The Triangulation of ACH Fraud, Wire Fraud and Check Fraud September 2020
Total Page:16
File Type:pdf, Size:1020Kb
The Triangulation of ACH Fraud, Wire Fraud and Check Fraud September 2020 Jeanette Mosley, CFO Greg Litster, President Presidian Hotels & Resorts SAFEChecks (210) 646-8811 ext: 223 (800) 755-2265 [email protected] [email protected] Fraud and the Coronavirus “…Moreover, the risk of B2B payments is even higher particularly as more employees work from home. Recently, Europol issued a warning of how cybercriminals and other fraudsters are adjusting their strategies to take advantage of the current climate uncertainty stemming from the coronavirus….” https://thepaypers.com/expert-opinion/b2b-payments-2019-2020-key- drivers-of-innovation--1243725 “ACH Network” = infrastructure for electronic payments between individuals and organizations. Began as a system for recurring transactions between parties who knew and trusted each other, but now includes one-time transactions between unfamiliar groups and individuals. 3 Almost 7 Billion ACH transactions in 2 nd quarter of 2020 alone! https://www.nacha.org/content/ach-network-volume-statistics 4 ACH Network = one of the safest payment systems in the world. HOWEVER… ACH fraud has almost tripled , from 12% in 2010 to 33% today (Unauthorized ACH Debits) AFP 2020 Payments Fraud and Control Survey AFP 2020 Payments Fraud and Control Survey “It is not the payment method itself that is compromised but the processes leading up to the payment initiation … “By gaining access to internal systems, fraudsters may successfully be able to generate ACH files…” AFP 2020 Payments Fraud and Control Survey Most ACH fraud could have been prevented if “best practices” had been followed by organizations or individuals. Some practices include : • Know the person with whom you are dealing – fraud happens by incorrectly assuming an unknown party is legitimate • Utilize your bank’s fraud detection and prevention resources such as ACH Filters, Blocks, Transaction Review, UPIC codes • Monitor EVERY account daily, before 10:00 AM Frank Abagnale Fraud Bulletin, Volume 15 • Segregate accounts for better control - collections vs. disbursements - high volume vs. low volume - paper vs. electronic • Use encrypted email for confidential information • Mask account numbers and tax ID numbers in correspondence • Collect bank tokens and cancel password of an employee leaving the company. Remove them as a authorized signer or authorized user of ACH services. Abagnale Fraud Bulletin, Volume 15 Cybercrime Wire Fraud, BEC Scams & VEC Scams Wire Fraud is Cybercrime In 2010, wire transfer fraud represented only 3% of payment fraud attempts Today, it represents 40%!! (down from 48% in 2018) Wire Fraud 2010 – 2020 Wire Fraud 2010 – 2020 The problem is not the bank’s wire transfer system. It’s a human failure . Somebody falls for a clever social engineering scam. “Vendor ” VEC Scams Most organizations haven’t heard about VEC scams and are falling prey to them ! What’s at stake? Money Reputation Productivity Jobs - Human Impact “A newly discovered cybercriminal gang is putting a twist on business email compromise scams by targeting vendors or suppliers with phishing emails and then sending realistic-looking invoices to their customers to steal money….” https://www.bankinfosecurity.com/vendor- email-compromise-new-attack-twist-a-13170 “…it is being popularized by a cybercriminal group dubbed Silent Starling ….” https://www.agari.com/email-security-blog/silent- starling-vendor-email-compromise/ https://www.agari.com/email-security-blog/silent- starling-vendor-email-compromise/ Fraudsters gain access to a vendor or supplier’s employee email account and watch those communications, become knowledgeable about the business operations, and attack: Fake invoices with “change-of-bank ” data sent to the customers of that vendor or supplier ─ style mimicking the employee. In < a year, 700 employees ’ email accounts in 500 companies have been infiltrated by Silent Starling . Most victims were in USA, Canada, and UK. https://www.agari.com/email-security-blog/silent- starling-vendor-email-compromise/ The BEC Email Scam RequestsRequests areare typicallytypically urgenturgent andand confidentialconfidential LookLook forfor SPOOFEDSPOOFED domaindomain registrationsregistrations Identifying the Difference in Email Domains Real Information Classification: Public Fraud Information Classification: Public Identifying the Difference in Email Domains [email protected] [email protected] Information Classification: Public Identifying the Difference in Email Domains [email protected] [email protected] Information Classification: Public InternationalInternational wireswires areare mostmost common,common, butbut requestsrequests forfor USUS paymentspayments