Torn Identity: Preventing New Forms of Corporate Identity Theft

Transcription

1 Torn Identity: Preventing New Forms of Corporate Identity Theft Bonnie J. Hertz, CTP Cash Manager North Pacific Group, Inc. Greg Hansen VP, Product Management Wells Fargo Bank 1

2 Agenda Overview of fraud landscape today Impacts of fraud New potential for fraud activity Fraud mitigation banking tools Internal controls Commercial identity theft horror stories Key takeaways Questions 2

3 Check Fraud Still Dominates Fraud Landscape Payment Methods Subject to More Payments Fraud in 2007 Compared to 2006 Checks Consumer ACH / card payments ACH debits Corporate cards ACH credits Prepaid gift cards Wire transfers 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Source: 2008 AFP Payments Fraud and Control Survey Revenues > $1B Revenues < $1B 3

4 Fraud Happens Internally and Externally Reasons Organization Suffered Financial Loss from Check Fraud Account reconciliation or check return not timely Internal fraud Did not use payee positive pay Did not use positive pay / reverse positive pay Other Source: 2008 AFP Payments Fraud and Control Survey 0% 10% 20% 30% 40% 50% 60% 4

5 Anyone Can Commit Internal Fraud Median Loss by Position of Internal Perpetrator Owner / Executive Manager $1,000,000 $218,000 Employee $78,000 Employee 40% Owner/ Executive 19% $- $200,000 $400,000 $600,000 $800,000 $1,000,000 $1,200,000 Manager 41% Position of Internal Perpetrator Source: 2006 ACFE Report to the Nation on Occupational Fraud and Abuse 5

6 Fraud is Continuing to Increase Change in # of Payment Fraud Attempts from 2006 to 2007 Increased incidents of fraud About the same Decreased incidents of fraud 0% 10% 20% 30% 40% 50% 60% Source: 2008 AFP Payments Fraud and Control Survey 6

7 Impacts of Fraud Costs of fraud often higher than dollar losses from the transaction Other financial losses Reputation impact with customers and investors Management distraction Consequential damages (Check 21) Legal / research costs 7

8 Why Check Fraud Occurs Reasons Organizations Suffered Financial Loss from Check Fraud Account reconciliation or check return not timely Internal fraud Did not use payee positive pay Did not use positive pay / reverse positive pay Other Source: 2008 AFP Payments Fraud and Control Survey 0% 10% 20% 30% 40% 50% 60% 8

9 New Potential for Fraud Activity Migration to sending or receiving ACH Remote deposit ACH check conversion Vendor payment portals and directories Online payment tools and services Online payment gateways P-card and merchant card transactions 9

10 ACH Fraud Controls Need to be Similar to Checks Reasons Organizations Suffered Financial Loss from ACH Fraud Account reconciliation / ACH return not timely Did not use ACH debit blocks Did not use ACH positive pay Internal fraud (employee responsible) Inaccurate key entry/error Gaps in online security controls Source: 2008 AFP Payments Fraud and Control Survey 0% 10% 20% 30% 40% 50% 60% 10

11 Tried-and-True Banking Tools and Services Positive pay Carefully manages your check issue files and exceptions! Reverse positive pay Allows you to manage your exceptions in-house Image access Very useful tool for managing exceptions Payee verification OCR and manual review of payee on check to payee on issue file ACH debit blocks & filters Should be placed on all accounts that shouldn t receive any ACH debits or only certain ACH debits Account structure Prevent checks from posting to depository account Set limits for checks clearing each account or cashed at teller window Using multiple accounts can help limit fraud exposure 11

12 Next Generation of Banking Tools and Services Proxy account number services Account number specific to one vendor Can be used in place of bank information Cannot be used for any other purpose Gets your account number out of the payment stream, reducing the opportunity for fraud Automated payables and/or receivables file Integration with bank allows for fewer manual touch points and opportunities for fraud Tools for making dual approval easier Alerts for payments needing approval New channels for approvals (e.g., mobile devices) 12

13 Internal Controls Knowing your employees may not be enough! Fraudsters are often on your payroll! Perform regular credit and background checks for employees with account access Regular user activity audits Know your trading partners! Require a specific, verifiable process for changes to trading partner account information Keep authorizations current Immediately remove internal and bank access and authorizations when employee leaves or changes position Separation of duties and dual approval Make sure that an employee s duties do not include a function that could ultimately camouflage fraud 13

