Comments on: How Dave DeSmidt Lost $179,000 Out Of His Retirement Account In One Day – And Why A Few Reforms Are Needed At Brokerages http://www.thesimpledollar.com/2007/01/08/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/ Simple, applicable personal finance advice for the modern world Sun, 22 Nov 2009 01:08:33 -0800 http://wordpress.org/?v=2.8.4 hourly 1 By: Rob in Madrid http://www.thesimpledollar.com/2007/01/08/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/comment-page-1/#comment-51719 Rob in Madrid Mon, 30 Jul 2007 11:12:00 +0000 http://www.thesimpledollar.com/2007/01/07/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/#comment-51719 There is a simple easy solution. In Europe it is quite common to have banks issue unique transaction numbers to prevent hacking, before you can do any online banking. In Germany it's a 5 digit code which is required each time you use the bank. The bank issues you a paper with 100 codes on them and they can only be used once. Deutsche Bank in Spain give you a credit card sized grid that you nee for each transaction (for example H-02 = 21) While this isn't 100% secure (nothing is) it prevents anyone who has you password and account number from accessing you funds. Interestingly enough I got caught off guard by the new Canada Trust secrity mesaures. You have to answer 5 questions and I couldn't remember the answers so I got locked out. As Doug said I had to get to a live person to reset my password. Of course in the interest of security I wrote down all the questions and answers :) so I don't get locked out next time. The other problem will always be that America is the largest country in the world and English the language of business and as such will always be prime territory for hackers and thieves. It also doesn't help that Banking in America is run on security lite. There is a simple easy solution. In Europe it is quite common to have banks issue unique transaction numbers to prevent hacking, before you can do any online banking. In Germany it’s a 5 digit code which is required each time you use the bank. The bank issues you a paper with 100 codes on them and they can only be used once. Deutsche Bank in Spain give you a credit card sized grid that you nee for each transaction (for example H-02 = 21) While this isn’t 100% secure (nothing is) it prevents anyone who has you password and account number from accessing you funds.

Interestingly enough I got caught off guard by the new Canada Trust secrity mesaures. You have to answer 5 questions and I couldn’t remember the answers so I got locked out. As Doug said I had to get to a live person to reset my password. Of course in the interest of security I wrote down all the questions and answers :) so I don’t get locked out next time.

The other problem will always be that America is the largest country in the world and English the language of business and as such will always be prime territory for hackers and thieves. It also doesn’t help that Banking in America is run on security lite.

]]> By: jake http://www.thesimpledollar.com/2007/01/08/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/comment-page-1/#comment-5196 jake Mon, 05 Feb 2007 12:09:37 +0000 http://www.thesimpledollar.com/2007/01/07/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/#comment-5196 Well some places are great with helping you get your money back. My cousin had his check book stolen along with his check card. They with drew about $3000 total from his account. Bank of America immediately returned the amount, then did an investigation. But I must say that he was lucky in the sense that the people who used his check didn't even signed in his name. It was a completely different name. I am sure the bank saw that and couldn't argue. Well some places are great with helping you get your money back. My cousin had his check book stolen along with his check card. They with drew about $3000 total from his account.

Bank of America immediately returned the amount, then did an investigation. But I must say that he was lucky in the sense that the people who used his check didn’t even signed in his name. It was a completely different name. I am sure the bank saw that and couldn’t argue.

]]> By: Trent http://www.thesimpledollar.com/2007/01/08/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/comment-page-1/#comment-2819 Trent Tue, 09 Jan 2007 04:12:13 +0000 http://www.thesimpledollar.com/2007/01/07/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/#comment-2819 Jeff: they only did this because of the PR. Doug: I agree completely with this. Most people double-click on every attachment they get and also don't turn on Windows Firewall (even at a minimum). It's just amazing more people aren't caught. My point is that brokerages are transacting things in this unsecure environment and they can take steps to make things more secure. Jeff: they only did this because of the PR.

Doug: I agree completely with this. Most people double-click on every attachment they get and also don’t turn on Windows Firewall (even at a minimum). It’s just amazing more people aren’t caught. My point is that brokerages are transacting things in this unsecure environment and they can take steps to make things more secure.

]]> By: Doug Alder http://www.thesimpledollar.com/2007/01/08/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/comment-page-1/#comment-2818 Doug Alder Tue, 09 Jan 2007 04:00:20 +0000 http://www.thesimpledollar.com/2007/01/07/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/#comment-2818 I should also mention that financial institutions need to spend more time educating their customer facing staff in the tactics of social engineers. No amount of electronic security on their part can compete against a a good social engineer and a naive employee. I highly recommend people read Kevin Mitnick's book "The Art of Deception". He is a master social engineer and did the time to prove it. I should also mention that financial institutions need to spend more time educating their customer facing staff in the tactics of social engineers. No amount of electronic security on their part can compete against a a good social engineer and a naive employee. I highly recommend people read Kevin Mitnick’s book “The Art of Deception”. He is a master social engineer and did the time to prove it.

