1. What’s New in Fraud Latest Threats and Fraud Control Solutions
Networking & Education
September 27, 2010

2. Agenda Fraud History and Trends Fraud Landscape
Fraud Examples and Best Practices
Employee Best Practices
Fraud Liability
Bank of America Merrill Lynch 2

3. Fraud History and Trends3 3

4. (industry estimates in $ millions, 1997-2008)
Historical Fraud Activity
Client Reported Attempted Fraud in Industry
Payment Methods
All Respondents
Revenues over $1B
Revenues under $1B
Checks
91%
94%
88%
ACH Debit
28%
Consumer Credit
18%
15%
19%
Corporate Card
14%
ACH Credit 7% 6%
Wire Transfer 4% 5%
Source: Association for Financial Professionals Payment Fraud Survey
Commercial Card Fraud
- Fraud attempts $11.4Billion in 2008
- 91% of fraud mitigated by prevention efforts
External Data Compromises
35% increase in data breaches 2008 to 2009
2009 single event included 130 million credit and debit account numbers (Heartland)
Best defense is to reissue account numbers for highest fraud risk accounts
(industry estimates in $ millions, )
Source: ABA Deposit Account Fraud Survey Report

5. Predicted Top Fraud Trends for 2010
Top 10 Fraud Trends Predicted for 2010
1. ACH/Wire transfer attacking small/medium businesses: Focus more on small- and medium-sized businesses as larger businesses increase security.
2. Attacks via Vendor-managed servers: Businesses that outsource their transactional network servers must ensure those vendors maintain acceptable security levels.
3. ATM skimming: Skimming machines look identical to legitimate ATM/card reader devices
4. First party fraud: Criminals gradually establish good credit using an alias with a card issuer or business and then “bust out,” running up enormous debt and abandoning the credit account.
5. Phishing: “phishing” attacks that illegally solicit victims’ personal information with official-looking requests are becoming more sophisticated, and increased 600% during 2009
6. Check fraud: Fraudsters have easy access to paper, printers and scanners to create phony checks. In addition, hackers can obtain detailed personal banking information from online check viewing services.
7. Internal fraud: Employees are increasingly a source of corporate fraud, as are contractors, business partners and suppliers.
8. Mobile phones: Web-enabled mobile phones are vulnerable to the same types of worms and viruses as PCs.
9. Online application fraud: Similar to first party fraud, this involves criminals manipulating multiple online applications using multiple identities from multiple access points.
10. Prepaid cards: Prepaid cards are a popular item for criminals to buy with stolen credit cards or steal and activate to obtain free spending power.
Bank of America Merrill Lynch
Source: The Fraud Practice, LLC - Predicted Top 10 fraud trends for 2010 in its biweekly newsletter.

6. Fraud Landscape: 6 6

7. Social Networking/Susceptibility
MySpace, FaceBook, and others have spawned new fraud tactics
63 percent of administrators worry that employees share too much personal data on social networking sites
Of those companies in this research: Twitter, FaceBook, LinkedIn and MySpace has accounted for one quarter of their malware attacks
Examples of direct messaging enticing Twitter members to phishing website (which attempted to steal their username and password)
Source: Sophos: Security threat report: July 2009 update
Phishing
Sends with lure of reward or value.
Loads virus on PC and gains access to vital information.
Uses information to commit various types of fraud.
Spear Phishing
Targeting high value employees (CFO, Treasurer, Administrators)
Obtain access to critical systems with payment capability
Bank of America Merrill Lynch 7

8. The Man in the Browser Attacks
Criminal community focuses attacks on corporate banking clients:
Greater availability of funds
Transaction limits are higher
Access to Wire Transfer and ACH through online channels
How it works:
Infection Path
Infected Download: Phishing suggesting user visit a site:
Breaking news report
Free software download
Phishing which looks as if it came from a financial institution
Browser or OS Vulnerability
Latest version of OS and browser not updated on user’s computer
Transaction Takeover
User launches their browser
Trojan is silently activated
Trojan stores or actively relay’s user’s activities without the user knowing
Trojans are coded to watch for one or more online banks
Bank of America Merrill Lynch 8

9. Keyloggers
Keylogger products have been available to purchase for years
Originally developed for legitimate uses but are also used for illicit purposes
Can be a piece of hardware or a thumb-drive that attaches to a computer and records keystrokes
Can also be software that can capture and relay similar information
All of these devices and software applications are readily available for purchase. Hardware keyloggers can be bought on ebay for around 80 dollars.
Bank of America Merrill Lynch

