Auditing Wire Transfers and ACH Transactions

1 Auditing wire Transfersand ACH TransactionsTuesday, June 18, 201310:15AM 11:15 AMPresented by:JohnDavidMcLeod, CPA, CISA, CITPM anagerMcNair, McLemore,Middlebrooks& Co., LLC389 Mulberry St., Macon, GA 31202 Phone:(478) | 800-ASK-4 FMSP resented by:JohnDavidMcLeod, CPA, CISA, CITPM anagerMcNair, McLemore,Middlebrooks& Co., LLC389 Mulberry St., Macon, GA 31202 Phone:(478) s Agenda FFIEC guidance Recent statistics on account takeover How account takeover works & examples Recent court cases Internal | 800-ASK-4 FMS FFIEC guidance Recent statistics on account takeover How account takeover works & examples Recent court cases Internal controlsslide2 FFIEC Guidance Stated institutions should rely on layered security approaches.

2 Stated not all Transactions have the same risk. Specifically required institutions to implementsolutions to(at a minimum): Detect and respond to suspicious activity Have better control of administrative | 800-ASK-4 FMS Stated institutions should rely on layered security approaches. Stated not all Transactions have the same risk. Specifically required institutions to implementsolutions to(at a minimum): Detect and respond to suspicious activity Have better control of administrative functionsslide3 Recent Password Hacks Living Social-April 26, 2013-50 million customersincluding email addresses, passwords and DOB Yahoo-July 2012-400,000 accounts LinkedIn-June 2012-6 million accounts Zappos (online shoe store)

3 January 2012-24 millionaccounts exposed, including passwords Dropbox-July 2012-used stolen usernames & passwordsfrom other hacks to sign into | 800-ASK-4 FMS Living Social-April 26, 2013-50 million customersincluding email addresses, passwords and DOB Yahoo-July 2012-400,000 accounts LinkedIn-June 2012-6 million accounts Zappos (online shoe store) January 2012-24 millionaccounts exposed, including passwords Dropbox-July 2012-used stolen usernames & passwordsfrom other hacks to sign into accountsslide4 Recent Password Hacks When you consider approximately55%ofAmericans use the same login and passwordacross multiple | 800-ASK-4 FMS When you consider approximately55%ofAmericans use the same login and passwordacross multiple of Layered | 800-ASK-4 FMSOut-of-WalletQuestionsLogin /Passwordslide6 Corporate Account TakeoverCorporate account takeoveris a type ofbusiness identity theft in which a criminalentity steals a business s valid online results in a fraudulent |

4 800-ASK-4 FMSC orporate account takeoveris a type ofbusiness identity theft in which a criminalentity steals a business s valid online results in a fraudulent About Statistics? | 800-ASK-4 FMSslide8 Monetary Losses to Fraud55%22%7%8%8% | 800-ASK-4 FMS22%< $100K$100K-$500K$500K-$2 million> $2 MillionNot SureSource: 2012 Faces of Fraud Survey, ISMG slide9 Non-Monetary Losses Due to Fraud29%37%59%No LossReputationLoss of | 800-ASK-4 FMS14%26%29%Regulatory ScrutinyCustomer AccountsNo Loss0%10%20%30%40%50%60%70%Source: 2012 Faces of Fraud Survey, ISMG slide10 Origin of Breach Threats30%18%7%5%12%PercentMost threats from Chinaare not monetarily | 800-ASK-4 FMS28%18%ChinaRomaniaUnited StatesBulgariaRussiaOtherslide11 Attack Techniques32%54%72% | 800-ASK-4 FMS1%9%18%ErrorPhysicalMisuse0%10%20%30% 40%50%60%70%80%slide1270%40%50%60%70%80% % of ATO Where Funds Left the | 800-ASK-4 FMS32%12%9%0%10%20%30%40%200920102011201 2 Source.

5 2012 FS-ISAC Survey (1/2 of 2012)slide13 More Statistics65%26%9%82%91%14%9%4%40%50%60% 70%80%90%100% | 800-ASK-4 FMS65%No Monetary TransactionTransaction StoppedFunds Left Institution82%91%0%10%20%30%40%20122011 WiresACHO therSource: 2012 FS-ISAC Survey (1/2 of 2012)slide14 Reasons for Decrease? Customer Education Temporarily shutting down affected online customeraccess Manual review of ACH/ wire Transactions over a specificdollar amount Analysis of customer login patterns Interrogation of customer sessions to detect | 800-ASK-4 FMS Customer Education Temporarily shutting down affected online customeraccess Manual review of ACH/ wire Transactions over a specificdollar amount Analysis of customer login patterns Interrogation of customer sessions to detect anomaloustrafficslide15 How Does ATO Work?