andand W-2W-2 recordsrecords areare increasingincreasing WhenWhen replying,replying, useuse ForwardForward NOTNOT ReplyReply Information Classification: Public DoDo callbackscallbacks oror otherother out-of-bankout-of-bank verificationverification to to aa knownknown goodgood contactcontact sourcesource NEVERNEVER callcall thethe numbernumber onon thethe emailemail BEC Scam Videos BEC Scam Videos https://www.youtube.com/watch?v=sxybmE1rrZg BEC Scam Videos Staff Training Video https://www.youtube.com/watch?v=LfGaDd7-dlk This EXCELLENT video has been taken down, but I saved it. Email: [email protected] BEC Scam Videos https://www.youtube.com/watch?v=LfGaDd7-dlk This EXCELLENT video has been taken down, but I saved it. Email: [email protected] VEC Scams and BEC Scams target Organizations & Businesses It is not a “bank” problem It’s human failure A recent unsuccessful email scam received at SAFEChecks – Hovering cursor over Name on “button” did not match banker’s info NEVER click on embedded links!!! Scam email attempts can happen to anyone ! Be afraid Be very afraid Scam email attempts can happen to anyone ! Be afraid Be very afraid Strategies to defeat VEC Scams Verify that the email address source is correct. (Domain addresses are changed by 1 or 2 letters!) Look at words, phrasing of email – very slight differences in grammar style, misspellings. Spoofed emails in VEC & BEC scams don’t trigger spam traps because the targets are targeted. Verbally confirm all change-of-bank notifications – Don’t call the number on the invoice. Wire Fraud Court Case Choice Escrow and Land Title vs. BancorpSouth Bank Choice Escrow and Land Title vs. BancorpSouth Bank Important Link http://courtweb.pamd.uscourts.gov/courtwebsearch/mowd/qmC2dt555T.pdf Choice Escrow and Land Title vs. BancorpSouth Bank March 17, 2010: Bank received an online banking wire transfer request to wire $440,000 from Choice Escrow’s Trust Account Wire transfer $440K to Republic of Cypress Request NOT legitimate – Choice Escrow employee’s computer had been hacked; taken over by fraudsters http://courtweb.pamd.uscourts.gov/courtwebsearch/mowd/qmC2dt555T.pdf Computer Takeover: NO “Dual Control” 1. The wire to Cypress was initiated using the User ID and password of a Choice Escrow employee 2. Wire was initiated from IP address registered to Choice 3. Bank authenticated employee’s computer by detecting the ID secure token device the Bank had installed 4. Immediately after wiring funds, Bank auto-generated a Transaction Receipt that was faxed to and received by Choice Escrow. Fax placed on a desk, without review until the next day. The money was gone! Bank: Customer failed to implement Dual Control Bank required online banking customers sending wires to utilize “Dual Control” (Dual Control = 2 computers, 2 different logins, passwords) Wire transfer could only be effectuated by two individuals using separate User IDs and passwords Choice declined in writing , TWICE , to use Dual Control Feeble Legal Argument against using Dual Control Choice contended “Dual Control” was not “commercially reasonable” because… “…at times, one or both of the two individuals authorized to perform wire transfers through the [bank] system were out of the office due to various reasons. ” Court disagreed. Choice Escrow held liable for loss. Official Comments to the Funds Transfers provisions of the UCC: The purpose of having a security procedure deemed to be commercially reasonable is to encourage banks to institute reasonable safeguards against fraud but not to make them insurers against fraud . A security procedure is not commercially unreasonable simply because another procedure might have been better or because the judge deciding the question would have opted for a more stringent procedure. The standard is not whether the security procedure is the best available . Official Comments to the Funds Transfers provisions of the UCC: Sometimes an informed customer refuses a security procedure that is commercially reasonable and suitable for that customer and insists on using a higher-risk procedure because it is more convenient or cheaper. In that case , under the last sentence of subsection (c), the customer has voluntarily assumed the risk of failure of the procedure and cannot shift the loss to the bank . Court Order, March 18, 2013 "For"For thethe foregoingforegoing reasons,reasons, thethe CourtCourt GRANTSGRANTS thethe MOTIONMOTION OFOF DEFENDANTDEFENDANT BANCORPSOUTHBANCORPSOUTH FORFOR SUMMARYSUMMARY JUDGMENT.JUDGMENT. AllAll otherother pendingpending motions,motions, includingincluding allall otherother motionsmotions forfor summarysummary judgmentjudgment (including(including motionsmotions forfor partialpartial summarysummary judgment),judgment), areare DENIEDDENIED asas moot.moot. Accordingly,Accordingly,