Combatting Fraud Security Planning Susan Lincke Security Planning

Combatting Fraud Security Planning Susan Lincke

Security Planning: An Applied Approach | 11/4/2020 | 2 Objectives: The student shall be able to: What are the key elements of fraud, and what techniques can be used to counteract these key elements? What are three categories of fraud and what crimes do they include? Define skimming, larceny, embezzlement, lapping, shell company, payroll manipulation, ghost employees. What are the legal considerations of fraud? Who commits fraud, and who commits the most expensive fraud? What are some red flags of potential fraud? How does social engineering occur, and how can it be prevented? Define the four roles of segregation of duties. Describe the purpose of the 3 stages of a fraud investigation.

Security Planning: An Applied Approach | 11/4/2020 | 3 The Problem Amount recovered following an Incident of fraud Organizations lose 5% of revenue annually due to internal fraud Average scheme lasts 16 months, costs $130, 000 22% costs exceed $1 M Smaller companies suffer nearly 2 x $ losses due to inadequate controls ($200, 000) ACFE 2018 “Report to the Nations on Occupational Fraud and Abuse”

Security Planning: An Applied Approach | 11/4/2020 | 4 How long fraud lasts before discovery

Security Planning: An Applied Approach | 11/4/2020 | 5 Internal or Occupational Fraud Definition Violates the employee’s fiduciary responsibility to employer Is done secretly and is concealed Is done to achieve a direct or indirect benefit Costs the organization assets, revenue, or opportunity

Security Planning: An Applied Approach | 11/4/2020 | 6 Fraud Categories % Cases, $ Average Asset Misappropri ation 89% $114, 000 Bribery & Corruption Financial Statement Fraud 38% $250, 000 10% $800, 000 ($4 million in 2010) Examples Theft of checks, cash, money orders, inventory, equipment, supplies, info Bribe to accept contractor bid or Kickback, Collusion, Bid rigging. Extortion: threat of harm if demand not met; False Billing: Providing lower quality, overcharging Conflict of interest in power decision Corporate espionage: Sell secrets Illegal Gratuities Revenue Over(under)statement: False sales Over(under)stating Expenses, Liabilities: Delayed or capitalization of expenses; not recording owed amounts Improper Asset Valuation: No write down of uncollectable accounts, obsolete inventory, … Misapplication of Accounting Rules: Improper disclosures, timing differences.

Security Planning: An Applied Approach | 11/4/2020 | 7 Fraud is an International Problem International Fraud Allocation by Type (some types) Asia-Pacific West Europe North Africa, Mideast Canada Latin America East Europe, Russia U. S. South Asia Sub-Sahara Africa Financial Corrup- Statetion ment Non cash Billing 51% 13% 25% 14% 36% 8% 17% 28% 49% 40% 51% 4% 14% 19% 18% 22% 15% 20% 11% 60% 30% 62% 10% 9% 10% 30% 21% 20% 15% 26% 13% 49% 9% 18% 17% 2018 ACFE Report to the Nations: Global Study on Occupational Fraud and Abuse

Security Planning: An Applied Approach | 11/4/2020 | 8 Legal Considerations of Fraud Intentionally false representation Not an error Lying or concealing actions Pattern of unethical behavior Personal material benefit Organizational or victim loss

Security Planning: An Applied Approach | 11/4/2020 | 9 Key Elements of Fraud Motivation: Need or perceived need Opportunity: Access to assets, information, computers, people Rationalization: Justification for action Motivation 3 Key Elements Opportunity Rationalization

Security Planning: An Applied Approach | 11/4/2020 | 10 How Internal Fraud is Discovered Tips provided by employees 53%, customers 21%, anon. 14%, vendors 8%. ACFE “ 2018 Report to the Nations: Global Study on Occupational Fraud and Abuse”

Security Planning: An Applied Approach | 11/4/2020 | 11 Collusion: Two or more employees or employee & vendor defraud together ACFE 2018 Global Study on Occupational Fraud and Abuse

