KeyBank Special Report: Identifying And Mitigating Your Exposure To Fraud

Size: px

Start display at page:

Download "KeyBank Special Report: Identifying And Mitigating Your Exposure To Fraud"

Gladys Robbins
5 years ago
Views:

1 KeyBank Special Report: Identifying And Mitigating Your Exposure To Fraud Inside: Fraud: A Problem That Won t Go Away How Criminals Exploit Vulnerabilities In Treasury Practices Fraud Prevention From An Enterprise Perspective Vigilance: Your First Line Of Defense Fraud Is Real You Are Not Alone We Can Help

2 executive summary: Fraud rings are better organized and more technologically sophisticated than ever before. Enterprise USA 2008 Enterprise USA 2008 Fraud: A Problem That Won t Go Away At this very moment, businesses like yours are being targeted by criminals whose sole intent is to obtain funds by illegal means. Operating both individually and in well-organized rings, these corrupt and calculating individuals have learned to identify and exploit weaknesses that victims often overlook. Hidden in plain sight among employees, associates and the population at large the perpetrators of payment fraud rob American enterprise of billions of dollars each year. In fact, the Association of Certified Fraud Examiners (ACFE) calculates annual losses due to fraud at $652 billion,* or approximately 5 percent of the nation s Gross Domestic Product. Are you vulnerable? In a recent survey conducted by the Association for Financial Professionals (AFP), 72 percent of all participating organizations reported that they had been the victims of attempted or actual payment fraud.** And, unfortunately, fraud appears to be a growth industry. In a roundtable discussion held by the Federal Reserve Bank, participants reported that costs associated with this steadily growing problem are not only substantial, but increasing as the incidence of fraud continues to escalate. The hidden costs. The cost of fraud is not limited to direct losses. Also significant are the many expenses associated with investigative efforts and attempts to recover lost funds. Less quantifiable, but potentially even more damaging, is the negative impact of

3 ACH Fraud: The profile of a victim. The AFP finds that organizations with annual revenues under $1 billion are nearly three times more likely to sustain financial losses due to ACH fraud than are businesses with revenues over the $1 billion mark. In examining the statistics, the reason for this significant disparity becomes readily apparent: larger institutions are much more likely to implement fraud prevention solutions. successful fraud attacks on the public image of victim organizations. If victimized by fraud, you can expect to spend over 175 hours filling out insurance claims, police reports and affidavits, and in completing numerous other timeconsuming tasks in an attempt to repair the damage. Added to the time and expense of correcting fraudulent activity, the cost of each incident typically exceeds $3,000. Alliance: Joining forces on multiple fronts. Clearly, to prevail in the battle against fraud, organizations must take a proactive stance. Today, businesses and institutions are actively engaging in building alliances with financial institutions that can provide the expertise to pinpoint vulnerabilities and structure solutions that can help to defend the organization against fraud and from the losses it can cause. How Criminals Exploit Vulnerabilities In Treasury Practices Fraud is as old as commerce itself but as the technology of treasury management has evolved, so too have the methods used to perpetrate it. Today, the level of sophistication among those who conspire to commit fraud is alarmingly high. Disaffected and cunning, techsavvy criminals arm themselves with an insider s understanding of treasury management practices and set forth to defraud the organizations that drive our economy. The costs are immense. Fortunately, banking services designed to protect organizations against fraud also continue to evolve as well. The following are several of the many ways criminals endeavor to exploit vulnerabilities in treasury practices. The most frequent targets. Despite the declining use of checks, check fraud continues to increase and is still the most prevalent form of payment fraud by a significant margin. In fact, 41 percent of all organizations responding to the AFP study reported an increase in the incidence of check fraud.** Other frequent targets of payment fraud are: Automated Clearing House (ACH) Credit and debit cards Wire transfers Technology: The criminal s toolbox. At first glance, check fraud may seem relatively low-tech. But forged signatures and altered payable amounts are just the beginning. Current methodologies are as advanced as today s technology. One of the fastestgrowing types of check fraud involves the production of counterfeit checks. Using tools that are readily available including desktop publishing software, color copiers and high-end printers counterfeiters produce replications of genuine checks that are both convincing and effective in producing the intended result. Criminals also commit check fraud by: Stealing employee paychecks, reimbursement checks and rebate checks. Continued on next page.

