Jim Beddow, CPA

The Wall Street Journal is reporting a huge increase in hacker attacks on small business bank accounts. The hackers are using “spear phishing” emails to small business employees that have bank account access, but this is just one common method. These emails gather usernames and passwords through a fictitious website or a malware keylogger that transmits keystrokes to the thief. They find the usernames and passwords in the keylogger log file, then access the bank accounts remotely, add phony payees and electronically transfer funds from the account. Many small businesses don’t have the resources to protect against this or to recover the funds and they often just absorb the losses.  I’ve personally seen an increase in the number of phishing emails purportedly from financial institutions.

There are many things the small business can do to protect themselves. Consider these steps:

• Use a non-Windows operating system to access bank accounts. Since you’re accessing the bank account through a browser, Ubuntu or Fedora Linux can be used. A bootable CD can be made from many of the Linux distributions. Use that CD in an old machine to access your bank account.
• If you use Microsoft Internet Explorer, make sure you have the latest,  version 8.  Make sure you don’t have version 6. If you do, upgrade. It’s free.
• Protect accounts. You can configure accounts to require two approvals for payment.
• Establish a daily limit on how much can be paid from the account.
• Impose restrictions on adding payees.
• Check balances and scheduled payments at the end of every workday to ensure all are authorized. Electronic payments are usually made in the morning, so you may have time to intervene and stop them.
• Know your rights with the bank and make sure the bank has appropriate controls. Small businesses are suing banks for not having reasonable controls. That assumes the bank has any money and isn’t teetering on the edge of insolvency itself.
• Report losses and connect with the FBI’s InfraGard, a group of businesses, educational institutions and local law enforcement agencies that cooperate to prevent attacks by sharing information.

Read the entire article here: http://online.wsj.com/article/SB10001424052748703483604574630690362605018.html?mod=dist_smartbrief

Very interesting reading.

Comments are closed.