Security Planning: An Applied Approach | 11/4/2020 | 12 Who Does Fraud? Most $$$ internal frauds committed by longer-tenured, older, and more educated staff Executives commit most expensive fraud: $850 K 19% • Median manager fraud: • Median line employee fraud: $150 K 34% $50 K 44% Most hit: Private company 42% $164, 000 • Public Company: • Government: • Not for profit: 29% $117, 000 16% $118, 000 9% $75, 000 96% have no criminal convictions related to fraud To steal a lot of money, you must have a position of power and access: • men > women by 75%; higher $ • Longer tenure higher $; 1 -5 years higher % 2018 Global Fraud Study Assoc. of Fraud Examiners

Security Planning: An Applied Approach | 11/4/2020 | 13 Discussion Points What types of fraud could computer programmers or system administrators commit? For each type of fraud, what methods may help to prevent such fraud?

Security Planning: An Applied Approach | 11/4/2020 | 14 Example 1: Financial Statement Fraud Executives, Wall Street have high expectations: employees needed to meet the standards. To meet these standards, it may be necessary to play the game, and financial statement fraud may be accepted. Methods of such fraud may include: manual adjustments to accounts or improper accounting procedures

Security Planning: An Applied Approach | 11/4/2020 | 15 Example 2: Corruption The Director of a subsidiary always purchases goods from 2 large organizations, who provide rebates for large purchase quantities. The director negotiated contracts and pocketed the rebates to an off-shore bank account. Local vendors are upset that their bids are ignored.

Security Planning: An Applied Approach | 11/4/2020 | 16 Example 3: Asset Misappropriation A manager took money from one account, and when payment was due, paid via another account. When that was due, she paid via a third account, etc. This lapping went on for years and was finally caught when a sickness resulted in her being absent from work for an extended period.

Security Planning: An Applied Approach | 11/4/2020 | 17 Asset Misappropriation Vocabulary Skimming: Taking funds before they are recorded into company records Cash Larceny: Taking funds (e. g. , check) that company recorded as going to someone else Embezzlement: Abusing a business privilege for personal gain Lapping: Theft is covered with another person’s check (and so on) Check Tampering: Forged or altered check for gain Shell Company: Payments made to fake company Payroll Manipulation: Ghost employees, falsified hours, understated leave/vacation time False Shipping Orders or Missing/Defective Receiving Record: Inventory theft

Detecting & Preventing Fraud How to Recognize Fraud How to Prevent Fraud Info. Systems Applications

Security Planning: An Applied Approach | 11/4/2020 | 19 Fraud & Audits are not designed to detect fraud Goal: Determine whether the financial statement is free from material misstatements. Auditors test only a small fraction of transactions Auditors must: • Be aware of the potential of fraud • Discuss how fraud could occur • Delve into suspicious observations and report them

Security Planning: An Applied Approach | 11/4/2020 | 20 Red Flags Living beyond means Financial difficulties Close association with vendors, customers Control issues, no sharing duties Divorce, family problems Wheeler-dealer attitude Dissatisfaction with job: complaints of pay, no authority Excessive pressure: organization or family Addiction Irritability, defensiveness Report to the Nations on Occupational Fraud and Abuse: 2018 Global Fraud Study. ACFE.

Security Planning: An Applied Approach | 11/4/2020 | 21 Work Habits of Fraudsters One or more: Justifying poor work habits Desperately trying to meet performance goals Over-protective of certain documents (poor sharing or avoids documentation) Refusal to swap job duties Consistently at work in off-time (early or late) or never absent Essentials of Corporate Fraud, T L Coenen, 2008, John Wiley & Sons

Security Planning: An Applied Approach | 11/4/2020 | 22 Concealment Methods Created fraudulent physical doc’s 55% Altered physical documents 48% Created fraudulent transactions 42% Altered transactions in accounting 34% Altered electronic doc/files 31% Destroyed physical documents 30% Created fraudulent doc/files 29% Created fraudulent journal entries 27% Duration of Fraud until Discovery 12 mos. 24 mos. 30 mos. Cash on hand Register disbursements Larceny Billing Expense reimbursements Financial statement fraud Check/payment tampering Payroll

