BankInfoSecurity.com - Information Security News, Regulations, & Education

Bank Information Security Articles

Customer Sues Bank After Phishing Attack

Credit
Eligible
As a BankInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info
MI-Based Business Lost $550,000 in Breach
February 11, 2010 - Linda McGlasson, Managing Editor
Share

Comment on this article

A Michigan-based metal supply company is suing Comerica Bank, claiming that the bank exposed its customers to phishing attacks.

A lawsuit filed by Experi-Metal Inc. (EMI) in Sterling Heights, MI alleges that Dallas-based Comerica opened its customers to phishing attacks by sending emails asking customers to click on a link to update the bank's security software. EMI says even though the bank had two-factor authentication using digital certificates for its online banking portal, the phishing scam was able to circumvent these measures.

EMI contends that Comerica's actions opened its online bank account to a successful phishing attack where more than $550,000 was stolen from the company's bank accounts and sent overseas.

News of this suit comes days after news of another Dallas-based bank, PlainsCapital Bank, suing one of its customers in a dispute over a similar hack.

EMI is but one of many companies across the U.S. being targeted by hackers in this fashion. The crimes have become so numerous that federal banking regulator FDIC issued a warning about this form of fraud.

EMI vs. Comerica

The complaint filed by EMI in December in a Michigan circuit court states that for many years Comerica used digital certificates for authenticating online banking. Once a year from 2000 to 2008, the suit alleges, Comerica sent emails to EMI and other bank customers instructing them to click on a link in the email, and then log in at the resulting website in order to renew the Comerica digital certificate.

Click to Get Updates on the Latest Information Security News

Then, in 2008, Comerica began telling its customers to adopt a different security solution -- a security token to use along with user names and passwords. The tokens would generate a random set of numbers to be entered with the customer's user name and password to access the online bank account.

The suit claims that on January 22, 2009, an EMI employee opened and clicked on links within a phishing email that said it was from Comerica. The email duped the employee into believing the bank needed to update its banking software. It gave instructions to the EMI employee to log in at a linked website that mimicked Comerica's online banking site. The EMI employee provided the site with the company's online banking credentials, as well as the code generated by the bank's security token.

The phishers began to quickly move money out of EMI's account. Between 7:30 a.m. and 10:50 a.m. the same day, the phishers made 47 wire transfers to various accounts in Russia, Estonia, Scotland, Finland, China, as well as domestic accounts from which funds were quickly disbursed or withdrawn.

The bank's response says that the EMI credentials were used to initiate the wire transfers and were valid, and the phishing website the employee went to would have been discovered as fake, "to any reasonably alert person who was responsible for safeguarding EMI's financial records and digital credentials."

The bank also says its online security approach was reasonable "because they were in general used by other similarly situated customers of other banks."




Next Related Article:


Question
Question
?We're seeing increasing litigation between banks and customers. Who ultimately will be held accountable for these hacks?
Here's your chance to be a part of the dialogue and engage with your peers! Just enter your comment to the right, click submit to send it to our Editor. All entries are posted anonymously.
Please login if you would like to post a comment on this question.

"There should be a loss share between the bank and the customer. The customer should be held responsible for being phished. The banks security best practices were weak at best, sending links for security updates and allowing 47 wires in 3 hours??
"I agree that this should have been halted in the wire deaprtment!
"The banks will ultimately come to be held responsible if they keep acting as Comerica is reported to be acting. This clearly is a case of the blind leading the blind. There are very few true MFA applications for online banking out there. Just because they (and other banks) use poor MFA and other weak information security procedures does not make it reasonable or secure.
"The leading legal text on privacy & security is "Proskauer on Privacy". A reasonably thorough read will indicate there are many more of these suits to come. I agree with the final poster -- lack of stewardship on the part of both parties facilitated the incident.

