A Brief Overview of Cross-Channel Fraud, the Financial Intelligence Unit (FIU) and the Role of Technology

Transcription

1 A Brief Overview of Cross-Channel Fraud, the Financial Intelligence Unit (FIU) and the Role of Technology A Verafin White Paper November 2011

2 Introduction. BSA compliance and fraud detection professionals at financial institutions (FIs) are playing a greater balancing act than any other time in their history. Never has there been greater pressure to accomplish more with less. But the landscape is topsy-turvy and shifting. Traditionally, many FIs have treated compliance and fraud detection as entirely separate entities. This was largely due to organic growth that has led to structural segmentation. However, modern crime has made this approach antiquated. Each has unique concerns but the evolution of criminal behavior means the traditional lines are blurred. Modern criminals have largely shifted from operating alone or in small groups to working within highly organized and complex, oftentimes international, groups. This complexity means siloed criminal activity, if it ever truly existed, is wiped away as fraud weaves across channels. In an effort to keep pace, many FIs are breaking with the historic siloed fraud detection and compliance models and creating a more centralized security group. Enter the Financial Intelligence Unit (FIU) to help deal with the growing sophistication of crosschannel fraud. The rise of cross-channel fraud. Cross-channel fraud is the new reality as the sophistication of criminal activity rapidly increases. Globalization has brought with it extended organized crime networks that perpetrate a wide-range of activity, from large-scale offenses such as drug trafficking and human smuggling to smaller, seemingly one-off incidents like identity theft and payment card fraud. The common denominator is the large sums of money involved and the need to find ways to clean it. As financial institutions (FIs) increase the layers of protection necessary to uncover suspicious activity, criminals have to find increasingly sophisticated means of avoiding detection. Weaknesses are unearthed and exploited. One such weakness that exists in many FIs today is the siloed nature of suspicious activity detection. George Tubin, a senior research director for TowerGroup, summed up the problem of siloed fraud departments and increasing cross-channel fraud in a 2011 interview with Tracey Kitten of bankinfosecurity.com. It is basically a fraud that occurs when a criminal or fraudster uses resources from the institution across different channels or payment A Verafin White Paper Page 1

3 types. So, it is getting bits and pieces of information where they can and utilizing different channels, and recognizing that a bank typically works in a very siloed technology environment, where information across the channels isn t necessarily shared; they then use that information and insight from the institution to commit fraud. (bankinfosecurity. com, January 11, 2011) Disturbingly, FIs across the country are seemingly unaware that cross-channel fraud is occurring in their institutions. A fraud survey of more than 230 financial leaders and security officers performed by Information Security Media Group (ISMG) in late-2010 found that 76% of respondents discover fraud incidents once a customer notifies them. That is a staggering number but not entirely surprising considering three other points found in the survey: 55% of respondents rely on manual reports to detect fraud. Only 13% felt their institution had the fraud detection tools necessary to detect cross-channel fraud patterns. 27% do not have a defined plan or team to detect cross-channel fraud. 24% are working on it and 12% don t know! These numbers point to a large disconnect between the current sophistication of fraud and many FI s ability to stop it. Examples of how it happens. Debit card fraud is exploding across the US. A common means of exploiting debit cards is by placing a skimmer, or card-reading device, either on or within a Point-of-Sale (POS) or Automated Teller Machine (ATM) terminal. The illegally obtained card information is often used to create fake cards that are then exploited at numerous ATMs across the country. The cash obtained from this activity must then be cleaned or laundered, often moved to locations overseas. Another cross-channel scenario becoming increasingly common is the takeover of online customer accounts. This often affects small businesses and leads to the ACH transfer of cash from the customer account into the accounts of money mules, who then launder the fraudulently obtained cash. Again, the cash is often moved overseas. A siloed anti-money laundering department may catch the illegal movement of money out of the country but miss the bigger picture of card fraud that led to the attempted money laundering. The FI fails to produce a complete and clear picture of the activity. This lack of knowledge leaves the larger criminal network unharmed, the debit cards continue to cause losses for FI (both monetary and reputational) and the exploitation of customers continues. A Verafin White Paper Page 2

