Internet Banking-Related Security Suit – A Case of Man Bites Dog

I have been monitoring the case of Plainscapital Bank and Hillary Machinery since the news broke in November that more than $800K was apparently stolen from Hillary via the fraudulent initiation of wire transfers by criminals probably in Eastern Europe.

I have been monitoring the case of Plainscapital Bank and Hillary Machinery since the news broke in November that more than $800K was apparently stolen from Hillary via the fraudulent initiation of wire transfers by criminals probably in Eastern Europe.  Brian Krebs recently posted a nice update article, which provides the necessary background.  In an ironic twist the bank has actually filed a suit against its customer, Hillary Machinery.  What the bank is looking for from the court is a “judgment that its security procedures are commercially reasonable” and thus it should not be held responsible for the remaining unrecoverable monies.  While I certainly can’t pretend to sit in judgment on this particular case, since likely only some facts are on the table, the case provides a good framework to discuss the key issue of what is a commercially reasonable level of security and who is primarily responsible for online security.

Some points I would like to make around this from a security professional’s point of view are:

  • The primary responsibility for security should fall on the provider of the application or service, in this case Plainscapital Bank. Any security system whose function hinges on the user doing the right thing, is broken. The security system should always presume that the user will lose what should not be lost and will do and say what should not be done and said. Any important system, whether a spaceship, car, or security system, must start with the presumption that humans are unreliable.

  • Was the bank in compliance with the FFIEC (a banking regulator) guidance published nearly 5 years ago that specifically addressed the security of online banking transactions? Quoting from this FFIEC report: “The agencies consider single-factor authentication, as the only control mechanism, to be inadequate in the case of high-risk transactions involving access to customer information or the movement of funds to other parties.” If the bank was only using single-factor authentication complemented by other compensating controls that totally depended on the user doing the right thing, then I think the conclusion on reasonableness becomes obvious.

  • Multiple-factors of authentication – using an authentication factor that the user can’t wittingly or unwittingly “give away” – has been commercially available for many years. It doesn’t sound like the bank was using a more reliable system of user authentication. While there was some discussion in the article around having customers “register” their computer’s Internet address, presumably to act as another authentication factor, apparently this request was sent via email, which is not the most reliable system of communication. This approach also ignores the fact that Internet addresses can be easily spoofed and thus should not be significantly relied upon as a factor of user authentication. Security practitioners know that there are forms of multi-factor authentication that can be deployed without the user even knowing that it is happening.

  • Risk-based authentication. Beyond multi-factor authentication discussed above many financial organizations use what is known as risk-based authentication to weigh the risk of certain on-line transactions (such as wiring large amounts of money) as measured by looking at certain factors, such as whether the customer is using his normal computer, the geographical location of the requester, how strongly the user has been authenticated, whether the financial counterparty is a new one or a long standing one for this particular customer, etc.

Based on what I have written above you can probably guess how I would rule if I were the judge on the case and the facts were as I assumed.  The fact of life is that there are serious criminals out there trying to steal money from all of us.  It is imperative that organizations remain vigilant and not rely on the users as their primary line of defense.

Written by

Matthew Gardiner

Published in

View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!


    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website.



  • king lear

    testing comment functionality, please do not publish this

  • Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.

    Nice Post and Timely!


    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.