A coalition of banks, financial trade associations, federal regulators, and law enforcement agencies is studying a variety of best practices and technologies to thwart the criminal hijacking of accounts and other bank account scams.
The effort, led by the Financial Services Information Sharing and Analysis Center (FS-ISAC), aims to provide recommendations for preventing, detecting and responding to account takeover, said Bill Nelson, FS-ISAC president and CEO.
Dozens of organizations are involved, including the FBI, the FDIC, the American Bankers Association, and providers of banking services, along with banks of all sizes, he said.
Criminals have been using malware like the Zeus Trojan to steal online banking credentials and drain corporate accounts through fraudulent ACH and wire transactions. Small businesses, municipalities and nonprofits have been particularly hard hit. The FS-ISAC, along with the FBI and NACHA, which oversees the ACH network, issued an alert about the fraud surge last August.
Nelson said the coalition isn't just looking at corporate account takeover, but account takeover in general because consumers are getting hit by the fraud too. The group is also addressing non-cyber attacks, such as those that use the phone channel to steal banking credentials and hijack bank accounts.
Education of customers is key, and the coalition is looking at best practices for education and awareness but also is looking at techniques and technologies that can help prevent bank account scams, he said.
"We know there's no silver bullet, but there are some areas we want to look at," Nelson said.
Some of those technologies include out-of-band transaction authentication and transaction profiling or predictive analytics to watch for anomalies. The credit card industry has done a great job at spotting potential fraudulent activity, for example, by alerting a customer when his card is used in a place he's never been before like Singapore, he said.
"Banks are very interested in cost-effective solutions for this," Nelson said.
How to securely share information about money mule activity and how banks can respond to the money mule problem is another an area the group will address, he said.
Criminals keep changing their tactics to avoid detection of their bank account scams. Last summer, they were often making fraudulent withdrawals under $10,000, apparently in an attempt not to trigger Suspicious Activity Report (SAR) requirements. Now, there are reports of fraudulent $500 transactions, Nelson said.
"They'll wipe out your account in $500 increments," he said, adding, "Whenever there's an obstacle, these guys find a way around it."
The coalition was scheduled to hold its first meeting Wednesday and hopes to produce actionable advice this summer.