Hong Kong police struggle to stop brokerage hacking spree

By Michelle Price HONG KONG (Reuters) - Hong Kong police are struggling to deal with digital pump-and-dump schemes targeting brokerages - a little-known type of computer-generated fraud that surged in the Chinese territory last year. Although the money involved was small - only about $20 million worth of shares - there were 81 such incidents reported in 2016, more than triple the number in 2015, according to police. In the scheme, criminals invest in thinly traded penny stocks and then manipulate their share prices by ordering trades from hacked brokerage accounts. They earn profits by selling before the fraudulent trades are reported. After last year's cyber-heist of $81 million at Bangladesh's central bank and a series of hacks of ATM's around the world, authorities fear such pump-and-dump schemes could be increasingly used for electronic theft. Hong Kong is a favored place for such attacks because of the number of thinly-traded penny stocks in the territory and because its securities industry has fallen behind other financial centers in defending against cyber fraud. At least seven brokers and eight banks have been targeted in Hong Kong, including HSBC Holdings Plc and Bank of China International (BOCI) Securities, according to regulators and people familiar with confidential investigations. A spokesman for HSBC declined to comment. A spokeswoman for BOCI Securities said he could not comment on its case but the brokerage would continue to invest in IT security. "If you ask regulators in the industry what is the number one threat, not surprisingly it’s all about cyber attacks," Ashley Alder, CEO of the Hong Kong Securities and Futures Commission (SFC) and chairman of the International Organization of Securities Commissions, said in a speech to the local legislature last week. "We've seen that happen not only in banking but also at brokers in Hong Kong, in particular recent attacks to do with basically hijacking share trading accounts." Such schemes surfaced more than a decade ago in the United States. Charles Schwab Corp, E*Trade Financial Corp and JP Morgan Chase & Co. were identified as victims of these schemes in a 2006 complaint filed by the Securities and Exchange Commission. The pace of attacks reported in the United States has slowed in recent years after big brokerages implemented a variety of strategies to thwart the hacks, said John Reed Stark, a former chief of the Securities and Exchange Commission's (SEC) Office of Internet Enforcement. Some use algorithms to identify and halt unusual trading activity, others scrutinize Internet traffic for orders coming from suspicious servers and one stopped permitting customers to use its online trading platform from buying penny stocks, said Stark, who now runs cyber-security consulting firm John Reed Stark Consulting LLC. But such protections are rare in Hong Kong, where the government has only recently started suggesting security improvements to banks and brokerages which have traditionally considered stock trading to be low-risk. TWO-FACTOR AUTHENTICATION The Hong Kong SFC last year told firms to increase surveillance of client transactions and data protection. Authorities believe that hackers accessed brokerage accounts using stolen or guessed passwords, according to investigators. This might have been thwarted if they were protected with two-factor authentication, the Hong Kong Monetary Authority has said. Two-factor authentication typically includes a password and a piece of information only the user has, for instance an electronic token with changing numbers. "Hong Kong is being targeted because they have not instituted the same cyber protections that we see in the U.S. and certain parts of Europe," said Jeff Cramer, a former U.S. prosecutor. Cramer, who is managing director with cyber-security investigations firm Berkeley Research Group, said he expects to see more attacks in Hong Kong and perhaps other Asian nations, including China, Japan and South Korea that are also behind in cyber security. FIGHTING BACK Such pump and dump cases have proven tough to crack in the United States because the masterminds are typically overseas, using surrogates and pseudonyms to make investments. Brokerages are typically not required to go public when they are hacked, so cases often only surface when the government files a complaint against suspected cyber criminals, or the hack results in litigation. The attack involving BOCI Securities year became public after it was sued by a customer that claimed its account was breached. Trading firm Fast Track Holdings Limited alleged in court documents that somebody hacked into its brokerage account on the afternoon of September 23 using a valid user ID and password. Within 18 minutes, the intruder had emptied the account by spending HK$38 million to buy 49 million shares of thinly traded Pa Shun Pharmaceutical, according to Fast Track. The stock soared more than 30 percent after the purchase, which was made at a 36 percent premium to the previous day's closing price, Reuters data shows. BOCI alerted Fast Track of the suspicious activity an hour later, but it has said in court documents it should not be held financially responsible, saying it found no evidence its systems had been compromised. Peter Pang, Pa Shun's CFO, told Reuters the management "would keep an eye to the incident and report to the regulators and the public when necessary". One person familiar with the case said Fast Track's management believes the incident was a pump and dump scam and that Pa Shun was targeted because it is thinly-traded, but it remained unclear who was responsible. Fast Track's directors did not respond to requests for comment. (Additional reporting by Jim Finkle in Boston and Jessica Yu, Katy Wong and Donny Kwok in Hong Kong; Editing by Raju Gopalakrishnan)