4 Understanding your exposure. It is often assumed that financial institutions are responsible for losses resulting from fraud. However, an organization may be held responsible in some instances for example, if it failed to reconcile accounts and/or identify and return fraudulent items in a timely manner. Financial responsibility is determined on a caseby-case basis, depending on the facts of the case and applicable law. Responsibility may be linked to the entity determined to have been in a position to take preventive action, but which did not do so. You should seek the advice of your legal counsel regarding responsibility for fraud. Taking advantage of checkconversion loopholes at unprotected financial institutions. Criminals obtain account and routing numbers from checks and use this information to initiate payments typically via phone or the Internet that are presented electronically as ACH transactions. Fraud in the electronic realm. As Automated Clearing House transactions and other electronic payment methods have gained increasing acceptance, so too has the incidence of electronic fraud. Rapidly assimilating these new and emergent electronic payment technologies, the criminally opportunistic relentlessly continue to pursue their victims in the electronic realm. With the proliferation of phishing schemes and online trojan attacks, organizations must acknowledge the necessity of protecting access to account information. Today, expertly crafted phishing s, which are used to fraudulently obtain passwords and other account information, are one of the most damaging weapons in the criminal toolbox. Trojans, which harvest account data automatically and all too often without being detected are also responsible for significant financial losses. The potential for loss due to trojans is expected to continue to increase over time, as these malicious programs become more sophisticated. Respondents to the AFP survey report that over a third of the fraud attempts made against their organizations involved ACH transactions.** And among organizations that were found to be financially responsible for losses due to fraud, more than half did not use ACH debit blocks or filters. Another 22 percent of ACH fraud attempts were successful because the organization had not reconciled its accounts or returned payments on a timely basis. And 17 percent of victim organizations reported that the source of fraud could be traced to persons within their own organizations. Beware the inside job. How do you identify a criminal who has penetrated your defenses? The answer may not be so obvious. According to data collected by the ACFE, less than 8 percent of prosecutable suspects had been convicted of any crime prior to committing internal fraud. The costs of internal fraud can be staggering. The ACFE finds that the median loss due to internal fraud is $159,000 per incident.* And nearly 25 percent of all reported internal fraud cases resulted in losses of at least $1 million. Among the most frequent types of internal fraud are asset appropriation schemes involving invoicing, expense reimbursements, check tampering and payroll. Small to mid-sized businesses are particularly susceptible to internal fraud and suffer disproportionate losses as compared to larger organizations.

Fraud Prevention From An Enterprise Perspective Taking the offensive: A multidimensional strategy.

However, as fraud continues to grow in scope and sophistication, the need to manage this threat has never been greater.

And because fraud can be expansive across an entire organization, it is also essential to engage internal partners by communicating concerns and sharing observations. Combating fraud: The essentials.

5 Fraud Prevention From An Enterprise Perspective Taking the offensive: A multidimensional strategy. Safeguarding the organization s cash flow and profits has long been the role of the corporate treasury department. However, as fraud continues to grow in scope and sophistication, the need to manage this threat has never been greater. To effectively combat fraud, forward-thinking organizations must adopt multidimensional strategies that function in synergy with their existing initiatives. And because fraud can be expansive across an entire organization, it is also essential to engage internal partners by communicating concerns and sharing observations. Combating fraud: The essentials. Combating fraud isn t simple, but it is possible if managed effectively. KeyBank recommends that you begin with these essential activities: Segregate duties. Designate one person to make payments and another person to reconcile, to help decrease the potential for internal fraud. Reconcile on a timely basis. The more frequently you reconcile, the sooner you ll be able to identify any unusual check or ACH transactions. Utilize electronic processes. Use online reporting to enable faster reconcilement and authorization decisions for questionable/red-flagged items. Also, consider issuing rebates and refunds as electronic transactions, and use direct deposit for payroll. Protect account information, user IDs and passwords. Account numbers, routing numbers and other relevant account details are gold to criminals who attempt to commit fraud. Instruct employees in the protection of secure information and teach them to recognize phishing s and other attempts to obtain sensitive data. Implement fraud prevention solutions. Implement bank-provided treasury management solutions that can help to mitigate fraud through early detection and safeguard against erroneous postings. Use two-factor authentication to strengthen transactionlevel security. Verify user identity with a user ID and password, plus a stronger factor such as a digital certificate. Defending against check fraud. Dealing with fraudulent checks is costly, not only in terms of the actual loss, but in terms of expenses related to remediation. The following strategies are fundamental to a successful anti-fraud initiative: Identify altered payee names and payable amounts, forged signatures and fraudulently replicated checks. Detecting unauthorized checking activity, automatically identifying questionable items and providing the option to either approve or reject these items are important safeguards Continued on next page.

