Michigan Firm Falls for Phishing Scam and Loses $560,000, Sues Comerica Bank

Posted 02/16/2010 at 5:35am | by Paul Lilly

5

Comments

Print

Experi-Metal Inc. (EMI), a Michigan-based metal supply company, is suing Comerica Bank alleging that the bank exposed its customers to phishing attacks, and thus is responsible for EMI's financial losses.

EMI fell victim to a phishing scam in which one of the EMI's employees handed over the company's banking credentials. Those credentials were then used to initiate wire transfers totaling $560,000 from EMI's account to numerous other accounts scattered about in Russia, Estonia, Scotland, Finland, China, and the U.S. The funds were quickly withdrawn once the transfers were complete.

Not wanting to eat its loss, EMI alleges that the phishing scam only worked because of Comerica's routine practice of sending emails to its customers asking them to click on a link to update their security information. The lawsuit also criticizes Comerica's token-based authentication system that replaced the company's digital certificates it had been using up until 2008.

"Comerica knew or should have known that the technology of the two-factor authentication procedure which it instituted in 2008 was known to be lacking in any reasonable fortification against 'man in the middle' phishing attacks," EMI said.

Naturally, Comerica sees things differently, pinning the blame squarely on EMI.

"Valid credentials assigned to an EMI employee were used to authenticate a logon for purposes of online banking transactions," the bank said. "If some unknown criminals used those credentials, rather than an EMI employee to whom they had been entrusted, this was caused solely by the actions of that EMI employee."

Image Credit: uberreview.com