📸

Like any corporate fraud, most bank fraud is committed by insiders, employees, those with access to codes and procedures, who can create a 'paper trail' justifying a transaction. In such cases the fraud is not really different from illegal transactions carried out in the quill pen era: the use of a computer has simply mechanized such fraud and made it more difficult to track.

The new threat to banks comes from hackers. In addition to the familiar duo of the bank robber and the criminal employee — the one bashing through the front door with a shotgun; the other sitting in the back room quietly cooking the books (or frying the audit programs) — banks now face a third security risk: the adolescent hacker with a PC, a modem and the ability to get into the bank's computers from a remote site. Unlike traditional bank robbers, hackers don't come through the front door: they come in through the bank's own computer access ports, then roam unseen through the systems, looking for vulnerable areas. Unlike bent employees, hackers aren't a physical presence: they remain unseen and undetected until it's too late.

Though banks spend millions protecting their computer systems from intruders, they aren't necessarily that secure. Bank employees, particularly those who work in dealing rooms, are notorious for using the most obvious passwords, generally those that reflect their own ambitions: 'Porsche' and 'sex' are perennial favourites. Sometimes even the most basic security precautions are overlooked. In London recently, two hackers demonstrated this point for a Sunday newspaper. They targeted the local headquarters of 'a leading American bank' — one that was so well known for its laxity that its systems had become a training ground for neophyte hackers. The two had first hacked into the bank's computer in March 1988, delving into a section called 'Cashconnector'. (Despite the promise inherent in the name, the section only held information about clients' accounts.) In October 1990 the pair did it again, using the same ID and password they had first employed in 1988. The bank hadn't bothered to modify its most basic procedures, and its first line of defence against hackers, for over two and a half years.

Given such opportunity, it could be assumed that banks are regularly being looted by hackers. The mechanics appear straightforward enough: operating from home a hacker should be able to break

📸