It won't be long before some of these suits specifically name executive management, consultants and vended relationships, as their outsourced business arrangements have created an environment of shirked responsibilities and have enabled the rapid adoption of xml-based technologies on unfounded measures of security, productivity and reliability.

By in large, institutions are paying way too much for unneeded application complexity. I keep waiting to see improvements in the contract/purchase process where price is less the subject and what/how comprises more of the agreements.
"This is the huge dilemma that we have created with technology. Who takes the hit when it goes bad? While I agree that banks bear a responsibility to make things as secure as they can, I also think that each individual user of this technology bears an equal amount of responsibility. Everyone wants the convenience that technology offers, but no one wants to take the risks. Doesn't that seem to be the problem, charge full speed ahead, and if I have a problem it surely must be someone else's responsibility to bail me out?

We can go ahead and tighten security on this stuff to the point that there is no risk to anyone. The problem is that it will no longer be functional. So, what do you want: conveninece or absolute security and no responsibility for failure?
"The banks. They are acting with such indifference as far as customers being hurt by ID Theft. I was and am a victim and I was told by a fraud investagator that they deny 9 out of 10 of fraud affidavits. The reason, she said, is that 9 out of 10 people just don't want to pay their bill. I feel so strongly that my money would have been safer under my bed!!!
"I am curious - what is the precedent or is there one yet for this? Both parties hold various types of responsibility here, but the legal responsibility and thus the decision in this case, I'd assume, will be set by precedent.
"Transferring via 47 wire transfers $550,000 to various accounts in Russia, Estonia, Scotland, Finland, China, as well as domestic accounts in a little over 3 hours... This should have been easily been flagged as aberrant behavior to the staff a Comerica that allowed the transfers. Large wire transfers should be validated especially if not in the customer's history. Multiple wire transfers in one day should be validated. Wire transfers off shore to new locations not in the member's history.

Should have been discovered as fake, to any reasonably alert person, who was responsible for safeguarding Comerica's financial accounts. The wire Transfer department was asleep at the wheel.
"Email contact containing links to bank websites is just a non starter. If Comerica has used this method of contacting customers in the past it bears at least partial responsibility for the loss.
"You cannot hold the Bank at fault for this--they provided reasonable security measures (tokens) and are meeting their regulatory responsibility. If the customer chooses to leap-before-they-look and provide information that was not needed, that is their fault. This is similar to a person getting into a car accident and blaming the manufacturer because the driver chose to drive recklessly without their seat belt. I would bet that the Bank likely sent out notices to its customers that they would never ask for that information.
"I would question the bank's fraud detection mechanisms on this one. Was this a normal set of transactions for EMI? If not, then the fraud detection processes should have alerted the customer and frozen the transfers.

I strongly suspect sloppiness on the part of both EMI and Comerica. EMI may not have a strong awareness program. Comerica should not rely on 'other banks are doing it' as an excuse for poor security practices in the past. Legitimate online transactions should have required EMI's 2FA to complete; if it did not, then as far as I am concerned the bank is liable for not requiring stronger authentication.

Don't even get me started on the 'cute little picture and passphrase' slop that is being pawned off as 2FA. It isn't.

Topics of Interest

Vendor Management

National Credit Union Admin.

Compliance

E-SIGN Act

Sarbanes-Oxley Act

FACTA

Latest Tweets & Mentions

BankInfoSecurity.com Research

Recent Blog Entries

More Blogs Posts

Vendor Solutions

  • Lumension Lumension

    Solutions For:

    End-Point Security, Security Configuration Management, Vulnerability Assessment

  • VeriSign VeriSign

    Solutions For:

    Anti-Phishing, Identification and Authentication, Web Services Security, E-Commerce Security

More Vendor Solutions

Marketplace

Advanced Search
Browse Topics
close

Agencies

Anti-Money Laundering


Banking Today

Business Continuity & Disaster Recovery

Compliance

Emerging Technology

Fraud

Governance & Standards

Identity Theft

Leadership & Management


Physical Security

Risk Management

Training & Education