4 The Financial Intelligence Unit (FIU) It is a capital mistake to theorize before one has data. Insensibly one begins to twist facts to suit theories, instead of theories to suit facts. Sir Arthur Conan Doyle ( ), Sherlock Holmes To stay a step ahead of evolving criminal activity, FIs need to shift from their traditional view of siloed fraud and money laundering. Matthew Speare, Senior Vice President of Information Technology at M&T Bank Corp, commented during a panel discussion on the results of ISMG s 2010 fraud survey, What we see is that as organizations get larger, you get more and more siloed. It s an incredible challenge, especially if you scale over time, to get the full view of your customer and all of their transactions. (ffiec.bankinfosecurity.com, December 27, 2010) Increasingly, and with encouragement from both analysts and regulatory bodies, the answer is being found in the creation of what is often called internal Financial Intelligence Units (FIUs). It is a fitting name to describe the sharing of information across fraud and regulatory compliance efforts creating an environment of intelligence that prepares an FI to act quickly to fraud threats. It is a common misconception that an FIU means the complete consolidation of anti-fraud and anti-money laundering professionals who treat the investigation of fraud and money laundering activity as if they are the same. However, an FIU is a progressive step that an institution should tailor to meet its specific needs. There is no FIU manual that gives stepby-step instructions on forming a one-size-fits-all team. The purpose of an FIU is improved data sharing and communication and the leveraging of cross-functional expertise. A true FIU creates an environment where anti-money laundering (AML) and anti-fraud experts can easily see what is happening across transaction channels, properly detect trends and readily share findings. The consolidation of individuals is significantly less important than the consolidation of the information required to create a complete view of activity in the institution. Some feel the unique aspects of the skill-sets required for AML and fraud detection pose an obstacle to success. It is important to recognize that an FIU encourages the sharing of knowledge, not the elimination of specialities. The FIU is about creating a holistic view of potential fraud and money laundering at the institution. It is about pushing back the blinds so that the entire picture of activity is made clear and put in full view. The result is significant time and monetary savings. As stated in an ACAMS Today article entitled, Consolidated FIUs save institutions time, money and headaches, Just as breaking down silos in other areas of business leads to increased consistency, cost savings and reduced risks, so too can an FIU create these benefits for cases of fraud. (ACAMS Today, March-May 2010) A Verafin White Paper Page 3

5 Jay Stark, VP of Fraud Management at RBC, discussed a Fraud Value Chain in a September 2011 ACAMS webinar entitled Financial Crime Trends. The chain, shown below, provides a visualization of an optimal fraud detection path. Note that everything starts with intelligence. Successful prevention, detection, investigation and root cause analysis requires the leveraging of all available information and knowledge; as the saying goes, you don t know what you don t know. The most effective and efficient means of sharing intelligence is through a centralized investigative platform where all stakeholders have access. The Fraud Value Chain. (Image Source: Jay Stark, RBC Fraud Management) Intelligence is the starting point to prevention, detection, investigation and root cause analysis. The importance of technology. One of the keys to maximizing the success of an FIU and cross-channel fraud detection is technology. A centralized software platform for detecting suspicious activity and managing investigations gives the professionals and investigators a location where alerts and investigative information can be shared. Avivah Litan, analyst and vice-president at Gartner, comments, There s not enough money being spent on cross-channel fraud detection, and that is disappointing to me. So much emphasis is being put on education for consumers and employees, but they aren t investing in technology. (ffiec.bankinfosecurity.com, December 27, 2010) There are many advantages to centralized cross-channel transaction monitoring and case management software. Holistic view of activity. A central software platform that performs cross-channel analysis and creates fraud and AML alerts gives financial crime investigators a full view of particular customers and the range of activity they are performing. An FI grows its knowledge of risky customers and their range of activity. A Verafin White Paper Page 4

