Cybercriminals took an average of $32,000 from small business accounts, according to a December survey of owners by the National Small Business Association. And The Associated Press reports businesses don’t have the same legal protection from bank account fraud consumers have.
The Electronic Funds Transfer Act, passed in 1978, states that it’s intended to protect individual consumers from bank account theft, but it makes no mention of businesses. Whether a business is protected depends on the agreement it signs with a bank, says Doug Johnson, a senior vice president with the American Bankers Association, an industry group.
If the business hasn’t complied with any security measures required by the agreement, it could be liable for the stolen money, he says.
Any business is vulnerable, but small companies are less likely to have security departments and procedures to guard against online theft than big corporations do. They also don’t have big revenue streams that are better able to absorb losses from a theft. Even if they get the money back, they still have to spend time and money dealing with the hassles of closing accounts and opening new ones.
Sandy Marsico’s company accounts were attacked—twice. Her bank contacted her in December 2014, saying a transfer of over $50,000 to Mexico had been requested from her checking account.
Marsico, owner of Sandstorm Design, a Chicago-based marketing company, still doesn’t know how the thieves had obtained the account information. The bank did an investigation but didn’t share its findings with her.
Marsico didn’t approve the transfer; the account was closed and a new one opened. But the following November, someone began withdrawing money from the new account in increments ranging from $1,000 to $4,000, a total of $20,000 in the course of a month. Marsico didn’t discover it until she got her monthly statement.
“My stomach dropped when I wasn’t able to identify these as our charges,” Marsico says.
