pacb fraud seminar 2021
TRANSCRIPT
PACB Fraud Seminar 2021
Pennsylvania Association of Community Bankers
November 9, 2021
The information contained in this manual is for informational purposes and is not legal advice. Users are encouraged to consult legal counsel and/or their banking regulator, as appropriate, directives, information and opinions included here are solely those of the author. This information contained herein should be adjusted by each financial institution to conform to its particular circumstances and related policies and procedures. The author will not be responsible for any consequences resulting from the use of any information contained herein.
PACB
Fraud Seminar 2021 Table of Contents
National Update Page 3
Three Ps of Financial Crime Page 10
What Keeps You Up at Night Page 39
Diffusing Hostile People Page 44 Board Reporting Page 56
National Update
National Security Update BARRY THOMPSON
Work From Home Or Stay At Office?
Working From Home
Workforce Confidence Report Workers in support roles are most likely to be stressed out by their colleagues and clients, according to LinkedIn’s latest Workforce Confidence Report, with 28% citing it as a top stressor in the workplace. Tension is also high in roles such as healthcare services (22%), information technology (21%) and sales (21%).
Working From The Office
OVEREMPLOYED.COM
Legal Pot
New Fraud Developing From Covid
QR Fraud
Defund Law Enforcement
Risk Assessment or Vulnerability Assessment?
For More InformationBarry Thompson
Thompson Consulting Group, LLC315.342.5931
This presentation is designed to provide accurate and authoritative information with regard to the subject matter covered. It is provided with the understanding that the publisher is not rendering legal, accounting, or other professional services.
If legal or other advice for your specific situation is needed, the services of a professional should be sought.
Three Ps of Financial
Crime
The Three P’s of Financial CrimeARVIN E. CLAR, CFE
What We Will DiscussProfiles in Financial CrimeProsecution of Financial Crime CasesPrevention of Financial Crimes
Profiling of Financial Crimes Arvin’s Fraud Triangle Suspect“Tools of the Trade” Crime Trends The Involvement of Organized Crime “OC”
Fraud TriangleBad guys will always find a weakness and exploit!Internal or external crimes.
Opportunity
RationalizationPressure
Arvin’s Fraud Triangle Subject
Investigative Review
Define the Loss
1. Identifying the subject(s)
2. Define and Track the loss(es)
3. Post Investigative Review (Find the weakness!)
Arvin’s Triangle (cont.)
Three sides of fraudulent activity Identifying the subject(s)
Define and Track the loss(es)
Post Investigative Review (Find the weakness!)
Identifying SubjectDeveloping “Intel”
Google (look at open sources) Refer to prior SAR(s)(they will be back) Check County “Clerk of Court’s” site “Call around”(Forged LE relationships) BEGIN TO DOCUMENT
The Suspect
Check & Debit Card Fraud Theft of Identity, “card cracking” Mortgage & Loan Fraud (Rescue Scams) International attacks
Suspect’s “MO”18 – 32 years of age, with an understanding of business and bankingMost likely have an inside sourceStrong indicators they have “OC” involvement
The Suspect Gang Involvement Foreign Involvement Cyber Involvement
“Tools of the Trade”Driver’s LicenseSpurious IdentificationValid Customer Information
Examine the Driver’s LicenseCompare the date of issue to birth date.Evaluate the height and eye color to the individual at the counter.View the photo to determine if it is the same person as well as the clothes in the photo to the clothes on the individual!Do not be afraid to ask questions.
Spurious IdentificationCheck out “fake ID” on the Internet.False or stolen “Tax ID” numbers are being used by professional fraud suspects in the financial environment.When in doubt, check with “state division of commerce” online for officers and company info.International drivers’ licenses do not exist!!
Compromising Customer InformationStealing mail from mailboxes (FLAG DAY) and offices as well as “trash diving” in upscale zip codes, are the most common form of fraud activity. Internet sites (eBay and Monster) are most common “takeovers” by Nigerians and Eastern Europeans. Selling of customer & employee information by other employees is still very active and on going.
