|CALCULATORS|BANK LOCATIONS|ATM LOCATIONS|EMPLOYMENT|CUSTOMER SERVICE
Business Online Banking Threat
The security and integrity of our online services is a top priority at MidWestOne Bank. This is why we felt it necessary to make our customers aware of an elevated risk of electronic funds transfer (EFT) fraud affecting mostly small to medium-sized businesses.
According to several government agencies, Web-based commercial EFT origination applications are being targeted by criminals using malicious software, including Trojan horse programs, keystroke loggers, and other spoofing techniques designed to avoid online authentication controls.
There has been an increase in the number of reports and the amount of losses from unauthorized EFT’s, such as automated clearing house (ACH) and wire transfers. In most cases, the fraudulent transfers were made from business customers whose online business banking credentials were compromised.
Typically, the compromise is carried out through a "spear phishing" e-mail which names the recipient correctly and contains either an infected file or a link to an infected Web site. The e-mail recipient is generally a person within a company who can initiate funds transfers or payments on behalf of the business. Once the user opens the attachment or clicks the link to open the Web site, malware is installed on the user's computer and collects the user's corporate online banking credentials. Users computers can also be infected by drive-by downloads when visiting Web sites hosting malicious code that exploits browser vulnerabilities.
The fraud is carried out when the fraudster creates another user account from the stolen credentials or directly initiates a funds transfer masquerading as the legitimate user.
Recommendations
There are several actions you can take that will contribute to online banking security. Among them:
Account Controls
- Initiate wire payments transfers and ACH under dual control, with a transaction originator and separate transaction authorizer.
- Reconcile all transactions on a regular basis. Daily, if possible.
- Consider account services that may aid in monitoring account activity, such as positive pay.
Best Practices
- If you perform high value or a large number of online banking transactions, consider a stand-alone, hardened PC used only for this purpose.
- Be suspicious of emails purported to be from the bank, government agency, or any source that is requesting account information, account verification or banking access credentials such as user names, passwords, or similar information.
- Opening file attachments or clicking on web links in suspicious emails may expose your system to malicious code.
- If you have broadband or a dedicated connection to the internet, install a dedicated, actively managed firewall.
- Use strong passwords at least 10 characters in length with a combinations of letters, numbers and special characters.
- Prohibit the use of “shared” usernames and passwords for online banking access.
- Change your password regularly.
- Limit administrative rights on user’s workstations to help prevent the inadvertent downloading of malware and other viruses.
- Ensure virus protection and other security software is updated regularly, as well as operating system and key application security patches. Consider installing spyware protection programs.
- Verify use of a secure session (https not http) in the browser for all online banking.
- Avoid using automatic login feature that save usernames and passwords for online banking.
- Do not use a workstation from an untrusted source to access online banking.
Notification
- Notify staff with access to online banking so they can take precautionary steps.
- Notify the bank if you receive any communication requesting account information or access credentials
- Immediately escalate any suspicious activity or transactions to the attention of the bank, particularly wire transfers or ACH.
Finally, we recommend that you familiarize yourself with your account agreement and Online Cash Manager Agreement and Disclosure Statement. A good understanding of these will aid in answering any questions you may have regarding roles and responsibilities related to the use of online banking.
At MidWestOne Bank, we want to be your trusted partner and strive to ensure your online banking experience is safe and secure. If you have any questions, please contact us at 1-800-247-4418.
