About the Author: ID Insight President Adam Elliott contributed this blog post.
I hear about new fraud schemes just about every week, but sometimes even I’m surprised by how easily criminals can find a new way in to consumers’ bank accounts. Usually, these schemes rely on a tried-and-true formula: impersonate the customer, change their contact information, request funds and cash out. But I just learned about a new wrinkle that takes account takeover fraud to a new level.
- A fraudster got a hold of a customer’s email address and online banking password
- Instead of changing the customer’s email, the fraudster used an email rerouting provider to hijack all of the customer’s email messages
- The fraudster then used email to request a $40,000 transfer using ACH
- Initially, the bank didn’t flag the request as suspicious, since it came from an email address that matched the customer information file
- When the bank realized the customer did not have enough money in his account to execute such a large transfer, a representative emailed the “customer” asking for clarification.
- The fraudster refused to agree to a phone authorization and the bank finally got suspicious and called the legitimate account-holder
- The customer was oblivious to the fraud attempt, though he had noticed that “something was up” with his email
Fortunately, this particular attempt was foiled by a very diligent banker.
We often see this sort of scam perpetrated with address changes (fraudulently changing an address by contacting the bank). But today – thanks to improved controls by financial institutions and USPS – fraudsters are taking a less traditional path: changing email or phone contacts and rerouting communications.
How can banks prevent this type of scam?
- Don’t wire funds based on a customer email
- Be suspicious of wire transfer requests made by phone (especially large dollar amounts)
- Take extra steps to get customer authentication before approving transfers
- For all transfer requests, make sure the customer has not recently changed their phone number, mailing address or email address
Vigilance is always a best practice in fraud prevention, but adaptability is just as important. You need to be ready not just for today’s scams, but for every future possibility. Fraudsters always choose the path of least resistance, so make sure every path to your customers’ accounts is well-defended (especially the digital ones).
Do you have a question for ID Insight President Adam Elliott? Let us know at firstname.lastname@example.org
What’s so cool about fraud prevention? A lot, apparently. While being cool is not one of our business priorities, it certainly is a badge of honor we wear proudly. And now, we’re thrilled that the folks at MinneInno agree that our work, our people and our office (not to mention a random pirate who posed with us at a St. Paul Saints game) are super cool.
What makes us the coolest? There’s the requisite “cool-office” amenities, like a brand-new rooftop deck, complete with seating and a grill for raucous office luncheons or happy hours. But coolness isn’t about the visible trappings for ID Insight: it’s a reflection of the way we approach every challenge with creativity, collaboration and (of course) cool.
The coolness starts with our recruiting process, which is designed to cast a wide net for talent and champion workplace persity, and runs throughout our entire company culture. With such a tightly-knit team, it’s essential for everyone to care deeply about the company’s work, customers and each-other. That’s why we foster mutual respect and collaboration every day by constantly seeking team feedback and engagement.
Recognition also makes us cool, especially when we’ve got our very own “MacGyver Award,” a coveted framed photo of Minnesota’s own Richard Dean Anderson a.k.a TV’s MacGyver, a trained scientist who worked as a secret agent to solve life and death situations. The award is given to a different employee every quarter who exhibits ingenuity and resourcefulness to solve a critical business problem. We may take our work seriously, but our team never takes itself too seriously.
Coolness comes in many forms, and while ID Insight has the standard accoutrements of cool on the surface, it also permeates every piece of our business. We’re cool because of what we do, not just because we’ve got bike parking in the office.
We’re looking forward to celebrating with other nominees on Sept. 13 and angling for a spot as a category winner. In the meantime, please cast your ballot for ID Insight in the MinneInno Coolest Companies reader’s choice poll. And don’t forget to stay cool!
Our President and CEO Adam Elliott was quoted in a recent MyBankTracker.com article about the EMV (“chip card”) rollout and its impact on fraud prevention.
While marginally more secure than magnetic-strip cards, the article warns that “the new cards…offer no special protection against online fraud.” Even though point-of-sale protections are increased, fraudsters can still use EMV card numbers and security information to make online transactions, the same way they do with any other credit card.
In the article, Adam says:
“Unfortunately, fraudsters are also well aware of the EMV roll-out, and are modifying their strategies to take advantage of the situation for financial gain,” Elliott said. “Mass reissues of tens of millions of cards are attractive targets for criminals and their sophisticated change-of-address and card-not-present schemes.”
Read more about ID Insight’s perspective on account takeover fraud.
Image credit: MyBankTracker.com