Auditing Wire Transfers and ACH Transactions

1 Auditing wire Transfersand ACH TransactionsTuesday, June 18, 201310:15AM 11:15 AMPresented by:JohnDavidMcLeod, CPA, CISA, CITPM anagerMcNair, McLemore,Middlebrooks& Co., LLC389 Mulberry St., Macon, GA 31202 Phone:(478) | 800-ASK-4 FMSP resented by:JohnDavidMcLeod, CPA, CISA, CITPM anagerMcNair, McLemore,Middlebrooks& Co., LLC389 Mulberry St., Macon, GA 31202 Phone:(478) s Agenda FFIEC guidance Recent statistics on account takeover How account takeover works & examples Recent court cases Internal | 800-ASK-4 FMS FFIEC guidance Recent statistics on account takeover How account takeover works & examples Recent court cases Internal controlsslide2 FFIEC Guidance Stated institutions should rely on layered security approaches. Stated not all Transactions have the same risk. Specifically required institutions to implementsolutions to(at a minimum): Detect and respond to suspicious activity Have better control of administrative | 800-ASK-4 FMS Stated institutions should rely on layered security approaches.

2 Stated not all Transactions have the same risk. Specifically required institutions to implementsolutions to(at a minimum): Detect and respond to suspicious activity Have better control of administrative functionsslide3 Recent Password Hacks Living Social-April 26, 2013-50 million customersincluding email addresses, passwords and DOB Yahoo-July 2012-400,000 accounts LinkedIn-June 2012-6 million accounts Zappos (online shoe store) January 2012-24 millionaccounts exposed, including passwords Dropbox-July 2012-used stolen usernames & passwordsfrom other hacks to sign into | 800-ASK-4 FMS Living Social-April 26, 2013-50 million customersincluding email addresses, passwords and DOB Yahoo-July 2012-400,000 accounts LinkedIn-June 2012-6 million accounts Zappos (online shoe store) January 2012-24 millionaccounts exposed, including passwords Dropbox-July 2012-used stolen usernames & passwordsfrom other hacks to sign into accountsslide4 Recent Password Hacks When you consider approximately55%ofAmericans use the same login and passwordacross multiple | 800-ASK-4 FMS When you consider approximately55%ofAmericans use the same login and passwordacross multiple of Layered | 800-ASK-4 FMSOut-of-WalletQuestionsLogin /Passwordslide6 Corporate Account TakeoverCorporate account takeoveris a type ofbusiness identity theft in which a criminalentity steals a business s valid online results in a fraudulent | 800-ASK-4 FMSC orporate account takeoveris a type ofbusiness identity theft in which a criminalentity steals a business s valid online results in a fraudulent About Statistics?

3 | 800-ASK-4 FMSslide8 Monetary Losses to Fraud55%22%7%8%8% | 800-ASK-4 FMS22%< $100K$100K-$500K$500K-$2 million> $2 MillionNot SureSource: 2012 Faces of Fraud Survey, ISMG slide9 Non-Monetary Losses Due to Fraud29%37%59%No LossReputationLoss of | 800-ASK-4 FMS14%26%29%Regulatory ScrutinyCustomer AccountsNo Loss0%10%20%30%40%50%60%70%Source: 2012 Faces of Fraud Survey, ISMG slide10 Origin of Breach Threats30%18%7%5%12%PercentMost threats from Chinaare not monetarily | 800-ASK-4 FMS28%18%ChinaRomaniaUnited StatesBulgariaRussiaOtherslide11 Attack Techniques32%54%72% | 800-ASK-4 FMS1%9%18%ErrorPhysicalMisuse0%10%20%30% 40%50%60%70%80%slide1270%40%50%60%70%80% % of ATO Where Funds Left the | 800-ASK-4 FMS32%12%9%0%10%20%30%40%200920102011201 2 Source: 2012 FS-ISAC Survey (1/2 of 2012)slide13 More Statistics65%26%9%82%91%14%9%4%40%50%60% 70%80%90%100% | 800-ASK-4 FMS65%No Monetary TransactionTransaction StoppedFunds Left Institution82%91%0%10%20%30%40%20122011 WiresACHO therSource: 2012 FS-ISAC Survey (1/2 of 2012)slide14 Reasons for Decrease?

4 Customer Education Temporarily shutting down affected online customeraccess Manual review of ACH/ wire Transactions over a specificdollar amount Analysis of customer login patterns Interrogation of customer sessions to detect | 800-ASK-4 FMS Customer Education Temporarily shutting down affected online customeraccess Manual review of ACH/ wire Transactions over a specificdollar amount Analysis of customer login patterns Interrogation of customer sessions to detect anomaloustrafficslide15 How Does ATO Work? Thieves mimic an institution s website Malware or viruses are installed oncustomers computers Social engineering attacks to gain | 800-ASK-4 FMS Thieves mimic an institution s website Malware or viruses are installed oncustomers computers Social engineering attacks to gain logincredentialsslide16 How Does ATO Work? Malicious document attached to an email Links within an email to an infected website Employees visiting legitimate websites anddownloading infected/malicious files Introduction of other devices (flash drives) | 800-ASK-4 FMS Malicious document attached to an email Links within an email to an infected website Employees visiting legitimate websites anddownloading infected/malicious files Introduction of other devices (flash drives)slide17 Who Are The Players?

