Most of us bank the same way. You open a search engine, type your bank’s name, and click the first result that looks right. Investigators in the United States say criminals have turned that ordinary habit into a way to drain accounts.
On 8 September the US Justice Department announced that a Russian web developer, accused of helping run a large bank account takeover operation, had been extradited to the United States. Prosecutors say the group bought sponsored search engine links that sent banking customers to fake login pages. Victims typed in their credentials believing they had reached their bank.
It is an American case, but nothing about the method is particular to America. Sponsored search placements can be bought by anyone, and a convincing copy of a bank login page is cheap to build. Australian businesses bank online in exactly the same way.
It tends to hurt a business more than an individual. Business accounts usually hold more, transfer limits are higher, and a payment heading out to an unfamiliar account can look like a normal supplier run for a day or two. By the time somebody queries it, the money has moved.
Four habits worth setting this week
- Do not reach your bank through a search. Type the address in yourself, or use a bookmark you saved from a page you know is genuine. The same goes for the ATO, Xero, MYOB and your payroll system.
- Look past the first result. Sponsored links sit above the real ones and are paid placements, not a mark of legitimacy.
- Turn on multi-factor authentication for banking and for the email account that can reset your banking password. A stolen password on its own is then far less use.
- Agree who may approve a payment, and require a second person for anything above a set amount. Most payment fraud gets through because one person could act alone in a hurry.
None of this costs anything. It is a matter of changing how your team reaches the sites that hold your money, and making sure a single stolen password cannot move it.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.