external bank fraud-090510 from henry hardoon of hhassociates.co.uk

8/9/2019 External Bank Fraud-090510 from Henry Hardoon of hhassociates.co.uk

1/43

Paul Lower 2010

FRAUD DETECTION & CONTROL

EXTERNAL BANK FRAUD


2/43

Paul Lower 2010

External Bank Fraud

Why do robbers steal from banks?

because thats where the money is

WILLIE SUTTONUS bank robber

Stole $2m over 30 years

Spent half of his life in jail

go where the money is - and go there often


3/43

Paul Lower 2010

External Bank Fraud

The external threat to financial institutions

Banks and other institutions are desirable targets

Always have been, always will be

Robbery involves actual or threatened violence

Fraud involves deception, manipulation & concealment


4/43

Paul Lower 2010

External Bank Fraud

The threat to banks

Cheque and credit card fraud

Online banking fraud and Phishing

Identity theft

Advance fee fraud and 419 fraud

Money laundering

Foreign currency fraud


5/43

Paul Lower 2010


CHEQUE AND CREDIT CARD FRAUD


6/43

Paul Lower 2010

Cheque and Credit Card Fraud

Cheque fraud

Cheques remain important method of payment

Main types of external cheque fraud

Forged cheques

Cheque altering

Cheque theft and forged signature

Cheque Kiting


7/43


8/43

Paul Lower 2010

Cheque Altering

BRAKELYS BANK DATE 18-6-10

PAY Acme Homecare 669.99MR. J SMITH

Six hundredSixty Nine Pounds 99 pence

John SmithSORT CODE ACCOUNT CHQ NO SIGNATURE21-22-39 13256897 10032


9/43

Paul Lower 2010


Cheque altering variation 1

A dishonest salesman makes a sale for 69.99. The customer paysby cheque and writes the amount in the right hand side of the amountbox and the amount in words to the right hand side.

The fraudulent salesman uses the spaces to alter the cheque andincrease by 600.


10/43

Paul Lower 2010

Cheque Altering

BRAKELYS BANK DATE 18-6-10

PAY Acme Homecare 669.99MR. J SMITH

Six HundredSixty Nine Pounds 99 pence

John SmithSORT CODE ACCOUNT CHQ NO SIGNATURE21-22-39 13256897 10032


11/43

Paul Lower 2010



Johnson & Company Limited is a company that provides computerservices to small and medium sized clients and is frequently paid bycheques payable to Johnson & Co or Johnson and Company.


12/43

Paul Lower 2010

Cheque Altering

BERKSHIRE BANK DATE 18-6-10

PAY Johnson & Company 6,200.00

Six Thousand Two Hundred Pounds Only

John SmithSORT CODE ACCOUNT CHQ NO FOR THE SMITH TOOL COMPANY29-42-39 256897124 1005232


13/43

Paul Lower 2010



Johnson & Company Limited is a company that provides computerservices to small and medium sized clients and is frequently paid bycheques payable to Johnson & Co or Johnson and Company.

A dishonest post-room worker at the firm uses chemical solution toalter the cheque and make it payable to Johnson Cooper.

That could be the name of the fraudster, the name of an accompliceor the name of a false account specifically set up for the purpose.


14/43


15/43

Paul Lower 2010


Cheque fraud

Cheques remain important method of payment

Main types of external cheque fraud

Forged cheques

Cheque altering

Cheque theft and forged signature Cheque Kiting


16/43

Paul Lower 2010

Cheque Kiting

Cheque Kiting what is it? How does it work?

Check kiting takes advantage of the cheque clearing process tomake use of non-existent funds in a bank account.

It is defined as writing a cheque from one bank with insufficientfunds, then writing a cheque to another bank, also with insufficientfunds, in order to cover the absence.

The purpose of cheque kiting is to falsely inflate the balance of abank account in order to clear cheques that have been written thatwould otherwise bounce.

CASE STUDY


17/43

Paul Lower 2010

Cheque Kiting

A kite that soared to $1.3m before crashing

John Quaid pleaded guilt to a kiting scheme that inflated his accountbalances with Bank of America and USAA Federal Savings Bank.

Quaid, who ran several small businesses, wrote worthless chequesand deposited them in to his business accounts with the banks andartificially increased the balance in the accounts.

The scheme was a classic cheque kiting scheme.

After depositing one bad cheque in to one business account, he thendrew a second cheque on the second account with insufficient fundsand deposited in the first account to cover the first bad cheque.

