Monitoring and reconciling accounts daily is probably the simplest way. Initiating ACH and wire transfers under dual control is another option: one person authorizes the payment file's creation and another authorizes the release of the file. In addition, workstations used for online banking can be disconnected from internal networks and restricted from use for computing tasks, such as social networking, that can increase exposure to Trojan horses and viruses designed to capture log-in and password information.
Ironically, advances in banking mobility may be introducing more risk for corporate users of online treasury tools. Mobile interfaces provided by some banks now allow a treasurer to initiate or approve wires, track intraday balances, and review and approve positive pay exceptions. But even if mobile platforms simply enable a finance executive to check balances, risk would be heightened because the information could help a cyberthief determine which accounts to target, says Tomasofsky. "Little bits and pieces may not necessarily compromise the account by themselves, but combined they could allow the bad guy to successfully take over an account," he says.
EPN's Romeo stresses that the ACH network itself is safe: corporate account takeovers and other security intrusions happen outside the network, usually with the front-end banking platform. Unauthorized return rates on the ACH network have been dropping steadily.
Meanwhile, use of the network is increasing. Last year about 20% of all payments transactions were made through the ACH system, only slightly less than the percentages made via paper checks and credit-card transactions. With more and more companies offering electronic payments to trading partners and customers, and many still using paper checks with valuable information on them, treasury departments have good reasons to tighten up on payments security.
Reader Comments» Post a comment