]]> By: Doug Alder http://www.thesimpledollar.com/2007/01/08/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/comment-page-1/#comment-2816 Doug Alder Tue, 09 Jan 2007 03:45:45 +0000 http://www.thesimpledollar.com/2007/01/07/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/#comment-2816 Most people who are victims like this are so because their home computers have become compromised and they don't know it. By necessity in my work I have become an expert in online fraud. I deal with victims of fraud like Dave DeSmidt on a daily basis. You 3 steps are good but they can be out witted by a good thief, especially if the victim is careless. Part of that non-internet accessible database must be safety phrases that only the account holder will know. This is necessary as there must be some mechanism in place that allows the account holder to update their information , specifically phone numbers and mailing addresses. At no time should email be used as an authentication mechanism (I've seen numerous times situations when a computer has been compromised and the thieves are monitoring the client's email in real time and responding to verification emails then removing any trace of the from the system). If the victim is silly enough to keep that pass phrase on their computer then there is no level of security at the financial institution that will prevent their account from being ripped. I know with my bank (TD Canada Trust) I can not make any inquiries about my account or any changes to my personal information without going through a live support person and answering several questions only I know the answer to. I am comforted by that. I urge everyone with a computer to take the most basic precautions. 1. Use a good AV program and keep it updated (AVG is free and good) 2. Use a personal software firewall that looks atr outgoing connections as well as incoming (Zone Alarm makes an excellent free one) 3. Get a router (not a hub, not a plain switch) and put it between your computer and your ADSL or Cable modem (average lifespan of a windows computer on the net without protection is 20 minutes before it is thoroughly compromised). You can get a decent one for about $80. 4. If you get a wireless router make certain you use the 128bit encryption and set a very difficult password. Better and safer would be to go wireline not wireless. Don't think you'll simply "know" when our computer is compromised. You won't unless the hacker is careless. Take the above precautions at a minimum. Most people who are victims like this are so because their home computers have become compromised and they don’t know it. By necessity in my work I have become an expert in online fraud. I deal with victims of fraud like Dave DeSmidt on a daily basis.

You 3 steps are good but they can be out witted by a good thief, especially if the victim is careless. Part of that non-internet accessible database must be safety phrases that only the account holder will know. This is necessary as there must be some mechanism in place that allows the account holder to update their information , specifically phone numbers and mailing addresses. At no time should email be used as an authentication mechanism (I’ve seen numerous times situations when a computer has been compromised and the thieves are monitoring the client’s email in real time and responding to verification emails then removing any trace of the from the system). If the victim is silly enough to keep that pass phrase on their computer then there is no level of security at the financial institution that will prevent their account from being ripped.

I know with my bank (TD Canada Trust) I can not make any inquiries about my account or any changes to my personal information without going through a live support person and answering several questions only I know the answer to. I am comforted by that.

I urge everyone with a computer to take the most basic precautions.

1. Use a good AV program and keep it updated (AVG is free and good)
2. Use a personal software firewall that looks atr outgoing connections as well as incoming (Zone Alarm makes an excellent free one)
3. Get a router (not a hub, not a plain switch) and put it between your computer and your ADSL or Cable modem (average lifespan of a windows computer on the net without protection is 20 minutes before it is thoroughly compromised). You can get a decent one for about $80.
4. If you get a wireless router make certain you use the 128bit encryption and set a very difficult password. Better and safer would be to go wireline not wireless.

Don’t think you’ll simply “know” when our computer is compromised. You won’t unless the hacker is careless. Take the above precautions at a minimum.

]]> By: Jeff http://www.thesimpledollar.com/2007/01/08/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/comment-page-1/#comment-2808 Jeff Tue, 09 Jan 2007 01:00:33 +0000 http://www.thesimpledollar.com/2007/01/07/how-dave-desmidt-lost-179000-out-of-his-retirement-account-in-one-day-and-why-a-few-reforms-are-needed-at-brokerages/#comment-2808 I totally agree with the overall point you're making, Trent, but I do think you ought to state, as the original post does, that in the end J.P. Morgan did refund the guy's money. Especially since they are not legally required to do so. I totally agree with the overall point you’re making, Trent, but I do think you ought to state, as the original post does, that in the end J.P. Morgan did refund the guy’s money. Especially since they are not legally required to do so.

]]>