CASE STUDY


18/43


19/43

Paul Lower 2010


Red flags of cheque fraud

Blank cheques missing

Cancelled cheques show signs of tampering

Signatures are missing or appear forged

Customer complain about payments not being credited

Misspellings or errors on cheques

If background checks on new account applicants revealdebt problems check kiting may be more likely


20/43

Paul Lower 2010


Preventing cheque fraud

Secure all cheques and enforce dual control of stock

Ensure and enforce all cheque limits

Conduct prompt bank reconciliations

Use anti-forgery cheque security features

Latest technology watermarking

Embedded fluorescent fibres


21/43

Paul Lower 2010



Secure all cheques and enforce dual control of stock

Ensure and enforce all cheque limits

Conduct prompt bank reconciliations

Use anti-forgery cheque security features

Encourage and reward employee vigilance

Credit check on new business account applicants


22/43

Paul Lower 2010



Restricted policies on use of uncleared funds

Use automated detection software to trap anomalies

Suspicious cheque account transactions

Frequently overdrawn accounts


23/43

Paul Lower 2010


Credit card fraud


24/43


25/43

Paul Lower 2010


Red flags of credit card fraud

Customers complain of unauthorised purchases

Unusual patterns in multiple customer card accounts

Sudden surge in cards maxing out quickly

Unusual increase in out of pattern purchases


26/43

Paul Lower 2010


Preventing credit card fraud

Use best security including chip and PIN

Mail cards and PIN numbers separately

Work closely with merchants on prevention measures

Insist on photo ID with large purchases

Insist merchants use chip and PIN technology

Or check signature against another document

Scrutinise cards for signs of forgery


27/43

Paul Lower 2010


Preventing credit card fraud

Use best security including chip and PIN

Mail cards and PIN numbers separately

Work closely with merchants on prevention measures

Maintain highest security on credit card database

Operate 24 hour hotline for card theft reporting


28/43

Paul Lower 2010


ONLINE BANKING FRAUD


29/43

Paul Lower 2010

Online Banking Fraud

Fraud for the 21st century

Online methods increasingly the mode of fraud

Fraud against financial institutions

Fraud directly against customers and individuals


30/43


31/43

Paul Lower 2010

Customer Data Theft

We will never know the numbers of records stolen

The largest breach of corporate information security so far is the2008 cyber attack on Heartland Payment Systems, one of the largestprocessors of credit card transactions in the US.

The crime affected more than 600 financial institutions and resultedin the loss of more than 100 million card numbers and other data.

Although the breach was shrouded in secrecy, sources said

we will never know the exact number of records stolen in thesecurity breach; but we do know that the company processes

payments for 175,000 merchants at the rate of 100 milliontransactions per month and the breach was going on for 6 months

CASE STUDY


32/43

Paul Lower 2010


Online fraud against financial institutions

Usually aimed at breaching computer security

To steal large volumes of confidential customer data

Cyber criminals use several tactics

Direct hacking attacks on company networks

Internet based attacks

Malicious computer code and viruses

Social engineering


33/43

Paul Lower 2010


Social engineering

Not in itself a type of fraud

It is a psychological tactic aimed at obtaining theinformation needed to commit a fraud

Social engineering is:

A scam that preys on our acceptance of authority and

willingness to cooperate with others. The Social Engineersobjective is to extract sensitive information, including login

names and passwords for websites.

These scams usually take place via email or telephone


34/43

Paul Lower 2010


Online fraud against customers

Challenge is that fraudsters move quickly

IT security professionals engaged in constant battle

Cyber criminals attack customers to steal personalinformation to raid credit cards and bank accounts

Trojan horses

Keystroke logging software

Phishing scams


35/43


36/43

Paul Lower 2010

Phishing Scams

NOT SPECIFICALLY ADDRESSED

NOT SPECIFICALLY ADDRESSED

NO ACCOUNT NUMBER


37/43

Paul Lower 2010


Phishing scams

Phishing is a form of social engineering

Usually in the form of a real email from the bank

A modern method of identity theft that allows thefraudster to assume the identity of the victim

Allows the fraudster to perpetrate a number of frauds

Theft from victims bank account

Fraudulent use of victims credit card


38/43

Paul Lower 2010


Red flags of online bank fraud

Customers complain of unauthorised withdrawals

Firewall logs show sustained illegal access attempts

Increase in warnings from anti virus programs

Multiple online accounts accessed illegally

Unusual patterns of multiple online customer accounts


39/43

Paul Lower 2010


Red flags of Phishing fraud

Unsolicited email requests for personal information

Email links to supposedly secure bank websites

Destination websites have long URL addresses

Emails are not personally addressed to recipient

Data requested is that which bank would have


40/43

Paul Lower 2010


Preventing information breaches

Avoid placing secure login boxes on insecure pages

Use strongest ID and password security

Maintain up to date firewall and anti-virus software

Install all updates and patches for operating software

Prohibit emailing of security-sensitive data

Screen and background check IT personnel


41/43

Paul Lower 2010


Preventing Phishing and online fraud

No foolproof way of staying ahead of cyber criminals

Key preventive measure is customer communication

Repeatedly warn customer of Phishing type scams

Always address customers by name

Use same strong URL for bank website


42/43

Paul Lower 2010


Preventing Phishing and online fraud

No foolproof way of staying ahead of cyber criminals

Key preventive measure is customer communication

Use PINsentry for access to online bank accounts


43/43

Paul Lower 2010


ONLINE BANKING FRAUD

external bank fraud-090510 from henry hardoon of hhassociates.co.uk

Documents