10. Fraud Examples and Best Practices10 10

11. Online Banking Fraud Online Banking – ACH & Wire Fraud
Gains Client login credentials for user ID with dual access: Initiate and Release financial transactions.
Perpetrator monitors legitimate user usage for one month prior to executing ACH transactions.
Changes recipient information on existing ACH batch or standing wire template.
Times transfer so that partners at recipient banks are ready to quickly withdrawal funds or further transfer to another bank outside the US.
Online Banking – Check Fraud
Gains access to Client’s Online Banking service accessed from a Trojan program.
Looks at check issue patterns, captures check copies with signatures.
Can sell information on the open market or give to their own fraud ring.
Perpetrates fraud against the company with counterfeit checks in a coordinated manner.
Same amount, same serial number/range, at different check cashing points at the same time.

12. Securing Online Banking Interactions
The paradox of fraud
Today companies expect anytime, anywhere banking that integrates efficiently into workflow. The trend is toward real-time communication and Straight Through Processing.
Considerations need to be made to balance convenience and security.
Carry out all online banking activities from a stand-alone computer system.
Dedicate one workstation for Payment Initiations and one workstation for Release functions.
Install and maintain anti-virus, anti-malware, spyware applications, and operating system patches.
Never access online banking via Internet cafes, public libraries or open Wi-Fi hotspots.
Avoid using an automatic login features that save usernames and passwords for online banking. Clear the browser cache prior to initiating an online banking session.
Implement Dual Administration
A single user should never have Initiation and Release capabilities.
Prohibit shared user names and passwords. 10 characters minimum alpha numeric.
Report suspicious transaction activity to the your bank immediately, particularly when Wire or ACH transactions are involved. Response time is critical to minimizing losses.
If Bank of America client, forward “Phishing” s to
Contact authorities to report any fraud attempts or instances.

13. Check and Deposit Fraud
Stolen Check Ring
Fraudster takes checks out of the mail (post office, lockbox, company)
Wash check and change payee information.
“Mule” opens bank account with fraudulent credentials and deposits/cashes the check.
Stolen Check – business account
Fraudster takes checks out of the mail (post office, lockbox, company).
Goes to State web site and obtains new business credentials that are the same or similar to the check.
Bank account is opened and checks deposited.
Funds withdrawn via various methods.
Business purchase/sale
Fraudster poses as representative of company engaging in a business purchase.
Loads virus on PC and gains access to vital information.
Uses information to commit various types of fraud.
Refund scam
Customer makes writes company a check for deposit on a new service. Could include overpayment such as $550 for a $50 deposit fee.
Customer calls up and cancels service or return the “accidental” overpayment
Company gives customer a $500 check for the overpayment
Initial deposit of gets returned days later as counterfeit.

14. Check Fraud Prevention and Best Practices
Check Fraud Best Practices
Reconcile accounts on a daily basis
Segregate internal duties for financial activities (Audit/Control)
Consider migration from Check Payments to Electronic Payment Products
Become fraud focused on inquiries from other banks or institutions regarding legitimacy of checks
Separate “Funding Only” Accounts to No Check Activity Status to prevent counterfeit item from clearing
Escalate suspicious activities to client manager team
Safeguard check stock. Use check stock security features.
Consider outsourcing check processing to secured vendor.
Check Fraud Prevention Products
Positive Pay - Automate review of items before decision to Pay or Return
Teller Positive Pay - Integrates check decision at the teller in banking centers
Payee Positive Pay - Determine if payee names have been altered
Reverse Positive Pay - Notify bank of exception items identified on file
Maximum Dollar Control - Flag any check over a given dollar amount to decision

15. Employee Best Practices15 15

16. Fraud Prevention Best Practices
Employee Education: Best Practices in user Awareness Training
There is a direct relationship between the amount of user training and the decreased number of successful fraud attacks. The following list highlights some best practices:
Don’t assume employees understand and internet risks. The courts appreciate policies based on best practices and supported by mandatory enterprise-wide training and enforcement through disciplinary action.
Don’t rely only on your company’s or intranet to inform employees of and internet policies and procedures. Distribute a hard copy of policies to every employee. Require employees to sign and date each policy.
Set rules for personal internet usage. Specify how much web surfing is allowed when and with whom it is permitted, and under what circumstances.
Ensure that employees understand policies toward monitoring their computer activity, and that violations of corporate and internet policies are enforceable through disciplinary action that may include termination.