14 Internal Controls Account reconciliation is critical Review transactions daily Reconcile bank statements frequently Report fraudulent activity immediately Protect your access information NEVER give out your authorization credentials Do not use links from s to banking websites Protect your and your customer s payment assets Safeguard check stock and signature stamps Keep it locked up under dual custody Shred unused or outdated check stock Imaged lockbox items Remotely deposited items 14

15 Commercial Identity Theft Horror Stories* * Names withheld to protect the innocent.or guilty Company A Horror Story Summary: Phishing for more than compliments. Eyewitness Reports Company A receives from from trading partner requesting changes to to bank bank account/rtn for for payments s appear legitimate with with logos, signatures, etc. etc. Trading partner info info updated Payments made, funds withdrawn quickly Losses incurred Prevention Tips Tips Know your your trading partners! Require changes on on official letterhead, employ callback procedures to to known individuals at at trading partner Work with with trading partners to to develop additional checks and and balances for for updates Financial provider may may provide repository for for secure updates made by by trading partner 15

16 Commercial Identity Theft Horror Stories* * Names withheld to protect the innocent.or guilty Company B Horror Story Summary: Dude, where s my account number? Eyewitness Reports Company B sets sets up up website to to provide bank bank info info to to trading partners Company inadvertently publishes bank bank account number on on unprotected website. Bank Bank statement reflects purchases at at sites sites of of ill-repute Prevention Tips Tips Do Do periodic audit of of where and and how how bank bank info info is is published to to trading partners Review IT IT security policies for for protected and and non-protected sites sites Leverage banking and and third third party tools tools and and directories for for sharing information 16

17 Online Tools Need to be Managed Carefully Security Measures Adopted to Protect Online Payments and Cash Management Data Segregate responsibilities for payments entry and approval Multi-factor authentication (e.g., tokens) Required password changes Delete online user IDs with exit procedures Dual system administrators Audit of employee roles and services Transaction limits for different roles Alerts for transactions above threshold Source: 2008 AFP Payments Fraud and Control Survey 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100 % Revenues > $1B Revenues < $1B 17

18 Commercial Identity Theft Horror Stories* * Names withheld to protect the innocent.or guilty Company C Horror Story Summary: Key Logging is not one of the Florida Keys Eyewitness Reports Computer used used by by Company C to to access online commercial portal is is infected with with key- keylogging software User User ID ID and and password is is sent sent to to fraudster Fraudster initiates outbound funds transfer via via ACH ACH or or wire wire Company does does not not have have dual dual controls or or secondary authentication. Funds immediately wired overseas from from account Prevention Tips Tips Dual Dual control on on any any form form of of outbound money movement Use Use secondary authentication for for online transactions Adequate internal IT IT security measures and and reviews for for critical computers and and workstations Frequent audit checks for for users of of IT IT hardware (e.g., (e.g., computers) and and software (audit history) 18

19 Commercial Identity Theft Horror Stories* * Names withheld to protect the innocent.or guilty Company D Horror Story Summary: But You Don t Look Like an Employee Eyewitness Reports Fake Fake payroll checks produced on on inkjet printer using Company D s D s controlled disbursement account number 4 criminals attempt to to cash cash checks at at liquor stores, retailers, bank bank branches Over Over $14K $14K successfully cashed by by fraudsters at at retailers, liquor stores Alert Alert teller spotted the the issue, contacted other branches and and Company Prevention Tips Tips Positive pay! pay! Positive pay!! pay!! Positive pay!!! Need to to regularly review positive pay pay exceptions may may choose default disposition of of return to to ensure you you do do it it 19

20 Commercial Identity Theft Horror Stories* * Names withheld to protect the innocent.or guilty Company E Horror Story Summary: I m gonna wash that name right outta your check Eyewitness Reports Company E s E s check for for $42K $42K is is stolen out out of of mail mail Payee name chemically washed off, off, stolen ID ID name inserted onto onto check Checks deposited to to business account set set up up with with stolen ID ID Multiple checks stolen from from other companies and and deposited to to account Positive pay pay did did not not stop stop file file because dollar number and and check number matched Prevention Tips Tips Bank Bank payee verification service would have have prevented this this scenario from from occurring Use Use more secure forms of of sending or or receiving mailed check payments Migration from from paper to to electronic payments would reduce fraud considerably 20

