Fraud in the Church High Tech Style

Transcription

1 Sunday, July 3, 2011 Fraud in the Church High Tech Style C9 1:00 PM 2:45 PM D9 (Repeat) 3:45 PM 5:30 PM Location Potomac 1 Fraud in the Church High Tech Style Verne Hargrave MBA, CPA, CFE Just as the nature of business transactions has changed due to the vast advances in technology, so, too, does the nature of fraud risk. No longer can churches rely solely on strong controls over offering count teams, check writing, and payroll processes in fraud prevention. A new threat is growing exponentially cyber fraud! A brief introduction to the fundamentals of fraud prevention will be followed by an in-depth discussion of four current cyber threats threatening churches. As each fraud technique is discussed, practical prevention techniques will be presented. Verne Hargrave is a Certified Fraud Examiner as well as a CPA.He joined PSK in 1978 and has been a shareholder since He concentrates in the area of not-for-profit organizations, principally churches and Christian ministries. He oversees and conducts numerous church audits and supervises the church accounting services department of PSK. Verne is a member of NACBA, and is a frequent speaker at various church and ministry-related seminars. He earned his BBA in accounting at the University of Texas at Arlington, in 1976, and obtained his CPA certificate in May In addition to his public accounting career, Verne served as a bi-vocational pastor at Grace Street Fellowship in Arlington, Texas, from 1993 to Verne is also author of Weeds in the Garden: The Growing Danger of Fraud Taking Root in the Church published by NACBA Press. Contact information: Verne Hargrave verne@pskcpa.com

2 Fraud in the Church High-Tech Style

3 The landscape of church and nonprofit organization fraud Not-for-profit organizations accounted for 9.6% of reported fraud incidents. Religious organizations accounted for 2.3% of reported cases. (2010 ACFE Report to the Nation on Occupational Fraud & Abuse) The median loss for nonprofit organizations amounted to $90,000. Median loss for religious organizations - $75,000. Organizations with fewer than 100 employees accounted for 31% of reported cases with a median loss of $155,000. Asset misappropriation accounted for the vast majority (90%) of all reported cases o Skimming 14.5%, $60,000 median loss o Cash theft 10%, $100,000 median loss o Expense reimbursements 15%, $33,000 median loss o Check tampering 13%, $131,000 median loss o Payroll 8.5%, $72,000 median loss o Cash on hand 12.6%, $23,000 median loss o Non-cash assets 16%, $90,000 median loss 2

4 Fraud Basics What is occupational fraud? Fraudulent Financial Reporting Intentional misstatements in financial reports. Examples: Inflated revenues or assets to meet targets established by a lender. Inflated contribution substantiation forms to generate fictitious tax deductions. Misleading payroll information generated to reduce taxable income or increase withholdings. Misappropriation of Assets The stealing or misuse of organization assets. Corruption The selling of influence through bribes, kickbacks, etc. 3

5 Fraud Basics Three ingredients of fraud PRESSURE RATIONALIZATION OPPORTUNITY 4

6 Four Versions of High-Tech Fraud Electronic Funds Transfer (EFT) Frauds - Criminals surreptitiously obtain banking credentials by hacking into a church computer, and stealing money from the church bank accounts. Identity Theft - Within the information technology system of most churches resides a treasure trove of information coveted by fraudsters. This information includes names, addresses, birthdates and in some cases, banking information of their members. Churches have a fiduciary responsibility to protect this data from misuse. Computer Forgery - A new generation of check forgers has emerged with the advent of the computer. Assisted by scanners, color printers and graphics software, forging checks has become much easier to accomplish and difficult to detect. Data Input Manipulation - Input manipulation is the most common form of computer crime due to the fact that it does not require sophisticated computer knowledge on the part of the perpetrator. With few controls, fraudsters can create forged documents (Contribution substantiation forms for example) or cover the tracks of other thefts they may have committed. 5

7 Electronic Funds Transfer (EFT) Frauds The Headlines: Over a weekend, a Catholic Diocese was the victim of a $600,000 ACH fraud theft. The church said it was victimized by criminals who illegally obtained its banking information in order to transfer funds to several money mules scattered across the United States. The diocese is but the latest of many such incidents targeting mid-level targets. According to FBI spokesmen, mid-level organizations don t have the same level of scrutiny that major organizations go through, and they are both less protected and less aware of the dangers. What Happened? How the criminals got the Diocese s banking credentials was never fully determined. Law enforcement officials say the Diocese seems to have been the victim of a highly sophisticated operation, most likely based overseas, which engages participation of individuals who unknowingly act as intermediaries of the funds obtained by theft. What made it possible? Lack of an adequate separation of duties Lack of oversight Poor reconciliation procedures 6