6 Thieves mimic an institution s website Malware or viruses are installed oncustomers computers Social engineering attacks to gain | 800-ASK-4 FMS Thieves mimic an institution s website Malware or viruses are installed oncustomers computers Social engineering attacks to gain logincredentialsslide16 How Does ATO Work? Malicious document attached to an email Links within an email to an infected website Employees visiting legitimate websites anddownloading infected/malicious files Introduction of other devices (flash drives) | 800-ASK-4 FMS Malicious document attached to an email Links within an email to an infected website Employees visiting legitimate websites anddownloading infected/malicious files Introduction of other devices (flash drives)slide17 Who Are The Players?

7 Organized Criminals often overseas Commercial Customers usually a smallbusiness Financial Institutions Money | 800-ASK-4 FMS Organized Criminals often overseas Commercial Customers usually a smallbusiness Financial Institutions Money Mulesslide18 The they | 800-ASK-4 FMSslide19 What is a Money Mule? Someone who moves stolen funds from oneaccount to another. Recruited via email/phone/online Often out-of-work Scammer will say we found you or some other job search site Offer work from home jobs with no | 800-ASK-4 FMS Someone who moves stolen funds from oneaccount to another. Recruited via email/phone/online Often out-of-work Scammer will say we found you or some other job search site Offer work from home jobs with no priorexperienceslide20 What is a Money Mule?

8 Money mules receive the funds in their bankaccount. The money mule then forwards the funds toanother account, usually overseas. They keep a small portion of the funds aspayment. Most money mules only receive about $5K-$10 Kto transfer , so their fee is rather | 800-ASK-4 FMS Money mules receive the funds in their bankaccount. The money mule then forwards the funds toanother account, usually overseas. They keep a small portion of the funds aspayment. Most money mules only receive about $5K-$10 Kto transfer , so their fee is rather Does It WorkThiefrecruitsmoney muleThief hackscustomeraccountMoney | 800-ASK-4 FMST hief hackscustomeraccountThiefsubmitswire/ACH I nstitutionprocesseswire/ACHM oney muleredirectsfundsCustomerrealizesthefts lide22 Example #1-Details When-January 2013 Institution-$1 billion community bank Customer-small business How-thief hacked customer | 800-ASK-4 FMS When-January 2013 Institution-$1 billion community bank Customer-small business How-thief hacked customer emailslide231.

9 Thiefhackscompanyemail2. Bankemails thief5 acct # sw/balances4. Thiefrequests$7K wiretransfer5. Bankprocesses& sendswireExample # | 800-ASK-4 FMS1. Thiefhackscompanyemail2. Bankemails thief5 acct # sw/balances4. Thiefrequests$7K wiretransfer5. Bankprocesses& sendswireslide24 Example #1-Result Bank contacted customer after-the-fact andlearned request was fraudulent Contacted receiving institution and got a holdplaced on funds Bank ultimately recovered the $ | 800-ASK-4 FMS Bank contacted customer after-the-fact andlearned request was fraudulent Contacted receiving institution and got a holdplaced on funds Bank ultimately recovered the $ 3monthsslide25 Bank didn t follow its own procedure wire requests via email werenotallowed byinstitution policy Board more concerned with getting $7 Kback than with the #1 Lessons | 800-ASK-4

10 FMS Bank didn t follow its own procedure wire requests via email werenotallowed byinstitution policy Board more concerned with getting $7 Kback than with the # 2 Details When December 2012 Institution-$375 million community bank Customer municipality (pop. 15,000) How type of man-in-the-middle | 800-ASK-4 FMS When December 2012 Institution-$375 million community bank Customer municipality (pop. 15,000) How type of man-in-the-middle attackslide27 Example # 2 Details City controller logged into online bankingwebsite and received a denial page. Thief on the other end now has logincredentials. Submits two ACH Transactions ($250K).