Money* we'd have a cure for Cancer and 100's of other diseases, we'd have people living on the Moon and a colony set up on Mars and looking to other planets to live on because Mother Earth is not going to support us forever and if we don't venture out it will Be The End Of The Human Race...

Alas, Whoa is me, We could have been 50+ years beyond where we are now if it wasn't for the word: *GREED* and the idiots that love to take advantage of it...

4 replies

$\"user-pic\"$

RandomHookup

January 29, 2010 6:17 AM

I have a \"law suit\". I wear it on those rare occasions I need to go to court.

$\"user-pic\"$

NeverLetMeDown

January 29, 2010 9:36 AM

http://www.spectacle.org/797/finkel.html

Really, that quote is probably best interpreted as nothing more than a lawyer joke - it's a statement by a comedic villain, describing his ideal world.

$\"user-pic\"$

JiminyChristmas

January 29, 2010 1:53 AM

That has to be the most abused out of context Shakespeare quote of all time. To take it as a straightforward imperative statement is to misunderstand the real meaning of the dialogue.

$\"user-pic\"$

Powerlurker

January 29, 2010 3:07 AM

It's surprising how many famous Shakespeare quotes actually mean something quite different from what most people think. For example, the quote that \"Some are born great, some achieve greatness, and some have greatness thrust upon them\" from Twelfth Night is actually a comedic line with a great deal more innuendo in it than most realize.

$\"user-pic\"$

DangerMouth

January 29, 2010 8:56 AM

It was certainly surprizing to me when I realized that many of what my grandmother told me were 'old Irish sayings' were actually Shakespeare quotes.

January 29, 2010 10:06 AM

$\"user-pic\"$

MauriceCallidice

I much prefer Shakespeare in the original Klingon.

$\"user-pic\"$

divedeep

January 29, 2010 1:24 AM

Before everybody goes off on lawyers because the bank is suing a customer - it is doing this in order to obtain a ruling from the court that its security measures were or were not adequate. The Uniform Commercial Code (UCC) Article 4A-202 (

$\"user-pic\"$

divedeep

January 29, 2010 1:25 AM

Before everybody goes off on lawyers because the bank is suing a customer - it is doing this in order to obtain a ruling from the court that its security measures were or were not adequate. The Uniform Commercial Code (UCC) Article 4A covers this. To put it simply, if the bank gets this ruling, the customer is probably out the rest of the money.

$\"user-pic\"$

bknabe

January 29, 2010 1:33 AM

When I first read about this I thought the blame should be shared about 50/50. Then I read the article at KrebsonSecurity (http://www.krebsonsecurity.com/2010/01/texas-bank-sues-customer-hit-by-800000-cyber-heist/) and it became very clear that unless there was something really major missing, the bank messed up, and messed up big. None of the transfers should have gone through without a phone call to Hillary Machinery. Period.

$\"user-pic\"$

Crim Law Geek

January 29, 2010 1:52 AM

I wonder if Hillary could try and get their money back from the FDIC. After all, the loss is no different than if the bank had failed.

2 replies

$\"user-pic\"$

January 29, 2010 7:45 AM

I don't think the FDIC insures against theft. The bank has their own insurance for that.

$\"user-pic\"$

Crim Law Geek

January 29, 2010 3:48 PM

Yes, banks have insurance for when someone comes in with guns and robs the place. But isn't FDIC insurance for the individual depositor? More precisely, doesn't the FDIC insure the depositor for the bank's inability to provide deposited funds on demand (be it because of a bank run, bank failure, etc)?

$\"user-pic\"$

sopmodm14

January 29, 2010 2:05 AM

they obviously didn't do enough to protect their client's possessions.

thats like saying if there was an armed robbery, we lose a percentage to off-set the loss.

$\"user-pic\"$

imthemommy

January 29, 2010 5:14 AM

\"the only other authentication the bank required was for users to register the systems they used for online banking transactions\"

This is the part that stands out to me. Since the above quoted is the the case, obviously this is a huge Bank Fail! The consumer used same account, same e-mail, same passwords and same IP address for all transaction... THEN, just before all this happens the bank gets these requests with a new IP address, one from Romania and one from Italy. Then immediately following that are these repeated HUGE transfers! They just sit back and allow it all to happen regardless of their own security measures supposedly in place. If the IP address is part of their security measures then it seems like a no-brainer to conclude that the bank is definitely at fault here for not raising the red flag for that alone! The fact that the Bank is the one who brought this to court is astounding!!! That's some pretty bad self inflicted PR! I know if I had any kind of substantial money sitting in PlainsCapital Bank, I'd be getting my cashiers check in had pretty quick and moving on to a different bank!

$\"user-pic\"$

Grrrrrrr, now with two buns made of bacon.

January 29, 2010 7:15 AM

When I put my money in a bank, it's not my responsibility to keep an eye on it, or to make sure the vault is locked, or to make sure that the security guard isn't asleep. That fact that it is a bank kind of implies that they're responsible for keeping your money from disappearing. They take my money, give me .0005% interest on your savings account, and then loan it to someone else and make 10% interest. I agree to do that because (supposedly) the money is safe in their vault. Otherwise, I'd just stuff it into my mattress or bury it in mason jars under the old oak tree.

If the bank loses my money, it's their problem to recover it, not mine.

2 replies

$\"user-pic\"$

January 29, 2010 7:49 AM

You stole my bacon tagline...

$\"user-pic\"$

dolemite

January 29, 2010 9:28 AM

You can never have too much bacon.

$\"user-pic\"$

s2

January 29, 2010 7:40 AM

reasonable? BoA sucks for customer service.. but.. their online banking is great. New IP logging in? you have to jump through some hoops to get access to your online account. In this day and age how can the only security be user/pass? And there the heck is the backend systems red flags for such a huge wire transfer without someone, anyone picking up a phone. I would think the bank manager, at least would call wondering why they just lost a bunch of potential fee's.