5 Organized Criminals often overseas Commercial Customers usually a smallbusiness Financial Institutions Money | 800-ASK-4 FMS Organized Criminals often overseas Commercial Customers usually a smallbusiness Financial Institutions Money Mulesslide18 The they | 800-ASK-4 FMSslide19 What is a Money Mule? Someone who moves stolen funds from oneaccount to another. Recruited via email/phone/online Often out-of-work Scammer will say we found you or some other job search site Offer work from home jobs with no | 800-ASK-4 FMS Someone who moves stolen funds from oneaccount to another. Recruited via email/phone/online Often out-of-work Scammer will say we found you or some other job search site Offer work from home jobs with no priorexperienceslide20 What is a Money Mule? Money mules receive the funds in their bankaccount. The money mule then forwards the funds toanother account, usually overseas.

6 They keep a small portion of the funds aspayment. Most money mules only receive about $5K-$10 Kto transfer , so their fee is rather | 800-ASK-4 FMS Money mules receive the funds in their bankaccount. The money mule then forwards the funds toanother account, usually overseas. They keep a small portion of the funds aspayment. Most money mules only receive about $5K-$10 Kto transfer , so their fee is rather Does It WorkThiefrecruitsmoney muleThief hackscustomeraccountMoney | 800-ASK-4 FMST hief hackscustomeraccountThiefsubmitswire/ACH I nstitutionprocesseswire/ACHM oney muleredirectsfundsCustomerrealizesthefts lide22 Example #1-Details When-January 2013 Institution-$1 billion community bank Customer-small business How-thief hacked customer | 800-ASK-4 FMS When-January 2013 Institution-$1 billion community bank Customer-small business How-thief hacked customer emailslide231. Thiefhackscompanyemail2.

7 Bankemails thief5 acct # sw/balances4. Thiefrequests$7K wiretransfer5. Bankprocesses& sendswireExample # | 800-ASK-4 FMS1. Thiefhackscompanyemail2. Bankemails thief5 acct # sw/balances4. Thiefrequests$7K wiretransfer5. Bankprocesses& sendswireslide24 Example #1-Result Bank contacted customer after-the-fact andlearned request was fraudulent Contacted receiving institution and got a holdplaced on funds Bank ultimately recovered the $ | 800-ASK-4 FMS Bank contacted customer after-the-fact andlearned request was fraudulent Contacted receiving institution and got a holdplaced on funds Bank ultimately recovered the $ 3monthsslide25 Bank didn t follow its own procedure wire requests via email werenotallowed byinstitution policy Board more concerned with getting $7 Kback than with the #1 Lessons | 800-ASK-4 FMS Bank didn t follow its own procedure wire requests via email werenotallowed byinstitution policy Board more concerned with getting $7 Kback than with the # 2 Details When December 2012 Institution-$375 million community bank Customer municipality (pop.)

8 15,000) How type of man-in-the-middle | 800-ASK-4 FMS When December 2012 Institution-$375 million community bank Customer municipality (pop. 15,000) How type of man-in-the-middle attackslide27 Example # 2 Details City controller logged into online bankingwebsite and received a denial page. Thief on the other end now has logincredentials. Submits two ACH Transactions ($250K). Other city employee logs into online bankingand approves both ACHs. Afterapproving, went to talk with City | 800-ASK-4 FMS City controller logged into online bankingwebsite and received a denial page. Thief on the other end now has logincredentials. Submits two ACH Transactions ($250K). Other city employee logs into online bankingand approves both ACHs. Afterapproving, went to talk with City # 2 Details City contacted the bank who did not processthe ACH-no loss. ISO for the bank visits city offices todetermine what happened.

9 No firewall or anti-virus in | 800-ASK-4 FMS City contacted the bank who did not processthe ACH-no loss. ISO for the bank visits city offices todetermine what happened. No firewall or anti-virus in useslide29 Bank needed to improve customer educationinitiatives Implemented call-back procedures on alltransactions for this customer account. 3 months later, still no firewall / anti-virus City was in negotiations with a vendorExample # 2 Lessons | 800-ASK-4 FMS Bank needed to improve customer educationinitiatives Implemented call-back procedures on alltransactions for this customer account. 3 months later, still no firewall / anti-virus City was in negotiations with a vendorslide30 Example # 3 Details When-January 2012 Institution-$135 million community bank Customer-small business How-fraudulent fax | 800-ASK-4 FMS When-January 2012 Institution-$135 million community bank Customer-small business How-fraudulent fax requestslide31 Example # 3 Details Customer receives fax request from Equifax It really wasn t Equifax Request was for updated credit referenceinformation, including bank references Customer supplied all data, including accountnumbers & faxed it a | 800-ASK-4 FMS Customer receives fax request from Equifax It really wasn t Equifax Request was for updated credit referenceinformation, including bank references Customer supplied all data.

10 Including accountnumbers & faxed it a signatureslide32 Example # 3 Details Bank receives wire request from customer for awire to Russiafor $27,000. Bank checked signature on fax to signaturecard and processed the wire . No call-backprocedures were performed. Customer hadneverwired to Russia | 800-ASK-4 FMS Bank receives wire request from customer for awire to Russiafor $27,000. Bank checked signature on fax to signaturecard and processed the wire . No call-backprocedures were performed. Customer hadneverwired to Russia # 3 Lessons Learned Good customer-bank took the $27,000 loss Small town-bank worried about reputation Going forward bank began performing anddocumenting call-backs on any wireoriginated other than in-person | 800-ASK-4 FMS Good customer-bank took the $27,000 loss Small town-bank worried about reputation Going forward bank began performing anddocumenting call-backs on any wireoriginated other than in-person slide34 Example # 4 Details(Same bank as in Example #3) When-June 2012 (6 months later) Institution-$135 million community bank Customer-small business How-fraudulent ACH | 800-ASK-4 FMS(Same bank as in Example #3) When-June 2012 (6 months later) Institution-$135 million community bank Customer-small business How-fraudulent ACH submissionslide35 Example # 4 Details Customer controller gets email from Service telling of an undeliveredpackage.