Cyber Insecurity - Making Sense of Payment Fraud

Transcription

1 Cyber Insecurity - Making Sense of Payment Fraud James Richardson Head of Pre-Sales & Consulting Thursday 23 February 2017 BCS, Chartered Institute for IT

2 Businesses and Banks rely on Bottomline for domestic and international payments efficient cash management tools that manage payments automated workflows for payment processing and bill review 1 fraud detection, behavioral analytics and regulatory compliance 1

3 Welcome! Together we ll explore A crazy time for payment frauds 30 minutes It won t happen to me 5 common myths What organisations can do right now to improve their defences

4 2016, a great year for the Cyber Fraudster! Money taken from 7% of Tesco Bank s current account customers Assurances quickly issued, although uncertainty with customers witnessed in media Lock-down of online purchases for all 136,000 customer accounts

5 2016, a great year for the Cyber Fraudster!

6 20167, a great year for the Cyber Fraudster! "The entire ABB group all 132,000 of us will have to live with the consequences uncovered significant embezzlement and misappropriation of funds "The treasurer of the South Korean unit is suspected of forging documentation and colluding with third parties

7 Less sensational but still headlines for corporates Yodel payroll clerk duplicated redundancy payments so cash was paid into his eight bank accounts and bank accounts belonging to his family and friends - 300K lost 2.6m Payment Diversion Fraud by requesting change of bank account details for contractor invoices Birmingham council tax payers charged twice after computer error - leaving them collectively out of pocket to the tune of about 500K 7

8 We asked organisations over the last 12 months In light of fraud and cybercrime, which of the following does your company feel most at risk, threatened or concerned by when it comes to processing business payments? Insider Fraud?? External Fraud? No Risk?? 8

9 1,000+ responses No Risk 11% Internal Fraud 12% External 77%

10 Given that you know the limitations and gaps in payment business processes, could you commit a fraud? (not would you?) 84% say Yes Bottomline anonymous survey of Senior and Operational finance individuals, April

11 According to the Association of Certified Fraud Examiners (ACFE), on average how long does it take to detect a fraud? 36 days A 110 days B 192 days C 270 days D

12 Following detection on average how long does it take to get to the root cause of a fraud? 32 days A 95 days B 105 days C 142 days D

13 The typical fraudster and he s been employed for more than 6 years, is a Senior Manager and has a position of authority. Boring frauds are the common frauds 93% of frauds involved multiple transactions Frauds taken place over 1-5 years KPMG: Global profiles of the fraudster: White-collar crime present and future & 2 Who is the typical fraudster

14 Statistically speaking before it was detected (270 days) If I committed a fraud today 2018 before you concluded investigation (105 days)

15 UK Invoice fraud losses in m 71% Increase over 2014 Source: Financial Fraud Action UK 17/03/16

16 Common payment fraud schemes CEO Fraud Payment diversion Fabricated invoices Duplicate invoices / payments

17 Who reads the detail anyway?

18 Who reads the detail anyway?

19 Yeah, yeah, yeah it won t happen to me! 5 common myths

20 5 common myths I can easily spot fraudsters Forget the image of a sweaty teenager in a hoodie, sitting a cyber café External frauds are using social media Insider is a real threat

21 5 common myths "We have got it covered, we're in control" Yesterday s processes are not good enough for todays fraud attempts, let alone tomorrows I phone my suppliers how long before that changes? 84% know of gaps in payment processes Source: Bottomline Survey 2016

22 5 common myths "It is not my responsibility, it's someone else's job" Protecting payments is EVERYONE s job Don t think someone else is looking at this Fraud & payment protection is not yet a common Board Room topic

23 5 common myths "I have a good IT system, it's fine" This is not just an IT firewall solution IT don t necessarily understand finance & treasury processes A lot of payment decisions are made by humans

24 5 common myths "My business isn't big enough to be impacted" Consequence of frauds in SME s are severe and crippling, with average 122k per incident Organisations with fewer than 100 employees are common victims of fraud Payroll fraud is also common (statistically by women in their 50 s) Sources: ACFE Report 2015/6

25 Don t be a fraud statistic Top 3 actions 1 Secure your payment channels Immediate alerts and blocking of suspicious payments before sending Take advantage of dual factor authentication where possible 2 Continuous education of staff Know your frauds, share information, keep up-to-date with trends A culture of challenging a payment is a good thing 3 Review payment processes from the beginning Review validation of suppliers/customers, invoice processing Understand and close the gaps, automate where possible

26