8 How to keep it from happening in your church Use dual controls in transacting ACH and wire transfer payments Execute all online banking activities from a dedicated, standalone and completely locked-down computer system from where and Web browsing are not possible Limit administrative rights on users workstations to prevent inadvertent downloading of malware Reconcile all banking transactions on a DAILY basis 7

9 Identity Theft The Headlines: Computer hackers (who have never been identified) used a computer virus to access a church s information system. The thieves were able to obtain the church s EIN number, bank information including account numbers, routing numbers, and authorized check signers and personal data of church membership. The information was used to apply for loans, open credit cards, and access the church s and its members bank accounts. What Happened? The virus was introduced by the opening of an containing an infected attachment or pop-up. Once inside, the virus Copied the church s computer hard drive Transported the files to an obscure website, probably offshore 8

10 The files were reviewed by the criminals in a search for sensitive information such as: Employer Identification Number Bank account numbers Routing details Check signatures Scanned checks Scanned bank statements Also could have used a key logger to obtain user names and passwords. Once obtained, the hackers accessed the church bank accounts and helped themselves to the church s funds. What made it possible? Careless opening of s Browsing of unsecured websites Personal USB (external) drives Manually loaded by an insider 9

11 How to keep it from happening in your church Firewalls Utilize software that regulates access to the church s information system. Common providers: Cisco CheckPoint Sonic Wall Fortinet Watchguard Anti-virus Utilize scanning software to detect the presence of a virus. Scanning should be network wide, including servers, computers, and external drives. Common providers: Norton McAfee Trend Vipre Penetration Test Engage a third-party provider to test the church s firewall at least once every six months. Physical Security Keep your servers in a LOCKED room! 10

12 Passwords Use complex passwords: Twenty characters Combine alpha, numeric, caps and special characters Incorporate limited attempt access Administration Develop AND follow a written IT policy Educate the church staff about: The danger of unfamiliar s, pop-ups, downloads and browsing questionable websites. 11

13 The Headlines: Computer Forgery Three members of a counterfeit check ring conspiracy were sentenced for running a two-year fraud scheme that caused more than $50,000 in losses. According to evidence introduced during the trial, from 2007 through 2010, the perpetrators engaged in a scheme to create and pass counterfeit company checks at various banks throughout the area. What Happened? The criminals recruited dozens of individuals to provide copies of legitimate checks that were then used to create counterfeit checks by using computers and laser printers. Other individuals were recruited to present and cash the counterfeit checks at various financial institutions and other businesses. The perpetrators also recruited people to open bank accounts at various financial institutions. The accounts were used to cash counterfeit checks. The fraudsters also promised and provided payment to these individuals for their participation in cashing counterfeit checks. 12

14 What made it possible? Lack of a proper segregation of accounting and check paying duties Lack of security over check stock How to keep it from happening in your church Keep your blank check stock under lock and key! Use checks with embedded security features Utilize Positive Pay services provided by the church s bank Conduct intense bank reconciliation procedures which include an inspection of cancelled checks. (Front and back) 13

15 The Headlines: Data Input Manipulation A church financial secretary was charged with embezzling more than $250,000. She was accused of devising a scheme to defraud using the U.S. Mail to send payments for her own bills and credit card purchases. The perpetrator, who had access to all modules of her church s information system, covered her tracks by doctoring vendor information, payroll records and charitable contribution substantiation reports. What Happened? The perpetrator wrote church checks to cover her personal bills and credit card charges. She then manipulated the cash disbursement register by changing vendor names to normal church vendors. After realizing that her re-directed cash expenditures had become excessive, she allocated her illicit expenditures in small amounts to various budget line items. Realizing that excess cash had accumulated in the church s payroll bank account, she drained the account by doctoring payroll information in the form of phantom employees. 14

16 Feeling guilty about the size of her theft, the financial secretary began to pay back the stolen money. To cover this inflow, she created phantom contributors and generated phony contribution substantiation reports. What made it possible? Absence of proper segregation of duties in the bill paying process Failure to partition the various IT system modules No well defined bill approval process Lack of adequate oversight over financial reporting How to keep it from happening in your church Implement an independent, extensive review of bank account reconciliations Adopt a formal vendor application process Implement regular communication with vendors Perform periodic payroll audits Consider implementing an occasional confirmation of charitable contributions exercise 15

17 Conduct an exhaustive review of budget reports: Budget to actual analysis On a test basis, compare general ledger detail to budget line items Perform an independent review of journal entries Perform periodic review of cash disbursement activity 16

18 Contact Information Verne Hargrave MBA, CPA, CFE PSK LLP 3001 Medlin Drive Suite 100 Arlington, Texas Fax verne.hargrave@pskcpa.com 17