Crime TrendsOrganized Crime GroupsInternational Organized Crime Groups“Street” Criminals
Organized Crime GroupsRely on employees to remove customer information from banks, retail stores, and medical offices, as well as insurance companies.Sell the information for identity theft, “account takeovers,” as well as mortgage fraud opportunities.Selling of customer information by “batching” and promoting the information on “Dark Web” sites.
International Organized Crime GroupsMaking use of diversification and using of legitimate account holders.
Indicator of fraudulent activity “work from home”
Indicator of fraudulent activity “personsl assisatnt”
Indicator of Fraudulent activity “internet loan applicaiton” quick money “immeadeat approvoal”
“Old School”When opening a new account; send a thank you letter
If it comes back “no such person or address” Flag it!
If person calls the bank and says “that aint me”Flag it.
ZAP it!Does the new account make logistical sense?
Zip Code
Address
Area Code (** cell phone)
Lottery ScamsLottery letters inform the victim that they have won $10-50K and that they are to return $2.5-5K for tax liabilities.All return money is requested and ordered to be sent via Western Union / MoneyGram!Very successful with older account holders in inner cities.Counterfeit “Official” or “Cashier” checks are mailed out and are excellent quality to the untrained eye.When in doubt, exercise check “holds” and attempt to verify authenticity with holding bank.
eBay & Craig’s List ScamsValid items being sold by victims are purchased with counterfeit check.Overpayment by suspects is common and request of repayment is made via Western Union or MoneyGram.Very common for apartment rentals in “college towns” both in the US and Europe.
OC (Organized Crime)Internet banking is a growing area with the Eastern European “account takeovers”The most common approach of the suspect is to gain confidence and control through “chat rooms” and with romance schemes as well as “work from home” internet scams.Counterfeit check or foreign ACH will be deposited into the valid customer accounts.Advised by suspects to forward funds back via Western Union or MoneyGram or “wire”.
“Street Criminals”Impulse Behavior - “thinking for the minute”Suspects test debit cards at POS. Charitable Scams Home Health Care
Charitable ScamsScams that are affecting our seniors.Especially following disasters.Via internet, email, telephone & mail.Request money to help those in need.
Charity Scams Research before you donate
Methods:
Door-to-door
Social media
Telephone
Home Health Care ScamsLocal people hired to take care of elderly, many have criminal history.Have access to bank account information.Have access to mail and credit information.Place their name (suspect) on accounts and open credit accounts.
Cyber CrimeInvestment ScamsHijacked Accounts“Skimming”Bitcoin and Cyber currency scams.
Investment ScamsVictim gets on mailing list, receives information on a “too good to be true” investment opportunity.Must contact only that person listed at the number printed.Must act immediately!After obtaining the victim’s money, suspect sends the victim a counterfeit check.
Hijacked AccountsConstantly increasing form of computer fraud and theft of identity.Goal is $. Most data breaches occur by suspects outside of the U.S., making it difficult to stop, if not impossible!
The Infinity factorThe “Affinity Theory” is described by persons obtaining the trust of the victim.The suspect may portray or “project” to be active in the victim's social circles, church, or close relationship with other family member.The victim’s trust is based on the suspect’s ability to falsely project involvement with or having close ties and same beliefs of the victim. (i.e. Bernie Madoff)
Romance Scams
31
Work-from-Home or Employment Scams
32
33
Skimming Warning SignsParasite Skimmer - Placed over the card access unit.Unattended units are easily compromised.Unusual Signage - “Swipe here before using card!”
Cyber Crime Websiteswww.ftc.gov (ReportFraud.ftc.gov)www.antiphishing.orgwww.fbi.govwww.usss.govwww.usps.govwww.icann.orgwww.lookstoogoodtobetrue.org
Prosecution of Financial Crime CasesCase MethodologyEvidence GatheringHaving the Case Prosecuted
Case MethodologyConducting the InvestigationGathering the FactsPreparing the ReportCriminal Enterprise & Money Laundering
Conducting the InterviewWho had access?What is missing?When was it discovered?Where were the items kept? Why is theft suspected?How was cash or items taken?
