When nearly $20,000 vanished from the bank account of Bluffton business owner Sandra Benson in early July, she immediately notified her bank.
But after reporting the fraud to Atlantic Community Bank, the Bluffton Police Department and even the FBI, Benson found out her business, Custom Audio Video, wouldn't get its money back.
Now, she wants to spread the word that small-business owners who use online banking for work may not have as much protection as they think.
That's because, as Benson discovered, the law does not protect businesses from cyber fraud in the same way that it protects individual consumers.
If the money had been stolen from Benson's personal account, a federal law known as Regulation E would have required Atlantic Community Bank to refund her. Regulation E protects consumers from unauthorized transactions.
It doesn't protect businesses. Since the money was stolen from Custom Audio Video, which designs and installs home entertainment centers, bankers told Benson that reimbursing the loss was not their responsibility.
Bank president Robert Trask said he empathizes with Benson's plight and that Atlantic Community Bank is a small business, too. However, the bank's investigation into the fraud found that Atlantic Community Bank's customer data had not been compromised, he said.
Trask would not comment further on fraud protection offered by Atlantic Community Bank, citing "customer confidentiality."
"We are only able to police our end of the transaction, which we do vigilantly," Trask said. "If an individual is banking or doing any business through a computer or mobile device, that individual also needs to ensure that their device is secure and that all security software is up to date."
Benson said an FBI agent told her hackers probably had infiltrated her computer and monitored keystrokes to find out her business account user name and password.
On July 2 and 3, the hackers made two transfers of slightly less than $10,000 from Custom Audio Video's accounts. One transfer went to Idaho Falls and the other to Virginia.
Atlantic Community Bank staff members investigating the fraud contacted police in Idaho Falls. Investigators there found the scam went deeper, according to an Idaho Falls police report provided by Benson.
An Idaho woman said she had been hired by a man online to accept money into her account and quickly wire it to Ukraine.
Such "money mules" are commonly used by overseas cyber crooks, Benson soon learned.
Most of the elements of the cyber attack on Benson are not unusual. A 2011 Business Banking Trust Study found that 56 percent of businesses had experienced a bank fraud attack in the past 12 months. The study, commissioned by Guardian Analytics and the Ponemon Institute, found that banks failed to catch the illegal transfers in 78 percent of the cases.
After being hit with cyber crime, many business banking customers are likely to switch banks. That's what Benson did. She said she won't use online banking with her next bank either.
Benson said the loss of the money probably would have shut down her business several months ago. These days, revenue is up, so Custom Audio Video will go on -- provided that vendors give her an extension on bills, she said.
"I feel I've been remiss in doing my homework," she said. "For the small-business owner, it's frightening. In my situation, it has been devastating."