Security Planning: An Applied Approach | 11/4/2020 | 23 Potential Transaction Red Flags Unusual transactions: Unusual timing, too frequent or infrequent Unusual amount: too much or too little Unusual participant: involves unknown or closelyrelated party Voided checks or receipts, with no explanation Insufficient supervision Pattern of adjustments to accounts Different addresses for same vendor, or vendors with similar names

Security Planning: An Applied Approach | 11/4/2020 | 24 Fraud Control Types Before Fraud: ***BEST*** Preventive Controls**: Preventing fraud includes: Segregation of Duties Ethical Culture & Policies Internal controls: Mgmt review Mgmt-signed Documents Fraud training Audits: Internal & eternal-> Fraud risk assessment Employee Support Programs Background checks Time of Fraud After Fraud Detective Controls: Finding fraud when it occurs includes: Anonymous hotline*-> Surprise audits*-> Proactive data*<monitoring Complaint or fraud investigation Mandatory vacations Rewards for whistleblowers Corrective Controls: Punishment-> Amend controls Fidelity Insurance Employee Bonding

Security Planning: An Applied Approach | 11/4/2020 | 25 Techniques to Discourage Fraud Realistic job expectations Employee support programs Motivation Adequate pay Training in job duties Key Elements Segregation of duties Oppor. Proactive data analysis tunity Internal audit dept. Mgmt review External audit Job rotation/mandatory vacation Physical security of assets Background checks Trained in fraud: mgmt. & employees Mgmt. certifies financial Rationalstatements ization Policy enforcement Code of conduct Sr. Mgmt models ethical behavior to customers, vendors, employees, share holders

Security Planning: An Applied Approach | 11/4/2020 | 26 Segregation of Duties Authorization Distribution Approves Acts on Origination Double-checks Verification

Security Planning: An Applied Approach | 11/4/2020 | 27 Compensating Controls When Segregation of Duties not possible, use: • Audit Trails • Transaction Logs: Record of all transactions in a batch • Reconciliation: Ensure transaction batches are not modified during processing • Exception reporting: Track rejected and/or exceptional (non-standard) transactions • Supervisory or Independent Reviews

Security Planning: An Applied Approach | 11/4/2020 | 28 Software to Detect Fraud: Data Monitoring and Analysis Provide reports for customer credits, adjustment accounts, inventory spoilage or loss, fixed-asset write-offs. Detect unusual anomalies such as unusual amounts or patterns Compare vendor addresses and phone numbers with employee data Use Range or Limit Validation to detect fraudulent transactions Logged computer activity, login or password attempts, data access attempts, and geographical location data access. ACFE report shows % fraud by industry

Security Planning: An Applied Approach | 11/4/2020 | 29 Red flags software can detect Out-of-sequence checks Large number of voids or refunds made by employee or customer Manually prepared checks from large company Payments sent to nonstandard (unofficial) address Unexplained changes in vendor activity Vendors with similar names or addresses Unapproved vendor or new vendor with high activity

Security Planning: An Applied Approach | 11/4/2020 | 30 Encourage Security in IT Departments Physical security Segregation of duties Employee monitoring Surprise audits Job rotation Examination of Documentation Quality Assurance Programmer Analyst Business Analyst

Security Planning: An Applied Approach | 11/4/2020 | 31 Business Application Checks locked up; access restricted Physical inventory of checks at least every quarter New accounts payable vendors’ existence and address doublechecked by management Returned checks sent to PO Box and evaluated by someone independent of Accts Payable

Security Planning: An Applied Approach | 11/4/2020 | 32 Question What is the MOST effective means of preventing fraud? 1. Effective internal controls 2. Fraud training program 3. Fraud hotline 4. Punishment when fraud is discovered

Security Planning: An Applied Approach | 11/4/2020 | 33 Question 1. 2. 3. 4. A woman in the accounting department set up a vendor file with her own initials, and was able to steal more than $4 M after 3 years. The auditor should have found that: The vendor was a phony company Purchases from the vendor did not result in inventory received The initials for the vendor matched an employee in the accounting dept. Management does not authorize new vendors with a separate web search and/or phone call.

