Shingle by shingle, Kris Markiewicz built a business of eco-friendly roofing tiles. In February of last year, Markiewicz says he became the victim of a crime that took a hit on his company. It started when he couldn’t log into his business’ online banking account.
According to Markiewicz, he immediately called Chase Bank and learned it had blocked a $20,000 wire transfer. He says he never initiated the transfer and doesn’t have wire transfers set up on his account.
After he got his login information straightened out, Markiewicz says he logged into his Chase Bank account and saw another wire transfer for $23,000. The small business owner says he called Chase Bank again and was told it could take up to five days to investigate.
Markiewicz was confident the $23,000 wire would be stopped. But according to him, Chase Bank closed the case later that day and he was out the money.
Chase’s denial said “Unfortunately, we denied the claim because a known device was used to initiate the transaction”. Markiewicz believes someone made the transfer using his credentials.
Chase Bank told NBC 5 Responds when money is sent with a wire transfer it’s like sending cash. It’s highly unlikely you’ll get it back if something goes wrong. It went on to say, “We’ve reviewed Mr. Markiewicz’s case and confirmed the transaction was authorized. The transaction was initiated from the customer’s known device for verification and was confirmed twice via one-time passcodes sent to his phone number.”
Markiewicz told NBC 5 Responds he never got any messages about these transfers to his phone. And no one else had physical access to his devices.
Chase Bank said it asked Markiewicz for evidence his device was hacked, but he couldn’t prove it.
Digital forensics expert David Chronister told NBC Chicago that level of proof is exceptionally rare in wire fraud investigations.
“The problem we run into is the same system that the attacker compromised has the evidence we would use for the investigation and the hacker cycle is to Identify vulnerability, exploit it, create access to it, and cover your tracks,” Chronister said. “It’s pretty typical, you’re not going to have any evidence to prove it.”
Key takeaways for protecting sensitive accounts:
- Use a password generator but don’t use one on your web browser. Those maybe susceptible to hackers, according to Chronister.
- Come up with your own password using easy to remember lyrics to songs.
- Spam filters can be useful for weeding out unwanted texts, but they cause to miss legitimate alerts, too.