$\"user-pic\"$

cbutler

January 29, 2010 9:09 AM

From Hillary Machinery's website:

\"!!!!!!!!!!!! Small Business Alert !!!!!!!!!!

PlainsCapital Bank Target of Cyber Robbery

Is Your Bank Watching Your Back?

In the cyber world, bank robbers carry keyboards; not guns. And, you will be surprised to learn that not only have banks been alerted by many regulatory agencies, many are still ill-prepared to prevent it, and may not return your money if it's stolen from your account.

In November 2009, PlainsCapital Bank in Dallas, Texas became the target of a cyber robbery. Cyber robbers exploited the vulnerabilities in PlainsCapital Bank's Internet banking system and initiated fraudulent wire transfers and automated clearing house (ACH) transactions and transferred money from one of Hillary Machinery Inc's commercial business accounts to multiple financial institutions and individuals in the US and overseas. Even though the transactions were not actually authorized by a representative of Hillary Machinery Inc and inconsistent with Hillary's specified and/or normal banking practices, the bank still allowed them to occur.\"

--------------------------------------------------------------------------------

$\"user-pic\"$

Coelacanth

January 29, 2010 9:20 AM

I'm surprised the bank isn't being put under investigation for possible AML violations, let alone weak enforcement policies.

January 29, 2010 10:06 AM

$\"user-pic\"$

flyromeo333

I think the bank failed here.
A wire transfer of 800k, which is out of the norm for the customer. why couldnt the bank put a hold on it and contact the account holder for verification? Now a days people lack common sense.

January 29, 2010 10:39 AM

$\"user-pic\"$

Rectilinear Propagation

http://www.ffiec.gov/pdf/authentication_guidance.pdf

This reminds me of this story. A couple sued their bank for not having multi-factor authentication: http://blogs.bankinfosecurity.com/posts.php?postID=297

January 29, 2010 11:12 AM

$\"user-pic\"$

Carmeysays...

Okay if I were the victim I'd be calling Department of Homeland Security first, FDIC second and reporting the bank for aiding and abetting international terrorists, and demanding at least the $100,000 refund after the FDIC, for starters. Third and fourth calls are to press and class action attorney.

January 29, 2010 11:29 AM

1 replies

$\"user-pic\"$

Carmeysays...

You know...food for thought - how would Dillinger / Bonnie and Clyde have handled this? I think that is a fair question to be put personally to the idiots at the bank suing the victim.

January 29, 2010 11:56 AM

$\"user-pic\"$

Corporate_guy

Banks is 100% at fault. If all the security info needed to transfer 800k can be picked up via a keylogger on a single machine, then there is no security at all.

And keep in mind, the bank is only trying to stick the customer with the debt because the bank's insurance company told them the same thing and denied the claim. The insurance company has already ruled that the bank screwed up.

January 29, 2010 11:56 AM

$\"user-pic\"$

Major Annoyance

On the other hand, they (BofA) thought nothing of sending my utility company almost $6k for a $58 electric bill because of a misplaced decimal by their automatic bill pay program, even though I'm on Social Security and that account has never had more than $900 in it at once and my electric bill, which they have paid for me every month for almost five years now has never been over $60.

Of course they got to charge me three overdraft fees and a returned item fee which I had to fight for weeks to get back and the utility company got to add a $10 returned item fee of their own. Not too sure how many flags get raised when the bank doesn't see a chance to make something from it.

$\"user-pic\"$

edison234

January 29, 2010 2:15 PM

Since online banking is an offered service by a bank it is logical that online banking have the equivalent level of security as offline banking? That being said, what would the equivalent type of transaction be at the bank? Could the crooks have accomplished the same result?

$\"user-pic\"$

JFalcon

January 30, 2010 8:49 AM

When you're not at a physical teller booth, there is *some* requirement that you provide enough information in order to ensure you are: a) who you say you are; and b) you are entitled to that transaction.

Society today has moved from the \"teller booth\" to the world of \"online transactions\" everywhere and anywhere as a matter of convenience. Look at \"Tilly the Teller\" and any other Automatic Teller Machine that sprang up (not that they weren't victims of theft) long ago.

It is the fault of the bank for providing convenience to its customer (with what should have been some due diligence into security) or is it the fault of the customer for not securing their credentials?

Granted, there are still some security issued being handled by online financial institutions and in some cases, I do not think they are necessarily responsible for fraud scrubbing; however, The story does help add some criteria that could be used for just that.

It seems like it's a struggle between the bank and the owner as to whom is at fault for the security breach --perhaps they were in cohoots and put their money into a Swiss account that can't be traced.

$\"user-pic\"$

EtherealFlame

January 30, 2010 8:14 PM

I didn't read the full article and am going out on a conspiracy theorist limb here but could it be someone from the company was working with someone in the bank to pull this off and make it look like cyber theft? An inside job sort of thing?

$\"user-pic\"$

quetzalquetzal

February 6, 2010 7:40 PM

i am an it security professional and have done bank audits. there are requirements that need to be met regarding security and authentication. also, a lot of smaller banks tend to outsource their online banking services to firms like fiserve.

most likely, the client's computer systems were compromised and a hacker was able to log user/password for both the bank's system and the client's email.

this could have been prevented by having outgoing ach and wire transfers disabled on the account or by having stronger authenication by using something a hardware authentication token like RSA securid

$\"user-pic\"$

carlogesualdo

February 7, 2010 9:53 PM

The bank is based in Lubbock, but the customer is in the Dallas area, where there are PCB branches. Dallas has been harder hit by the recession than Lubbock has...speaking of the TARP fund issue.