Slide 1: Anatomy of a Fraud
Anatomy of a Fraud Business E-mail Compromise & Computer Intrusion
Slide 2: What is Business E-Mail Compromise?
What is Business E-Mail Compromise? Scam targeting businesses that regularly perform ACH and Wire Transfer payments. Small and Mid Sized businesses but all are susceptible. How is the fraud perpetuated? Employees receive an email request to transfer funds. Typically from a representative of upper ma
Slide 3: Business E-Mail Compromise (BEC) – Case Study 1
Business E-Mail Compromise (BEC) – Case Study 1 A commercial client switched their remittance processing in June 2018 from check to ACH. Their vendors were contacted in May to provide bank account information. A controller of a vendor provided their bank information via e-mail to the commercial clie
Slide 4: Case Study 1, continued
Case Study 1, continued Due to the vendor’s email being spoofed, any correspondence the commercial client and vendor were exchanging for 6 months were not actually being exchanged with the controller. The fraudster was intercepting all correspondence and money. FMB worked with the receiving bank in
Slide 5: Computer Intrusion – Case Study 2
Computer Intrusion – Case Study 2 Subject: Business client using online banking and ACH payroll feature Fraud vehicle: Online Banking compromise via client computer intrusion Loss Exposure: $90,437 FMB’s systems flagged a suspicious newly created ACH Payroll file for $58,684 Why: Large, even dollar
Slide 6: Case Study 2, continued
Case Study 2, continued FMB responded by: Deactivating OLB Restricting all account debits Attempted to restrict the outgoing ACH file until verified During the 4 minutes between fraud flag and getting things shut down another outgoing ACH file was created for $31,753 Client was contacted via prior p
Slide 7: Case Study 2, continued
Case Study 2, continued How did it happen? Client’s IT team investigated their systems and scrubbed their emails. Diagnosis: E-Mail Bomb Similar to a DDoS attack and can infect systems with malware/spyware. Ultimately, system/computer intrusion allowed access to OLB How to Prevent Computer Intrusion
Slide 8: First Merchants Fraud Prevention Efforts
First Merchants Fraud Prevention Efforts We continually work to provide an environment in which account information stays secure. We maintain high security standards on our systems and continually research additional controls for protection. We continuously monitor our security protocols to keep cus
Slide 9: Best Practices for Companies
Best Practices for Companies General Never provide personal or confidential information – always protect Do not respond to or click on links from e-mails; do not open attachments on suspicious e-mails Reconcile all accounts and statements quickly Tighten internal security controls, including employe
Slide 10: Best Practices for Companies, continued
Best Practices for Companies, continued Online Banking Always protect online banking login credentials Use a dedicated PC for conducting financial transactions Monitor all account activity daily via online banking Use dual authorization for online banking transactions Enforce the use of robust passw
Slide 11: Payment Fraud & Prevention Tools
Payment Fraud & Prevention Tools
Slide 12: Current Fraud Stats
Current Fraud Stats As of 2019*: 81% of companies were targets of payment fraud last year 75% of organizations experienced Business Email Compromise (BEC) 54% of organizations reported financial losses as a result of BEC 42% of BEC scams targeted wires, followed by ACH credits at 37% 74% of organiza
Slide 13: Payments Fraud – 2019*
Payments Fraud – 2019* *2020 AFP (Association for Financial Professionals) Survey Report 13
Slide 14: Sources of Payments Fraud in 2019*
Sources of Payments Fraud in 2019* *2020 AFP (Association for Financial Professionals) Survey Report 14
Slide 15: Payments Fraud – Methods 2019*
Payments Fraud – Methods 2019* *2020 AFP (Association for Financial Professionals) Survey Report 15
Slide 16: Fraud Remediation
Fraud Remediation Immediate actions once fraud is discovered Contact your local Banking Center, Treasury Solutions, or Treasury Management Officer Complete a Fraud report File a police report Compile a list of legitimate items (ACH & Checks) Amounts, Payee, Dates, Check number Monitor daily to ensur
Slide 17: ACH Positive Pay
ACH Positive Pay Allows businesses to decide who can debit their account via ACH. ACH debit transactions that are presented for payment from your account(s) are displayed through Business Online Banking as Exceptions Individuals responsible for handling ACH and Wire transfers and financial payments
Slide 18: Check Positive Pay
Check Positive Pay Helps protect business accounts from counterfeit, duplicate, and altered checks. Payee Positive Pay A check “Issue File” is submitted through Business Online Banking, which includes: issue date, payee, check number, and the dollar amount for each check. Presented items that do not
Slide 19: Card Fraud & Best Practices
Card Fraud & Best Practices
Slide 20: Card Fraud Defined
Card Fraud Defined Card fraud is a form of identify theft that involves an unauthorized use of another’s credit card information for the purpose of charging purchases to an account or removing funds from it. Types: Card-Present Retail Face-to-Face Card-Not-Present Mail Telephone Orders E-Commerce 20
Slide 21: Card Fraud Defined
Card Fraud Defined Industry Statistics Advances in Technology Small Business 21
Slide 22: Card Present (CP) Fraud
Card Present (CP) Fraud Retail Counterfeit, fake, doctored cards Lost or stolen cards Point of Sale Terminals 22
Slide 23: Card Not Present (CNP) Fraud
Card Not Present (CNP) Fraud Mail, Telephone Orders, E-Commerce Unable to Verify Cardholder Identity Theft Web-based Data Breaches Online Shopping and Mobile Payments 23
Slide 24: Merchant Loss & Liabilities
Merchant Loss & Liabilities Chargebacks and Refunds Fines and Penalties Higher costs of Compliance Termination of ability to accept card payments Diminished sales Negative publicity and press resulting in a damaged reputation Loss of customers Going out of business 24
Slide 25: Payment Card Industry Data Security Standards (PCI DSS)
Payment Card Industry Data Security Standards (PCI DSS) If you accept or process payment cards, the PCI Data Security Standards apply to you. 25
Slide 26: Best Practices to Mitigate Card Fraud
Best Practices to Mitigate Card Fraud Maintain awareness of latest fraud trends Use a verified payment processor Ensure equipment & software are current Security of sensitive cardholder data Network and PC firewalls Password-protected secured internet Strong Passwords Check for skimming devices Educ
Slide 27: Your First Merchants Team
Your First Merchants Team Contacts Adam Maze Treasury amaze@firstmerchants.com 317-566-7689 Indianapolis, Management Officer IN Aimee Gilliland Treasury agillilland@firstmerchants.com 614-583-2047 Columbus, Management Officer OH Angel Gibson Treasury agibson@firstmerchants.com 734-374-9302 Wyandotte
Slide 28: Your First Merchants Team
Your First Merchants Team Contacts Heather Gigliotti Treasury hgigliotti@firstmerchants.com 317-762-2223 Muncie, IN Management Officer Jon Schiesser Treasury jschiesser@firstmerchants.com 219-513-5109 Merrillville, IN Management Officer MaKayla Thurman Treasury mthurman@firstmerchants.com 317-566-76
Slide 29: Your First Merchants Team
Your First Merchants Team Contacts Dale Buffin Merchant Card Sales dbuffin@firstmerchants.com 765-751-1841 Muncie, IN Officer Dave Mongan Merchant Card Sales dmongan@firstmerchants.com 317-566-7676 Greenwood, Officer, Team Lead IN Gretchen Schilb Merchant Card Sales gschilb@firstmerchants.com 260-41