B.G. Cinema, Shared Hope accounts hit electronically
Thieves electronically looted the business accounts of at least two Umpqua Bank customers, soon after the bank took control of the failed Bank of Clark County in Vancouver.
Clark County businessman Elie Kassab watched more than $81,000 vanish from his Battle Ground Cinema bank account in March. Umpqua was alerted to the thefts and traced the money to several East Coast accounts but was only able to recover $18,193.53 before the money disappeared offshore.
Similarly, Shared Hope International, a Vancouver-based nonprofit for impoverished women, lost $179,000 in May when three unauthorized transfers swept the funds away to a Russian bank. That money was not recovered.
In both cases, Umpqua confirmed the thefts, and identified security breaches in its clients’ computer systems that it says allowed the thieves to access their accounts remotely. Umpqua has since refunded the entire amount lost by Shared Hope but is still battling with Kassab over who’s to blame for the fraudulent transfers.
“We notified Umpqua that they had a problem but representatives from the bank came in to tell us it was our system that allowed the transfers and we had to just accept that we had lost the money,” said former U.S. Congresswoman Linda Smith, founder of Shared Hope, in an e-mail. “They came in the next day and said the money would be replaced in our account. Who knows their (the bank’s) reasoning?”
Umpqua Bank declined to comment on the details of the two cases, saying only that it has systems and policies in place to guard against electronic fraud.
“If at any point there was something we were at fault on, we would recognize that,” said Lani Hayward, a spokeswoman for Umpqua Bank, based in Roseburg, Ore. “We’re not going to try and jerk somebody around if it is our fault.”
Kassab disagrees and says he feels undeservedly yanked around.
“It’s not about the money anymore. We were treated unfairly,” said Kassab, president of Prestige Development, which owns and operates three cinemas, two in Washington and one in Oregon. “We were so diligent … when we discovered the fraud we called (the bank) right away and they didn’t respond.”
Kassab first noticed an unauthorized transfer of $30,000 from his personal account to his business account when he went to pay his bills late in the afternoon one Wednesday in March. After checking that none of his staff had made the transfer he called the bank, which reset his account password.
About 10 minutes later, Prestige vice president Chris Briggs noticed an unauthorized Automated Clearing House withdrawal of $39,334 from the Battle Ground Cinema’s business account. ACH is a national banking service provider. Kassab called the bank back shortly after 5 p.m.; no one answered the phone and a trip by Briggs to the Vancouver branch revealed the office was closed.
Briggs then called Umpqua’s 1-800 customer service number and a representative told him that there was nothing she could do to help.
He remembers asking, “So if someone is taking money from our account right now there is nothing you can do to stop it?”
According to Kassab, by chance, Umpqua employee Kelli Reynolds had returned late to the office and responded to Kassab’s phone message. She sent an e-mail that night to her colleagues at the bank telling them to place a hold on all of the accounts.
The next morning, Kassab learned from Umpqua that another fraudulent withdrawal of $42,000 was set to go out later that day. The bank couldn’t stop it.
“The second ACH had gone out after our account was locked down,” Kassab said.
ACH transfers are used in hundreds of millions of transactions a year, including online bill pay programs and automatic payroll transfers, said Jane Larimer, executive vice president of ACH Network administration for the Electronic Payments Association. But unlike a typical consumer account, which goes through several approval steps, businesses can initiate wire transfers directly and the money is sent within minutes, she said.
The bank immediately refunded all $81,000 lost in the transactions to Kassab and reversed the $30,000 transfer once it learned of the fraud. Two days later, the bank sent an IT consultant to investigate. Using anti-virus software he scanned Kassab’s computer and found the presence of the “Pakes” computer virus along with up to 11 other bots, Trojans and malware, according to internal e-mails copied to Kassab.
At the time, says Kassab, the bank consultant reassured him that the virus and spyware he found were not consistent with the level of fraud Kassab experienced, though there is no written statement to verify that claim.
Kassab hired his own consultant to examine the computer’s hard drive.
“I did not find any viruses on his computer that I believe could have caused it,” said Bryan Spooner, president of Trine Services Inc., Kassab’s consultant. “I doubt they could prove that it came off of his computer.”
In a letter two months later Umpqua asked Kassab for the money back, saying the refund was made on a “provisional” basis and that the fraud was ultimately Kassab’s fault.
“Umpqua Bank has no responsibility for fraud which may have occurred on your client’s (Kassab’s) computer system,” reads a letter from Umpqua to Kassab’s attorney.
Kassab has since been unable to access the $30,622.90 still in the cinema business account, now frozen by Umpqua. And the bank has now written to Kassab’s attorney threatening to sue Battle Ground Cinema for the remaining balance of $33,032.17.
The Federal Bureau of Investigation in November reported that small and medium-sized businesses throughout the U.S. are increasingly targets of electronic fraud using ACH transfers, amounting to $100 million in attempted losses as of October.
Most commonly, a person within the company who can initiate funds transfers is targeted with a “spear phishing” e-mail that contains an infected file or a link to an infected Web site. The link or file contains malware that’s installed on the computer and harvests sensitive account information that can be used by thieves to login.
“I know of no incident where a bank computer has been compromised in our market area,” said Pat Schaefer, CEO of Riverview Community Bank. “Usually the breakdown is on the customer side of the computer by not having protected passwords or firewalls in the computer.”
Detective Joe Vetter with the FBI in Vancouver says he doesn’t have an investigation under way with Elie Kassab or Umpqua Bank and could not comment on his previous contact with them. The FDIC did not immediately return calls seeking comment.
Last week, Kassab placed a legal notice in The Columbian and the Vancouver Business Journal seeking other Umpqua customers who may have experienced the same kind of electronic bank fraud. Except for Shared Hope, Kassab so far knows of no other affected businesses.
Meanwhile, he’s preparing to defend his business against a potential lawsuit from Umpqua, he says.
It is not clear why the Shared Hope case was resolved but the Prestige Development situation remains unresolved.
Kassab’s experience may be a lesson for all small-business owners who do not benefit from the same federal protections that guard consumers against fraud, said the Electronic Transactions Association’s Larimer. While consumers have 60 days to dispute an unauthorized charge by federal regulations, the association’s operating rules for ACH transfers give businesses just two days after the fraud occurs to report the unauthorized activity.
Even though Battle Ground Cinema grosses about $1.5 million to $2 million per year, the annual profit amounts to about half of what the thieves stole, said Kassab.
“If Battle Ground Cinema was my only business, I would have to shut down,” said Kassab. “There’s no protection for small businesses.”
Libby Tucker covers banking for The Columbian. She can be reached at 360-735-4553 or at firstname.lastname@example.org.