How a hacker led to Finra censuring and fining a broker-dealer

Buttonwood Partners of Madison, Wis., fined $50,000 over unauthorized transfers.

The Financial Industry Regulatory Authority Inc. has censured Buttonwood Partners and fined the small, Madison, Wis.-based broker-dealer $50,000 for having inadequate procedures in place to prevent unauthorized transfers from customers’ accounts.

Finra said that Buttonwood used pre-signed letter of authorization forms to permit payments to third parties from clients’ accounts.

In one case, it wired $207,300 from a customer’s account as directed by fraudulent emails to accounts controlled by a hacker.

(More: Financial professionals targeted by sophisticated ‘keylogger’ malware)

On March 11, 2015, Buttonwood became suspicious of a wire request it received and called the customer to confirm. Upon reaching the customer by telephone, the fraud was discovered. Buttonwood and its clearing firm were able to retrieve all but $61,932.35 of the previously wired funds, Finra said, and in April 2015, Buttonwood reimbursed this remaining amount to the customer, and reported the violations to Finra.

(More: Finra: Firms begin to heed cybersecurity, but have much to do)