21 Commercial Identity Theft Horror Stories* * Names withheld to protect the innocent.or guilty Company F Horror Story Summary: Not exactly building goodwill. Eyewitness Reports Fraudster makes simple personal checks with with Company F s F s controlled disbursement account number Checks used used to to make purchases at at retailer Checks caught by by positive pay, pay, retailer incurred cost cost of of fraud Company F account number added to to negative database Prevention Tips Tips Positive pay pay works yet yet again in in this this instance Migration from from paper to to electronic forms of of payment is is critical get get checks out out of of the the mail mail 21

22 Commercial Identity Theft Horror Stories* * Names withheld to protect the innocent.or guilty Company G Horror Story Summary: Increasing employee productivity. the wrong way. Eyewitness Reports Company G s G s internal employee accesses trading partner bank bank account information Employee changes account to to be be his/her own own dummy company account Money is is wired or or sent sent as as ACH ACH credit to to new account Money is is quickly transferred out out of of that that account so so it it can t can t be be traced as as easily Prevention Tips Tips Leverage dual dual control and and segregation of of duties; one one person initiates payment and and another person approves Perform regular audits of of employee access to to and and use use of of trading partner bank bank information Use Use bank bank risk risk limits for for outgoing payments exceeding certain thresholds 22

23 What To Do if You Are Victimized? Notify your financial institution immediately even if your fraud prevention tools worked They can help with paperwork and reporting procedures Can help investigate fraud and place holds and/or flags on other accounts File a police report You ll need this for confirming fraud to check guarantee, collection, and credit companies Depending on the type of fraud, you may want to contact credit agencies and/or check guarantee companies directly Immediately reconcile all your account statements and report any suspicious transactions Revisit your internal controls and identify and close any potential gaps 23

24 Key Takeaways Fraudsters are getting smarter and technology can make it easier Your financial institution is your friend in fighting fraud Internal controls are critical Electronic payments provide many benefits but also have inherent risks Stay educated to stay ahead of (or on par with) the fraudsters 24

25 Thank You Questions? 25

26 Supplemental Info 26

27 From a former fraudster. It would be 4,000 times easier to do today, what I did 40 years ago, and I probably wouldn't go to prison for it. Technology breeds crime -- it always has, it always will. When I forged checks 40 years ago, it required a $1 million printing press that required three journeymen printers to operate. I had to build scaffolding on the side of it so I could operate it by myself. There were color separations, negatives, plates, typesetting chemicals. Today, I sit down at a laptop, pick any company I want, go to their Web site, capture their logo, like American Airlines. I put it up on a check with a 747 in the background taking off. Fifteen minutes later, I have the most beautiful American Airlines check you've ever seen -- probably 10 times better than the check American Airlines uses. Forty years ago, I wouldn't know who signs American's checks; I wouldn't know where American Airlines keeps its accounts payable account. Today, I would just call their accounts receivable, ask them for their wiring instructions. They'd tell me where they bank, on what street in what city, what their account number is. I call back and ask for a copy of their annual report, and on page three will be the signature of their chairman of the board, the CEO, the CFO, the treasurer. I scan it onto glossy white paper, with camera-ready art -- and I have the check. A world of too much information and the technology make it very easy to do today what I did 40 years ago. It would be 4,000 times easier to do today, what I did 40 years ago, and I probably wouldn't go to prison for it. Frank Abagnale, keynote address at Computerworld's Storage Networking World Conference, October 17 th,

28 Additional Resources Contact your Banker first! Your bank can assist you filing proper paperwork and following procedures. Telecheck Services Inc. (a national check guarantee company) Forgery Department PO Box 4451 Houston, TX (800) Contact them and file a Forgery Affidavit for any fraud checks that have passed through one of their systems You will need to provide a copy of the police report with your affidavit Credit Agencies The 3 big ones Equifax (800) Experian (888) TransUnion (800) Collection Agencies Often times, returned checks are handed over to collection agencies for collection, regardless of the reason the check was returned. Collection agencies then start collection proceedings against you since you appear to be the maker of the check. If this happens, write a letter explaining the fraud and send a copy of the police report. Usually, this will take care of the issue. However, you may need to consult an attorney if the initial letter and police report do not suffice as proof of fraud. Identity Theft Identity theft is handled very differently than counterfeit checks or electronic check transactions. Identity theft is handled by the Federal Trade Commission. Information is available at their website 28