Developing the SubjectOpportunity – Who had access? Who has Financial need? Look at Credit History.Document, Document, Document!Look for non-shareable problems –Drug/Alcohol AbuseGamblingSpeak to an employee you trust who may hold a similar position or understands the job. Ask “how could someone commit the crime?”
Gathering the EvidenceObtain written and “signed” statements.Take photos of area and inventory the property. Look at surveillance videos & questionable documents.Use forensic examiners and auditors
ReportsReports should be in “chronological order.”Report should be in a synopsis format and include all affidavits of customers.Explain where the evidence is being held and all contact information of reporting person. Report only factual information. (no opinion!!)3 copies (Prosecutor, Police & Institution)
Prosecutor & Law Enforcement - Selling Your CaseComplete police report & obtain copy for case file.Request time with police & prosecutor for case discussion.Have case ready and “readable,” make it easily understood.
Criminal EnterpriseEngaging in a Pattern of Corrupt ActivityAggravated Grand TheftCrimes Against the ElderlyMoney Laundering
Making the Case for “Organized Crime”Engaging in a pattern of criminal activity.Levels of suspect involvement and participation within the institution and their employees.Laundering proceeds of tainted money from criminal enterprise.Selling of customer information in organized effort.Losses exceed $100K.
Prevention - Laws for Protecting Profits Apathy about protecting profits will create opportunity!Given the opportunity, losses will occur!As management’s attitude toward loss prevention is perceived, employee’s attitudes follow. Losses will occur in the absence of responsible fulfillment of duties.
PreventionTrust in employees must not replace security and control measures.Employee disrespect for management will often breed losses.Without a doubt, losses will rise to the level acceptable to management.“Lead by example, not by fear!”
Rule # 1 “Hire Honest People”Always compare resume to application.Review your application for the correct question. “Have you ever been convicted of any criminal offense?”“Have you ever been admitted into a Diversion Program or First Offender’s Program?”
“Pre-Employment Screening”Contact Prior EmployersCredit HistoriesDrug ScreeningCriminal & Driving Record ChecksEducation Verification
Why Do Employees Steal?Employee theft due to employee debt problems.An honest person presented with a “golden” opportunity!
Warning Signs of Employee TheftRecords altered or missingChronic shortages“Over reaction” to auditsChanges in employee personalityEmployee living beyond their means“Too much control by ONE person”
Policies & ProceduresHave a written policy clearly defining the punishment for dishonest activity.Prevention is more preferable to apprehension.Have an Ethics Policy and have employees acknowledge and sign!A person’s opportunity to steal increases with the level of apparent trustworthiness.
Employee TrainingEmployee “Hot Line”Periodic Training for Fraud Prevention Reinforce the Correct Behavior (Awards)Training in “Social Engineering”
Customer TrainingEmails to customers on new “scams”.Posting “scam” info on your website.Asking the media to publicize new “scams”.Training employees to answer questions!
Questions?
54
For More Information
Thompson Consulting Group, LLC315.342.5931
This presentation is designed to provide accurate and authoritative information with regard to the subject matter covered. It is provided with the understanding that the publisher is not rendering legal, accounting, or other professional services.
If legal or other advice for your specific situation is needed, the services of a professional should be sought.
What Keeps You Up at Night
What Keeps You Up At Night BARRY THOMPSON CRCM
I Can’t Sleep!
How Many People Should Staff A Branch?A. You only need oneB. Two are enoughC. Three are enoughD. Four is the bare minimum E. Any number is ok
When do you activate a bank alarm during a robbery?
a.During the actual robberyb.When the robber leaves the bankc.When the teller feels safe
Should You Ever Use A Guard?a. Never use a guardb. Guards are the smartest investment
a bank can makec. Depends on the situation
Should The Guard Be Off Duty Law Enforcement?a. Never b. Always c. It depends on the situation
What Signs Should We Or Shouldn’t We Use?No Video, Audio or Photography Allowed!