6 Improved communication. With a centralized case management component, all fraud and AML professionals have a shared platform from which they can view the investigations and findings of other members. Increased efficiency. The combination of cross-channel fraud and a lack of communication mean an inevitable overlap in investigative effort. For example, activity that blurs between money laundering and fraud results in repetitive investigative efforts in a siloed environment. Centralized alerts and case management removes this problem. Flexibility. Centralized software lets an FI flexibly create an FIU and lets the members of that team retain their specialized knowledge areas while having quick and easy access to team investigations and suspicious activity alerts. An FI can even maintain separate departments with the software acting as the shared communication platform. Improved Suspicious Activity Report (SAR) consistency. Creating SARs from one location with software that auto-completes all required fields (excluding the Narrative field), means greater consistency and greatly reduces the chances of rejected reports that need to be reviewed, redone and resubmitted. Also, having access to all submitted SARs in one location allows for a stronger risk assessment and improved access to information for investigations involving customers with a report history. A common data repository. Financial crime investigators see and share the same data. Having all available data in one location allows for powerful, progressive data mining techniques, including the detection of transaction patterns and data anomalies. In addition, many institutions expend effort consolidating data for regulatory purposes; a data repository reduces this effort while providing many additional investigative advantages. Software features to consider. There are a number of software features that greatly increase the benefits an FI and its FIU can gain from adopting a centralized platform. Things to consider include: A robust case management component. The case management component is essential. It is the communication hub. Users should be able to attach investigative files, assign responsibilities across the larger team, add descriptive notes that include the date created and attach alert information including customer data. Also, the ability to create a SAR directly from a case is very helpful in terms of transparency and efficiency. A Verafin White Paper Page 5

7 Integration of fraud alerts and money laundering alerts. A platform that generates both fraud and money laundering alerts and contains an integrated case management component lets users quickly and easily attach related alerts, including the evidence contained within the alerts. This makes the case much more robust and positively impacts communication. Distinct fraud analytics. Money laundering activity is different than fraud activity. That does not mean they cannot be combined on a single platform. In addition to sharing a case management component, software that detects both fraud and money laundering, using analytics and scenarios distinct to both, creates a much more robust system that can be more effectively shared by professionals on both sides of the anti-financial crime coin. Automated SAR completion and submission. When the software can auto-complete a SAR, there are significant time-savings for members of the FIU. Additionally, there is a great improvement in report quality and consistency, meaning fewer rejected reports that can be a drain on resources. Ease-of-use. This is perhaps the most obvious but is all-too-often overlooked. A system that is difficult to use and does not present an intuitive user experience will create more roadblocks. Frustrated users will simply resist using the system, which means the fundamental tool in the team s arsenal actually hurts the team s potential for success. Conclusion. FIUs have evolved to stay ahead with the highly organized modern criminal that moves quickly and easily across traditional transaction lines. To maximize the success and efficiencies of a FIU, technology plays an essential role. A centralized technology platform that incorporates a case management component and integrated fraud and money laundering detection removes redundancy and offers a transparency that allows for effective communication across the unit. Increased communication and the sharing of information across formerly siloed groups means a more robust fraud detection effort with information instantly available to make quick, informed decisions. A Verafin White Paper Page 6

8 Learn more. To access Verafin s ever-growing archive of webinars, white papers, success stories and other materials focusing on BSA/ AML compliance and fraud detection topics relevant to financial institutions across the country, check out our Resource Center at About Verafin. Verafin is a leader in anti-money laundering and fraud detection solutions for financial institutions, with nearly 750 customers that span over 65 core processing systems and a broad asset range. Verafin helps financial institutions comply with the Bank Secrecy Act, USA PATRIOT Act, and FACTA regulations, while also helping to protect against fraud. Verafin is the exclusive provider of BSA/AML and fraud detection software for the California Bankers Association, Massachusetts Bankers Association, CUNA Strategic Services and 40 credit union leagues and associations in the United States. For more information, visit or call A Verafin White Paper Page 7