17. Fraud Prevention Best Practices
Specificity in Employee Training
Specificity strengthens the impact of employee training. Simple, straight-forward examples can be the most powerful for employee training. Here are some ways in which you can cite examples or case studies:
Show employees how to recognize threats and convey the consequences of those threats
Be explicit about what to look for to identify a malicious
Discussion or frequent reports of new threats and statistics of how many viruses have been caught within your organization, can help to raise their security awareness
Create explicit instructions for employees, such as:
Never turn off security protection on your computer and stay current with updates
Keep passwords in a secure place. Do not share them with coworkers
Do not use your personal computer for company business
Do not connect to the internet through suspect wireless networks (e.g., WiFi from a café)
Forward suspicious s to the company’s designated account (include the address)
Never give your business address to a website
Open only identifiable attachments from known sources. Financial institutions and government agencies never ask you to enter personal data, such as passwords, SSN, account numbers, etc
Bank of America Merrill Lynch

18. Fraud Prevention Best Practices
Two Minute Self-Assessment on Best Practices
Front-Door Security
Do you or your team use workarounds to streamline access to your bank’s portal or online applications (e.g., group sign-on with shared passwords)? Or leave passwords lying around, like a set of keys to your office?
Do you have an IT department or outsource your security to a firm that ensures all PC’s engaged in your cash management activities have all the security basics deployed, and those PC’s are not operating in unprotected networks and used by other individuals?
Transactional Controls
Does your company use dual administration and mandate dual approval and segregation of responsibilities for payment activities, including template creation?
Does your organization use all authentication tools offered (e.g., tokens, digital certificates and encourage your employees to register their computers)?
Back-Door Security
Is a review of audit logs and bank account activity part of your department’s daily routine?
Does your user administrator immediately respond to changes in an employee’s job requirements by making necessary changes to user entitlements?
Employee Education
Do you have a formal employee education process — with user awareness training designed for specificity — for online security and fraud prevention?
Do all employees receive hard copies of all internet policies and procedures? Are they required to sign and date each policy?

19. Fraud Liability 19 19

20. Fraud Liability Regulation E:
The Electronic Funds Transfer Act (EFT), also known as Regulation E, was implemented in the U.S. in 1978 to establish the rights and liabilities of consumers as well as the responsibilities of the financial institution in EFT activities.
Regulation E covers a consumer under certain conditions, limiting loss to $50 if the institution is notified within two business days.
Reg E Purpose: Consumer Protection
There currently are no similar loss protections for commercial customers that limits the amount of fraud losses a business could bear from fraudulent ACH or wire transfers.
Security is a shared responsibility between the business, consumer, and financial institution.

21. Fraud Liability
Regulation CC: Current UCC Codes outline specific check fraud responsibilities for banks and corporations. Court decisions have already established guidelines for legal responsibilities, and failure to meet these guidelines can cause a bank or company to experience financial loss.
UCC Revisions now define responsibilities for check issuers and paying banks under the term ordinary care. Under Sections 3-403(a) and 4-401(a), a bank can charge items against a customer's account only if they are "properly payable" and the check is signed by an authorized individual. However, if a signature is forged, the corporate account may be liable if one of the following exceptions applies:
Ordinary care requires account holders to follow "reasonable commercial standards" prevailing in the area for their industry or business. failure to exercise ordinary care, may restrict restitution from the payee bank if their own failures contributed to a forged check signature or an alteration - (for example, raising a check amount from $50 to $5000).
Requires customers to reconcile their bank statements within a reasonable time to detect unauthorized checks.
Comparative fault can shift liability to the check issuer. If both the bank and corporate account holder have failed to exercise ordinary care, a loss can be allocated based upon the extent that each party's failure contributed to the loss. Since banks are not required to physically examine every check, companies may be held liable for all or a substantial portion of any given loss - even if the bank did not verify the signature on a fraudulent check.
Liability for counterfeits that are virtually identical to originals will be examined on a case-by-case basis.

22. Questions?
This presentation is for informational purposes only. It does not constitute an offer or commitment to buy or sell or a solicitation of an offer to buy or sell a security or any financial instrument, or a commitment to enter into a transaction, of the type generally described herein.
The information contained herein, and any other communications or information provided by Bank of America, is not intended to be, and shall not be regarded or construed as, a recommendation for transactions or tax, business, legal, or investment advice, and Bank of America shall not be relied upon for the same without a specific, written agreement between us.
The information contained herein has been obtained or derived from sources believed to be reliable, but we do not represent that it is 100% accurate or complete and it should not be solely relied upon.  The information contained in this presentation is not legal advice.
Thank you! 22 22