U.S. banks and their customers are doing a better job of protecting themselves against cyber attacks that result in thieves taking over commercial accounts, according to a survey released by the Financial Services-Information Sharing and Analysis Center.
In the first half of 2012, just 9 percent of cyber attacks, involving Trojans, phishing and other electronic attacks, resulted in funds leaving banks, according to the survey of 95 financial institutions and five service providers. In 2011, 12 percent of account takeover attempts resulted in money leaving the banks, while in 2009, 70 percent of attacks involved money leaving the banks, said the survey, released Wednesday.
About 2.1 of every 1,000 corporate customers were the target of account takeover attempts in the first half of 2012, compared to 3.4 per 1,000 in 2011, the FS-ISAC said. When funds were lost, wire transfers were the most frequently used method in 82 percent of the cases in 2012, although the use of the banking Automated Clearing House (ACH) network led to more than 50 percent of the losses last year.
The FS-ISAC survey, conducted by the American Bankers Association, didn't estimate the total amount of losses from corporate account takeovers. Losses from corporate account takeovers appear to be dropping in recent years, said Bill Nelson, president and CEO of FS-ISAC, a group launched in 1999 to help banks share cyberthreat information.
The U.S. Federal Deposit Insurance Corporation estimated US$120 million in activity from online banking fraud involving the electronic transfer of funds in the third quarter of 2009.
Losses are "way down" because of a number of factors, including education of corporate customers about cyberthreats, Nelson said. Corporate customers are using new account authentication methods, and some are using computers dedicated only to banking, he said.
In addition, after an uptick of account takeover activity in 2009, U.S. law enforcement agencies cracked down on criminal activity, and a number of banks were hit with lawsuits because of account takeover losses, Nelson said.
"Corporate customers have woken up," he said. "All these things have added up."
Cybercriminals may find a way around new protection methods, and that could lead to an uptick of corporate account takeover in the future, Nelson said.
Effective methods of combating corporate account takeover included customer education, shutting down compromised accounts, manual reviews of large transactions, and analysis of customer log-in patterns, according to the survey. Banks are also looking for anomalous traffic on their networks, the survey said.