Security Planning: An Applied Approach | 11/4/2020 | 34 Question What is: Origination, Authorization, Distribution, Verification? 1. Four stages of software release 2. Recommended authority allocations for access control 3. Stages for development of a Biometric Identity Management System (BIMS) 4. Categories for Segregation of Duties

External Fraud Social Engineering Check & Receipt Fraud A Fraud Investigation

Security Planning: An Applied Approach | 11/4/2020 | 36 Social Engineering Pretexting Phishing Used in 93% breaches Dialogue, obtain info, influence Gain foothold Email: 96% SE cases Financial motive 95% Malware >67% 4% people take phish E. g. CEO impersonation, Tax return fraud Financial 59% Spying 41%

Security Planning: An Applied Approach | 11/4/2020 | 37 Red Flags Rule Red Flag Category Suspicious Documents Personal Identifying Information Account Activity Example Red Flag Cases Warnings from a Credit Agency Other Sources Identification or application looks forged or altered. Info is inconsistent btwn ID, what client says, and their records. Picture or signature differs. Info matches other clients Info. looks suspicious: phone number is answering service; SSN is on Death Master File; info. inconsistent with credit report. Incomplete application and client fails to submit additional info Client cannot provide authenticating info beyond name address phone A major change in spending or payment habits. A change in address, followed by unusual requests: e. g. , multiple credit cards. Initial use of credit card shows unusual activity: first payment only; purchase of products easily converted to cash: electronics, jewelry. Inactive accounts become suddenly active. Mail is undeliverable but transactions continue. Changes to a credit report, inconsistent with client’s history. Indication of fraud, credit freeze or other abuse. Changes in recent credit transactions: increase in inquiries or new accounts. Tip indicates an account has been opened inappropriately or used fraudulently. Red Flags Rule

Security Planning: An Applied Approach | 11/4/2020 | 38 Social Engineering I Email: The first 500 people to register at our Web site will win free tickets to … Please provide company email address and choose a password You received a message from Facebook. Follow this link … log in. Social engineering: Getting people to do something they would not ordinarily do for a stranger Social engineering is nearly 100% effective

Security Planning: An Applied Approach | 11/4/2020 | 39 Social Engineering II Telephone call from ‘IT’: Some company computers have been infected with a virus that the anti-virus software cannot fix. Let me walk you through the fix… We need to test a new utility to change your password…

Security Planning: An Applied Approach | 11/4/2020 | 40 Social Engineering III Phone call 1: “I had a great experience at your store. Can you tell me manager’s name, address? ” Phone call 2: “This is John from X. I got a call from Alice at your site wanting me to fax a sig-card. She left a fax number but I can’t read it can you tell me? What is the code? “You should be telling me the code…” “That’s ok, it can wait. I am leaving but Alice won’t get her information…” “The code is … “ Phone call or fax 3: “I need … Code is …”

Security Planning: An Applied Approach | 11/4/2020 | 41 Social Engineering Techniques Learns insider vocabulary and/or personnel names Pretends legit insider: “I am <VP, IT, other branch, other dept>. Can you …? ” Pretends real transaction: Helping: I am in trouble <or> you need help due to … • <My, Your> computer is <virused, broke, busy, don’t have one>. Can you <do, tell me> …? Deception: Hides real question among others. Establishes relationship: Uses friendliness to gain trust for future tasks

Security Planning: An Applied Approach | 11/4/2020 | 42 Combating Social Engineering Verification Procedure Verify requester is who they claim to be Verify the requester is currently employed in the position claimed. Verify role is authorized for request Record transaction Organization security Data classification defines treatment Policies define guidelines for employee behavior Employees trained in roles, need-to-know, and policies

