Which schemes, scams and trends are financial fraud investigators seeing most often in 2018? We joined the International Association of Financial Crimes Investigators (IAFCI) Minnesota/Dakotas Chapter at their annual conference to learn more about the most compelling topics in fraud-fighting today.
The IAFCI Fall Conference is attended by multiple fraud investigators from the private sector, in addition to white-collar crime investigators from law enforcement. The conference focused on insights from industry leaders in financial services, including Ameriprise, Allianz, U.S. Bank and more. Key discussion topics included:
Fraud across multiple channels
Investigators revealed how fraudsters exploit different communications channels to perpetrate financial fraud, primarily account takeover (ATO). Fraudsters are using phone centers, along with stolen customer credentials, such as SSN and DOB. Attendees also reported online fraud using stolen or hacked login information, as well as forged paper documents used to open new accounts and change personal information within existing accounts.
Data breaches are powering fraud
Retail banks are seeing victims of high-profile data breaches become victims of financial fraud. Conference attendees advised banks to take a multi-layered approach to fraud detection and prevention, using a series of ID verification and ID proofing technologies – as well as an internal “blacklist” of known frauds across DDA and credit accounts – to ensure they stymie more ATO fraud schemes before they can hit customer accounts.
Manual schemes that use social engineering are growing
A financial institution attendee reported an uptick in fraud from phone centers, focused on callers phishing for information about customer credentials. This company is revamping its customer service training to detect people phishing for information. These callers frequently have bits and pieces of customer identity they use to perpetrate the fraud, often acquired through data breaches. The company is also exploring solutions that identify IP addresses with high rates of fraud or past fraud losses as a way to better identify callers at the other end of the line.
Mobile and peer-to-peer payment fraud is an emerging concern
Attendees discussed the rising tide of mobile wallet and peer-to-peer payment fraud schemes, using Zelle, Apple Pay, Venmo and other payment systems to gain access to customer profiles that are tied to DDA or credit accounts. Investigators stressed the need for real-time fraud tools that would help detect more mobile payment fraud by screening email addresses, IP addresses and other digital “fingerprints” that may not currently be tracked by financial institutions.
While fraudsters have become more organized and are implementing technology to automate their schemes, we are encouraged that the industry is fighting back with technologies to thwart these nefarious efforts. Today, many banks are using a several data sources (including industry consortium data) – compiled and delivered quickly – in addition to their own data sets to catch fraud before it results in losses. Banks also need to be ready not just for today’s schemes and scams, but for a now-unknown set of future fraud risks. Therefore, banks and credit unions require solutions that will give them the power to add capabilities, integrate new data sources, and configure business rules—all to help ensure that the bank’s assets and customers are well-defended from fraud attempts.
About the Author: ID Insight President Adam Elliott contributed this blog post.
I hear about new fraud schemes just about every week, but sometimes even I’m surprised by how easily criminals can find a new way in to consumers’ bank accounts. Usually, these schemes rely on a tried-and-true formula: impersonate the customer, change their contact information, request funds and cash out. But I just learned about a new wrinkle that takes account takeover fraud to a new level.
- A fraudster got a hold of a customer’s email address and online banking password
- Instead of changing the customer’s email, the fraudster used an email rerouting provider to hijack all of the customer’s email messages
- The fraudster then used email to request a $40,000 transfer using ACH
- Initially, the bank didn’t flag the request as suspicious, since it came from an email address that matched the customer information file
- When the bank realized the customer did not have enough money in his account to execute such a large transfer, a representative emailed the “customer” asking for clarification.
- The fraudster refused to agree to a phone authorization and the bank finally got suspicious and called the legitimate account-holder
- The customer was oblivious to the fraud attempt, though he had noticed that “something was up” with his email
Fortunately, this particular attempt was foiled by a very diligent banker.
We often see this sort of scam perpetrated with address changes (fraudulently changing an address by contacting the bank). But today – thanks to improved controls by financial institutions and USPS – fraudsters are taking a less traditional path: changing email or phone contacts and rerouting communications.
How can banks prevent this type of scam?
- Don’t wire funds based on a customer email
- Be suspicious of wire transfer requests made by phone (especially large dollar amounts)
- Take extra steps to get customer authentication before approving transfers
- For all transfer requests, make sure the customer has not recently changed their phone number, mailing address or email address
Vigilance is always a best practice in fraud prevention, but adaptability is just as important. You need to be ready not just for today’s scams, but for every future possibility. Fraudsters always choose the path of least resistance, so make sure every path to your customers’ accounts is well-defended (especially the digital ones).
Do you have a question for ID Insight President Adam Elliott? Let us know at firstname.lastname@example.org