Michigan firm sues bank over theft of $560,000
Experi-Metal says Comerica Bank's online security practices resulted in theft
Computerworld - A Michigan-based manufacturing firm is suing its bank after online crooks depleted the company's account by $560,000 via a series of unauthorized wire transfers last year.
In a lawsuit filed in December, Experi-Metal Inc. (EMI) of Sterling Heights blamed the loss on its financial institution Comerica Bank's security practices, and on the bank's alleged failure to heed signs that should have alerted it to the fraudulent activity.
The complaint, filed in Macomb County Circuit Court, demanded that Comerica reimburse EMI for the loss, along with interest, attorney's fees and any other damages the court saw fit to impose. News of the lawsuit was reported by Bankinfosecurity.com earlier this week.
The lawsuit is one of several that have been filed over the past few months involving banks and customers victimized by online theft. In this case, the theft occurred after an employee at EMI supplied the crooks with the company's online banking credentials in response to a phishing e-mail that purported to come from the bank.
The credentials were then used to initiate wire transfers totaling $560,000 from EMI's account to numerous accounts in Russia, Estonia, Scotland, Finland, China, and the U.S. Once deposited, the funds were quickly withdrawn.
In its lawsuit, EMI alleged that the phishing scam had worked only because of Comerica's routine practice of sending e-mails to customers asking them to click on a link to update their security information.
EMI said that between 2000 and 2008, Comerica had used digital certificates to authenticate users to its online banking system. During this time, the bank would send e-mails asking customers to click on a link and submit specific information in order to renew their digital certificates, EMI claimed in its suit.
The complaint also alleged that the token-based authentication system that replaced Comerica's digital certificates was not adequate enough to protect against the kind of attack that resulted in the theft.
"Comerica knew or should have known that the technology of the two-factor authentication procedure which it instituted in 2008 was known to be lacking in any reasonable fortification against 'man in the middle' phishing attacks," EMI said.
"[It was in] reality a downgrade as a security measure from the digital certificate technology that was previously used by Comerica," the company said.
The complaint also faulted Comerica for ignoring signs of fraudulent activity on EMI's account. The company said that it had initiated just two wire transfers in total before the unauthorized withdrawals began.
Then, over a three-hour period, 47 wire transfers and 12 transfer-of-fund requests were initiated from EMI's account. The bank did not check with EMI about the unusual activity for several hours, and even after it was asked not to honor any transfers, the bank did not take action until another 38 wire transfers had taken place, the complaint alleged.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cybercrime and Hacking White Papers | Webcasts