Security Planning: An Applied Approach | 11/4/2020 | 43 Example 4: Multi-call Social Engineering Example for Medical Scenario John is getting a divorce from Susan. He has a new love, Alice, who he would like to spend more time with. He has considered what to do with his two school-aged children, Jim and Ann. He figures that if Susan retains custody, he will owe a considerable amount in alimony. Frankly, he would like to keep the money. Plus, if he keeps them during the week, Susan care for them on weekends, leaving his weekend free for golf and quality time with Alice. However, Susan won’t give up the kids easily. Her first love is her children. He has always been too busy – golfing, business, … affairs - for kids. She will want to retain full custody, and she has been a great full-time Mom up until now. So how to fight this? He has heard from an old friend that she has cancer. If the cancer is serious and he can prove it in court, perhaps she can be judged to be inadequate. If she is on chemotherapy … who will take care of her and the kids? It would be best that he be given main custody (hopefully weekdays). He decides to ask Alice for help. First he needs to find out which doctor Susan is seeing. Then he needs to get her records. Finally he can talk to his lawyer about the best way of presenting this part of the case. Alice agrees to place the calls to potential doctors.

Security Planning: An Applied Approach | 11/4/2020 | 44 Call 1: Find Doctor Date: July 2. 3: 05 PM. Office: This is Dr Anderson’s office. How can I help you? Caller: This is Susan Armstrong. I will be going away to help my Mother soon. I think I have an appointment coming up, and I lost the appointment card. Can you check? The appointment would be for Susan Armstrong. Office: What is your address and home phone number? Caller: 262 -408 -4722. 1245 N Ridge Ave. Kenosha. Office: Yes, I see you have an appointment next Wednesday at 2: 30. Caller: Good! Well, I think I will leave to visit Mom right after that appointment. Thank you so much, it is now on my calendar. Also – did my PPO pay off my last visits, or do I owe anything extra? Office: Well we are still awaiting payment for your last appointment at the hospital on June 5 th, but the previous visits have all been paid. But they usually take about a month or two to pay. Caller: Thank you, I will see you next Wednesday at 2: 30!

Security Planning: An Applied Approach | 11/4/2020 | 45 Call 2: Obtain Medical Records Date: July 8 10: 42 AM. Office: This is Dr Anderson’s office. How can I help you? Caller: This is Susan Armstrong. I will be visiting another specialist for a problem with my leg and foot. She would like to see my prescriptions and my medical history. I would also like a copy for my own records. Can you fax me a copy of my records, and I will be sure to bring the records to the new doctor? Office: Well, you will have to come in to sign for a copy of your records. Also, doctors usually prefer to have the records sent directly to them. Caller: I think it is most important that I have the copy, and the doctor said it was ok if I brought my records in. Hmm. I don’t have a car available. Can my husband sign for them and pick them up? Office: No, it needs to be you. Caller: What if I request a copy in writing, and use our fax machine to send you my signature? Office: I think that would be acceptable. Our fax number is 262 -488 -2122. Should we fax the records to the fax number where we get the letter from?

Security Planning: An Applied Approach | 11/4/2020 | 46 Call 3: Report Success Caller: Yes, that would be extremely helpful. What do I need to include in the letter? Office: Please include your name, the information you need, the location where the information should be faxed to, and why you are asking for the information. Also include your printed name and signature. Caller: No problem! Thank you so much for your help. Office: Any time… Date July 8, 6: 45 PM Alice: John! We got her medical information! I hooked the laptop up to a phone line at my friend’s office, in the conference room, and sent the fax from there. It will be difficult to trace it back to us. John: And the records say… Alice: She does have breast cancer. John: Great! Thanks so much!

Security Planning: An Applied Approach | 11/4/2020 | 47 Fraud Scams Get a receipt from the trash, ‘return’ a product Copy gift certificate and cash in at multiple locations Markdown sale prices reimbursed with receipt – copied and collected at multiple locations Fake UPC numbers to pay low prices then return at higher price. If receipt total is sufficient, scam may work.