For More InformationBarry Thompson
Thompson Consulting Group, LLC315.342.5931
This presentation is designed to provide accurate and authoritative information with regard to the subject matter covered. It is provided with the understanding that the publisher is not rendering legal, accounting, or other professional services.
If legal or other advice for your specific situation is needed, the services of a professional should be sought.
Diffusing Hostile People
Diffusing Hostile People ARVIN CLAR, CFE
ObjectiveOur most important role and responsibility is to make sure that our accountholders, visitors, and employees are safe during their time on our property.
“You see, but you do not observe. The distinction is clear.”The Adventures of Sherlock Holmes, Sir Arthur Conan Doyle
Who is the Problem?
An Accountholder(s) A Visitor(s) An Employee(s)
What Are Accountholders Worried About? “You won’t cash my check.”“You will put a hold on my check.” General fear of financial institutions. Fear of formal institutions of any type.“Money is missing from my account.” Misdirected anger – trouble at home/work or mad at the world
Causative Factors of “Hostile People” Frustration Lack of understanding Terminations Mental health issues Critical incidents
Environment Music Use of Glass/Speakers Use of Discretion in Crowded Room
Causative Factors of “Hostile People”Frustration
“No one called me back. They told me that someone would call me!”
“The person I spoke with was rude!”
Causative Factors of “Hostile People”Lack of Understanding
Most accountholders do not know the inner workings of your financial institution. Sometimes we need to take a breath and explain our process. Nothing will be done in a few hours.
Best Practices Service – Treat others as you would expect to be treated.Call when you promise to call.Do not say “It’s not my job.” Say, “Please give me some time and I will find the answer for you.”
Warning Signs“Acting Out” behavior out of norm for the individual Violent Actions - loss of controlFantasying - “If I could wish harm to someone” Loss of Logic
Warning SignsBecoming “non-verbal” Speaking with actions! Passive aggression.Inappropriate relations between accountholder/employee.
Cognitive ListeningLet the person tell their entire story.Do not interrupt or finish their sentences.Never say “I know how you feel!” - You most likely do not know how they feel.
Cognitive ListeningRemove the Words: NOWON’TCAN’T
Replace with phrases of: I understand your position and I share your concern!
Cognitive Listening
Nod head to agree as they speak.Use acknowledging phrases such as: “We value that you have been an accountholder for ten years.”“I have worked on your account for ten years.”
Cognitive Listening
No one is paid to be sworn at!Once swearing begins, set boundaries!!!
Course of Action If the problem escalates…Set a boundary – tell them to stop and ask them to leave.Close the account and send a letter.Document, Document, Document – if not in writing, it did not happen.
Course of Action If the problem escalates even further…Civil Action – Restraining OrderCriminal Action – Criminal TrespassingProsecutor – Mediation Hearing
Course of Action
Say we are sorry?
Move the employee
“Beer Muscles”
Telephone Problems
For More Information
Thompson Consulting Group, LLC315.342.5931
This presentation is designed to provide accurate and authoritative information with regard to the subject matter covered. It is provided with the understanding that the publisher is not rendering legal, accounting, or other professional services.
If legal or other advice for your specific situation is needed, the services of a professional should be sought.
Board Reporting
Board Reporting: The Security PerspectiveBARRY THOMPSON
Board Reporting
Security is a necessary evil.
ORSecurity is a vital function of the bank.
The Problem I can’t obtain funding.They don’t take my position seriously.What should I be reporting to the board?The average bank robbery = $2,500We have never been robbed.The newest examiner reviews this area.
Your Goals1. Establish the value of the Security/Risk Management
position.2. To obtain funding for the position.3. To limit liability for your bank.
Objectives1. Demonstrate Need2. Gather Information3. Prepare the Written Report4. Present to the Board
Demonstrate NeedRegulation H, Subpart F12 CFR § 208.61 Bank security procedures
(a) Authority, purpose, and scope.Pursuant to section 3 of the Bank Protection Act of 1968 (12 U.S.C.1882), member banks are required to adopt appropriate security procedures to discourage robberies, burglaries, and larcenies, and to assist in the identification and prosecution of persons who commit such acts. It is the responsibility of the member bank's board of directors to comply with the provisions of this section and ensure that a written security program for the bank's main office and branches is developed and implemented.