6 against altered or fraudulent checks. An effective tool in managing these scenarios is positive pay. An extra layer of protection, known as payee positive pay, is provided by comparing the payee name on presented checks to an electronic list submitted by the client organization. This feature helps to ensure authenticity by automatically reporting all exceptions, and allowing the client to make the desired dispositions. Because many financial institutions do not offer this service, it is important to determine availability. Identify fraudulent activity rapidly. The more quickly fraudulent activity is identified, the more likely it is that you can prevent it. This is why it is imperative to reconcile accounts on a timely basis. By doing so, your organization can identify exceptions that may be fraudulent and take appropriate action before financial damage can result. Enterprise USA Use automated account reconcilement. This is an effective alternative to traditional reconcilement methods. It provides detailed checking account information that reduces the time needed to reconcile accounts and enables you to identify fraudulent activity sooner. Typically, organizations choose from one of two distinct levels of account reconcilement: 2008 Partial reconcilement provides a list of paid checks in numerical order. Check serial numbers, dollar amounts, dates paid and sequence numbers are displayed within this concise, easy-to-read report. Full reconcilement in addition to a list of paid checks, it provides an itemized report of outstanding checks and exception items. Keep paper checks out of the wrong hands. Paper checks, when stolen or altered, can provide a direct route into your accounts. One of the best ways to keep them out of the hands of criminals is to archive checks as digital images and store them on CD-ROM or other digital media. This process enables organizations to easily manage, retrieve and view images on demand. Typically, archived check images include the front and back of each check, providing a visual record of the signature, endorsement and/or bank of first deposit. Automated account reconcilement reports and bank statements are also frequently imaged for archival purposes. Make it more difficult to counterfeit your checks. One of the more effective ways to reduce check fraud is to utilize enhanced check stock security features, including microprinting, dualcolor gradients, watermarked security tags and photocopy prevention markings. To further complicate the efforts of counterfeiters, limit access to sensitive account information and check stock. Often, the most cost-effective way to achieve these objectives is to outsource check production.

7 Safeguarding the ACH process. Automated Clearing House (ACH) payments present new and potentially lucrative opportunities for criminals. To help protect against fraudulent ACH transactions, organizations need to carefully monitor electronic account activity. In addition to reconciling accounts daily, the primary solutions in the battle against ACH fraud are ACH blocks and filters. Designed to protect against unauthorized electronic ACH debits, these methods enable users to authorize specific ACH debits or block all ACH debits to their accounts. Users can select the level of protection that best fits their organizations: Matching all ACH debits against a pre-approved account list provided by the client to determine if the debit should be paid. Receiving a daily exception report of all unauthorized attempts to debit protected accounts, including an option to pay or not pay each item on the list or place a block on an account. Rejecting all ACH debits attempting to post to a specified account. ACH block and filter reports are often available via fax, or the Internet. Closing the loopholes between digital and traditional payment methods. To be effective, your fraud protection initiative needs to close the loopholes that can open when checks are presented as ACH payments. Positive Pay and ACH block and filter solutions should be structured to work hand-in-hand including the verification of payee name for electronic items to identify questionable transactions and to return suspicious items upon presentment. Because not all financial institutions offer this level of integration, it is important to evaluate carefully when selecting a solutions provider. Vigilance: Your First Line Of Defense Fact #1: No amount of planning and oversight will ever completely eliminate fraud. The bad guys are just that good. Fact #2: Criminals look for easy targets, so if an account is protected, it becomes a far less attractive target for would-be criminals. This is particularly true in the case of internal fraud, especially when members of the organization know that fraud prevention measures are in use. Fact #3: With a well-conceived, well-executed system in place, you have the potential to reduce fraud to a point at which it becomes a negligible nuisance, and perhaps even eradicate it for considerable periods of time all without incurring unreasonable cost. The right blend of process and technology. It s time to take a proactive stance against fraud. KeyBank can help you formulate a strategy designed to address your needs. Contact Key today to discuss your fraud strategy and to obtain recommendations specific to your organization.

8 For more information, visit key.com/globaltreasury. SM *Association of Certified Fraud Examiners (ACFE), 2006 Report to the Nation on Occupational Fraud & Abuse **Association for Financial Professionals (AFP), 2007 AFP Payments Fraud Survey: Report of Survey Results, 2007 Federal Trade Commission. Identity Theft Clearing House, 2002 The American Bankers Association. Deposit Account Fraud Survey Report, 2004 This document is designed to provide general information only and is not legal advice. If legal advice or other expert assistance is required, the services of a competent professional should be sought. KeyBank does not make any warranties regarding the results obtained from the use of this information.

mitigating Payments Fraud risk:

HigHer education banking mitigating Payments Fraud risk: Strategies and best Practices for Higher education institutions 2 Mitigating Payments Fraud Risk: Strategies and Best Practices for Higher Education