Security Planning: An Applied Approach | 11/4/2020 | 48 Preventing Scams Receipts must have security marks on them (e. g. , two-colored ink on special paper, or better: thermochromatic ink) Line-item detail on receipts and sales records in company database Garbage bins which may receive receipts should be protected from access (e. g. , bank garbage bins) Register gift certificates – unique numbers Shredders should be used for any sensitive information Protect against shoulder surfing or device attachment for card readers

Security Planning: An Applied Approach | 11/4/2020 | 49 Check Fraud Examples Altered Checks: Chemicals are used to erase the payee or amount, then reprinted OR check is appended to. • An Argentinian modified a ticket-overpayment refund check from Miami, changing a $2 check to $1. 45 Million Counterfeit Checks or Identity Assumption • Someone in your checkout line views your check, or does yard work for you • Fishes in a business’s in-mailbox or home’s out-mail for a check • Checks can be purchased on-line or mail order Telemarketing Fraud: • “You’ve won a prize” or “Would you like to open a VISA? ” “Now give me your account information. ” Hot Check: “Insufficient Funds” 90% of ‘insufficient funds’ checks are numbered between 101 and 200 Account opening year may be printed on check

Security Planning: An Applied Approach | 11/4/2020 | 50 Check Security Features Watermark: Subtle design viewable at 45 -degree angle toward light. Cannot be photo-copied Void Pantograph: Background pattern of checks. When photo-copied, the background patter disappears or prints ‘VOID’ Chemical Voids: When check is treated with eradicator chemical, the word VOID appears Microprinting: When magnified, the signature or check border appears to be written words. The resolution is too fine for a photo-copier 3 -Dim. Reflective Holostripe: Metallic stripe contains at least one hologram, similar to credit card. Security ink: React to eradication chemicals, distorting check Thermochromic Ink: Ink reacts to heat and moisture by fading and reappearing

Security Planning: An Applied Approach | 11/4/2020 | 51 Processing Money Orders Money order information provides info on a ready checking account Non-negotiable incoming wire account prevents out-going checks I would like to send you a money order. What is your account number? THANK YOU SO MUCH!!!

Security Planning: An Applied Approach | 11/4/2020 | 52 A Fraud Investigation Step 1: Initial Inquiry Investigate what is happening: • What is happening from a financial and/or operational aspect? • Do security controls exist and are they always practiced? • Does the employee show any of the red flags of fraud? Data mining analyzes financial transactions to find suspicious patterns or transactions • e. g. , match employee and accounts payable contact information. Initial Inquiry: Investigate processes, suspicious transactions Develop & Confirm Hypothesis: Determine methods & personnel involved Collect Evidence: Prepare for trial; Answer all questions

Security Planning: An Applied Approach | 11/4/2020 | 53 A Fraud Investigation (Cont’d) Step 2: Develop and confirm hypothesis Analyze the evidence. Hypothesize on possible methods of fraud and who is involved. The goal is to develop an accurate story of what happened. Develop: • timeline of what happened when, • pictures of evidence, • a diagram showing evidence relationships: which evidence is associated with which people and other evidence Step 3: Collect evidence for trial. Prove three requirements of fraud: evidence of organizational loss, personal gain, and deception. Establish answers to full set of questions: • Who decided to make the unethical or illicit changes? • Did affected personnel know the correct methods? • How far up the management chain did this knowledge go, and could auditors have been complicit?

Security Planning: An Applied Approach | 11/4/2020 | 54 Forensic Tools for Fraud Computer forensic tools can • uncovering secret files • decoding encrypted files • investigating external media and deleted and retained email • E. g. , find images of checks in computer or printer memory. Look at different versions of documents, transactions or emails: • Analyze emails from both sender and receiver side; is there a difference in emails purged? • Fraudsters change dates, amounts and/or names of transactions or checks; when are changes introduced? These tools may also be used during earlier stages of the investigation.

Security Planning: An Applied Approach | 11/4/2020 | 55 Summary Fraud on average takes 5% of all income but can bankrupt organizations. 3 Key Elements: Motivation, Opportunity, Rationalization Internal Fraud = Employee Fraud • Asset misappropriation, corruption, financial statement fraud • Controls: Preventive, Detective, Corrective • Key: Segregation of Duties External Fraud = Outsider Fraud Red Flags Rule applies to any organization that provides credit • Specifies suspicious transactions to be wary of Social engineering fraud: fraudster pretends to be an insider • Multiple calls build information Other frauds: Receipt scams, checks, money orders, etc.