Demonstrate NeedRegulation H, Subpart F12 CFR § 208.61 Bank security procedures
(d) Annual reports.The security officer for each member bank shall report at least annually to the bank's board of directors on the implementation, administration, and effectiveness of the security program.
Security Officer’s Responsibilities Administer a Written Security ProgramOpening and Closing ProceduresSafe Keeping of Currency and ValuablesIdentify Persons Committing CrimesTraining of Officers and EmployeesTesting, Operating, and Maintaining EquipmentPhysical SecurityConducting InvestigationsInternal FraudOther Duties as Assigned
Education on “Foreseeable Events” ATM/On-Premise Customer RobberyBank RobberyInternal FraudFailure to Train Staff and Security OfficerOne Person Openings
Education on “Foreseeable Events” ExampleBlue Ridge Savings Bank in Greer, South Carolina
Who Was Sued?BoardSenior ManagementSecurity OfficerOutside Consultant
Education on “Foreseeable Events” Items SubpoenaedAnnual security report to the boardTraining of the Security OfficerRecords of staff trainingSecurity equipment and maintenance logsNight inspection reportsSecurity case files
Use the Proper Language Focus on statistics, facts, and information.
Influencing Management: Dollars and $ensePeer Ratios from ABA or State AssociationsPeer Ratios from Security GroupsDollar Losses Per X AccountsInternal Fraud: Losses Per Employee
Check Fraud Screen
General Fraud Screen
SAR Trends & AnalyticsSAR Category Trending Report
SAR Trends & AnalyticsSAR Geographic Trending Report
Board Financial Reporting
Restitution Reports
Influencing Management: Dollars and $enseOther SourcesFBI Crime StatisticsAssociation of Certified Fraud Examiners - acfe.comASIS International - asisonline.orgIAFCI – IAFCI.orgLocal Law EnforcementCap IndexCrimecast Report
The Written Annual ReportPays significant dividends as an educational vehicle.The perfect opportunity to gain creditability.Establishes you as the “Subject Matter Expert”.
The Written Annual ReportValueRegulators Will Read ItDiscoverable in Court ProceedingsIndispensable If You Don’t Report in Person
The Written Annual ReportKey ItemsAll staff has been trainedAny special training conductedSpecial security officer trainingNumber of security caseshandledCommunity programsForeseeable events
Testing of equipmentServicing of equipment byoutside vendorMonthly branch reportsTraining records for boardreviewContact with law enforcementOrganize for the Casual Reader
The Written Annual ReportBest Time to ReportNOT at the End of a QuarterNOT During the Fourth QuarterFebruary, March, May, June and October
The Written Annual ReportMake an ImpactTop Sheet Should Include Your GoalPictures Are Very EffectiveVideo with iPad is BetterWritten Word Is Least Effective
The Written Annual ReportPictures Make an Impact - Example
block
The PresentationRules1. Remember they don’t
know security as well asyou do.
2. Don’t assume they knowyour systems.
3. Avoid acronyms.4. Never make a ballpark
guesstimate.
5. Always deal in factssupported by statistics.
6. Expect the unexpectedquestion.
7. General question = generalanswer.
8. Make no promises onoutcomes you can’tcontrol.
The PresentationFearsYou want to make a positive impression.Security Officer afraid of public speaking.You worry about questions from the board.
The PresentationRememberUse local examples – the closer to the better.Don’t make predictions or offer dollar amounts you don’tknow are accurate.
The PresentationWhat to Do If Your Request is DeniedRemember, this is a business decision.Get what you can for security and move on.What you have documented protects you and theboard.
Questions?
For More InformationBarry Thompson
Thompson Consulting Group, LLC315.342.5931
This presentation is designed to provide accurate and authoritative information with regard to the subject matter covered. It is provided with the understanding that the publisher is not rendering legal, accounting, or other professional services.
If legal or other advice for your specific situation is needed, the services of a professional should be sought.