Fraud Alert – Reports of Fraud Attempts Involving ACH Transactions

In an effort to protect your company against fraud, we would like to alert you to the following fraud trend involving ACH transactions.

The Federal Bureau of Investigation (FBI) and other Federal government agencies have reported an increase in funds transfer fraud attempts involving the exploitation of online banking services belonging to small and medium sized businesses.

How does ACH Fraud occur?
A victimized company will receive a "spear phishing" email which contains either an infected file or a link to a malicious website. The email is generally sent to a person within a company who can initiate funds transfers or payments on behalf of the business. Once the user opens the attachment, or clicks the link to open the website, malware is installed on the legitimate user’s computer. The malware, which can consist of a Trojan keystroke logger, may possess the ability to capture the user’s corporate online banking credentials (including username and password) and could allow the fraudster the ability to remotely access and control the compromised computer. Often, these spear-phishing messages appear to be from reputable organizations.

The fraud is carried out when the fraudster, masquerading as the legitimate user, creates new ACH batch participant records, schedules payments, and submits them for processing. These transfers occur through wire transfers or ACH transactions that are directed to the bank accounts of willing or unwitting individuals recruited to act as mules or “foreign funds transfer agents”. Often within a couple days, or even hours of the unauthorized online access, money is deposited and immediately forwarded to overseas accounts by various means.

How can you protect your company?
Your security is our top priority, so we’ve provided the following tips recommended by the FBI on how to protect your company from online fraud.

Protect Your Accounts:

• Protect your online banking accounts by establishing check cashing limitations with our “Positive Pay” service, setting appropriate daily limits for wire transfers and ACH batches appropriate for your business. Additionally, consider setting appropriate ACH filters and blocks to protect your accounts from possible fraudulent inbound transactions. Please contact Sterling’s Treasury Management Department at 1-866-339-6847 for more information.
• Reconcile all banking transactions on a daily basis. Alerts can provide additional level of security and awareness for online banking users. Alert notices can be received by email, phone, fax or text message and are available for ACH/Wire approval notice, for secondary approval, balance thresholds, incoming and outgoing wire transfer notices and positive pay exception items.
• Initiate outbound ACH and wire transfer payments under dual control, with a transaction originator and a separate transaction authorizer.

Protect Your Computer Systems:

• Use best practices to secure computer systems in your business including but not limited to:
  • If possible, in particular for high value or large numbers of online transactions, carry out all online banking activities from a stand-alone, hardened and completely locked down computer system from which email and web browsing are not possible.
  • Be suspicious of any email claiming to be from Sterling Savings Bank, another financial institution, government department or other agency requesting account information, account verification or banking access credentials such as usernames, passwords, PIN codes and similar information. Opening file attachments or clicking on web links in suspicious emails could expose your computer system to malicious code that could hijack your system.
  • Install a dedicated, actively managed firewall. A firewall limits the potential for unauthorized access to a network and computers.
  • Create a strong password with at least 10 characters that include a combination of mixed case letters, numbers and special characters such as “!”, “@”, “#”, “$”, “%”, “&”, “*”, “(“, “+”, “=”, “?”, and/or “;”.
  • Prohibit the use of "shared" usernames and passwords for online banking systems.
  • Use a different password for each website that is accessed.
  • Change your password(s)/pass-phrases every three months and select one that is hard to guess.
  • Never share username and password information for online services with third-party providers.
  • Limit administrative rights on users' workstations to help prevent the inadvertent downloading of malware or other viruses.
  • Install commercial anti-virus and desktop firewall software on all computer systems.
  • Ensure virus protection and security software are updated regularly.
  • Ensure computers are patched regularly particularly operating system and key application security patches. It may be possible to sign up for automatic updates for the operating system and many applications.
  • Install anti-spyware detection programs.
  • Clear browser cache before starting an online banking session in order to eliminate copies of web pages that have been stored on the hard drive.
  • Verify use of a secure session (https not http) in the browser for all online banking.
  • Avoid using an automatic login features that save usernames and passwords for online banking.
  • Never leave a computer unattended while using any online banking or investing service.
  • Never access bank, brokerage or other financial services information at Internet cafes, public libraries, etc. Unauthorized software may have been installed to trap account number and sign on information leaving your business vulnerable to possible fraud.
  • Immediately escalate any suspicious transactions to Sterling Savings Bank or any other financial institutions involved, particularly for ACH or wire transfers. There is a limited recovery window for these transactions and immediate escalation may assist us in preventing further losses to your company.

Suspect You’re a Victim of Online Fraud?
If you suspect your company is a victim of fraud, there are a number of immediate steps the FBI and Sterling Savings Bank recommend you should take to help protect your financial interest including:

1. Cease all activity from computer systems that may be compromised. Unplug the Ethernet or cable modem connections to isolate the system from remote access.
2. Immediately report the fraud to your local Sterling branch or call us at 1-800-650-7141.
3. Contact your local police department.
4. Report the fraud to the Federal Trade Commission and the FBI's Internet Fraud Complaint Center.
5. Have your company’s network and systems reviewed by a qualified computer forensic/information security professional.

Make sure to also maintain a written chronology of what happened, what was lost and the steps taken to report the incident to the various agencies and firms impacted. Record the date, time, contact telephone number, person spoken to, and any relevant report or reference number and instructions.

There is a limited recovery window for these transactions, immediate escalation may allow us to initiate recovery efforts on your behalf before the window closes and prevent further losses to your company.

For more information about fraud/identity theft and how to avoid it, please visit the Federal Trade Commission website for additional fraud prevention tips.