Lex Cyber - Cyber Law Portal

Home

Scammers Randomly Target Checking Accounts

Posted at 02:00 PM ET, 05/ 3/2007

Posted by Brian Krebs

An alarming report published this week on the official Internet news service of the U.S. Air Force highlights the need for consumers to keep a close eye on their bank account statements for signs of fraud

The piece tells the story of an investigation launched after an Colorado airman discovered that his bank account was $124.90 less than it should have been. The man's bank, a Peterson AFB branch of 5-Star Bank, found that scammers apparently generated random account numbers, into which they tried to deposit one cent. When one of the tiny deposits clears, the criminals know they've hit upon a live account and begin to withdraw funds from it.

Turns out the crooks had automated the process: The charges appeared to be coming from Equity 1st Mortgage, based in Wilmington, N.C.. An employee at the mortgage company said it had not made the charges, but that she'd handled approximately 100 phone calls from scam victims since at least 2006. In every case the amount withdrawn was the same and occurred at the beginning of the month, no doubt to stay well ahead of the issuance of end-of-the-month bank statements.

The story notes that the scammers appeared to be taking advantage of validation weaknesses among businesses using the automated clearinghouse (ACH) system, a private electronic payment network that links banks with one another via the Federal Reserve. The network is used by banks to process large volumes of payroll, credit and debit card transactions, but it also facilitates direct payment of consumer bills such as mortgages, loans and utility bills, as well as business-to-business and federal, state and local tax payments.

Avivah Litan, a fraud analyst with Gartner Inc., said many banks have no real-time validation mechanisms in place to detect fraudulent ACH transactions, although that deficiency is starting to get the attention of federal regulators.

"All it takes is a routing number and knowing the numbering scheme on one account number, and then the fraudsters just increment the numbers and do the deposits, all of which can be done in an automated batch program," she said. "The ACH system was really designed for bank to bank transfers, and until recently it was a closed system that wasn't open to the general public."

Today, the ACH system is used by millions of consumers and businesses to initiate debits and pay bills online. According to NACHA-The Electronic Payments Association, which develops operating rules and business practices for the ACH system, Internet-initiated ACH payments grew by an estimated 35 percent in 2006 to 1.8 billion. NACHA estimates that 85 percent of Internet-initiated ACH payments are to pay bills via companies' or billing services' Web sites, and 10 percent are to transfer funds.

ACH fraud poses far more of a risk to businesses than it does to consumers. By law, consumers have up to 60 days to dispute a debit against their accounts, whereas businesses are given just 48 hours.