updated 7/16/2013 6:19:30 PM ET 2013-07-16T22:19:30



Under federal law, private, or "retail," customers in the United States are largely insured against such fraud. But no such protections apply to commercial clients, whose huge losses can lead to bankruptcy.

Yet many owners of small and medium-size businesses are unaware of the risks of online banking. Stories of businesses being cleaned out by cybercriminals, and then not recompensed by their banks, rarely make it beyond local newspapers.

Here's how to avoid being the next victim.

Understand the risks

Cybercriminals target small and medium-size businesses for two important reasons.

First, many business owners often have a limited understanding of Web-based threats and hence fail to implement the necessary protections.

Second, small and medium-size businesses generally have far more money in their bank accounts than consumers do.

Limited protection, combined with high account balances, makes such businesses an attractive target for cybercriminals.

Small and medium-size businesses are generally unaware of three key points regarding to online banking, said George Tubin, senior security strategist for Israeli banking-security company Trusteer and former industry analyst for the banking community.

Highly sophisticated malware, often in the form of banking Trojans, is being used to compromise hundreds, if not thousands, of business bank accounts; the measures many banks have in place don't effectively protect businesses against these types of attacks; and in many cases, banks will hold business customers liable for online fraud losses.

[ 12 Security Tips for Small Businesses ]

How to guard against risks

There are several large risks for businesses that use online banking services.



— Fraudulent or corrupted websites, which can silently infect Web browsers; and


To best protect business owners from potential online-banking dangers, Dan Ingevaldson, chief technology officer of Sunrise, Fla.-based transaction-security firm EasySolutions, provided the following tips.

Manage your risks: Small and medium-size businesses need to move beyond the mindset that they are too insignificant to be targeted by criminals.


Nearly half of small-business owners have no protocols in place for securing data, and have no one directly responsible for managing data security.


Use a browser that's not on the hard drive: Extending fraud prevention to the computer in the form of a secure browsing platform can dramatically reduce fraud-related losses and is relatively inexpensive and easy to set up.

Such a hardened browser, typically stored and run from on a USB drive, creates a protected connection to the financial institution's website.

Since transactions can only take place via the hardened browser and a secure proxy server, any malware that exists on the user's computer is "blind" to the exchange of customer information.

Essentially, the device turns the user's computer into a dedicated machine for online banking that isolates critical data from the cybercriminal's prying electronic eyes.

Such an approach is effective, yet does not place an excessive or unrealistic compliance burden on the customer.

For serious security, boot the computer from a "live" Linux distribution burned to a CD and use the included browser to access the online account. Malware can't write to or otherwise alter a burned CD.  

Choose your bank wisely: Financial institutions are among the most sophisticated organizations in the world when it comes to deploying advanced security technology, but not all are equal.

Select your bank based upon the security features it offers to commercial customers. Many banks provide additional account-security features above and beyond what is offered to retail banking users.

Keep your software updated: Many forms of malware can sneak into a computer through old or unpatched Web browsers, which present a serious risk to users.

Even when a software vendor has issued a fix for a vulnerability, the end user will often need to be reminded to install it. Take the guesswork out of the equation: Set up your PC and its applications to automatically load and install software updates.

Dedicate a computer to online banking: To prevent online fraud, the FBI and the American Bankers Association recommend designating a single computer that handles only online banking activities.

Because emailing and Web surfing account for nearly all infections, those activities should not be allowed on that machine.

A dedicated PC is not a practical recommendation for retail banking, but in the commercial sector, it's a powerful technique used to prevent or mitigate the risks associated with online banking.



© 2012 TechNewsDaily


Discussion comments


Most active discussions

  1. votes comments
  2. votes comments
  3. votes comments
  4. votes comments