Auditing Wire Transfers and ACH Transactions

1 Auditing wire Transfersand ACH TransactionsTuesday, June 18, 201310:15AM 11:15 AMPresented by:JohnDavidMcLeod, CPA, CISA, CITPM anagerMcNair, McLemore,Middlebrooks& Co., LLC389 Mulberry St., Macon, GA 31202 Phone:(478) | 800-ASK-4 FMSP resented by:JohnDavidMcLeod, CPA, CISA, CITPM anagerMcNair, McLemore,Middlebrooks& Co., LLC389 Mulberry St., Macon, GA 31202 Phone:(478) s Agenda FFIEC guidance Recent statistics on account takeover How account takeover works & examples Recent court cases Internal | 800-ASK-4 FMS FFIEC guidance Recent statistics on account takeover How account takeover works & examples Recent court cases Internal controlsslide2 FFIEC Guidance Stated institutions should rely on layered security approaches.

2 Stated not all Transactions have the same risk. Specifically required institutions to implementsolutions to(at a minimum): Detect and respond to suspicious activity Have better control of administrative | 800-ASK-4 FMS Stated institutions should rely on layered security approaches. Stated not all Transactions have the same risk. Specifically required institutions to implementsolutions to(at a minimum): Detect and respond to suspicious activity Have better control of administrative functionsslide3 Recent Password Hacks Living Social-April 26, 2013-50 million customersincluding email addresses, passwords and DOB Yahoo-July 2012-400,000 accounts LinkedIn-June 2012-6 million accounts Zappos (online shoe store)

3 January 2012-24 millionaccounts exposed, including passwords Dropbox-July 2012-used stolen usernames & passwordsfrom other hacks to sign into | 800-ASK-4 FMS Living Social-April 26, 2013-50 million customersincluding email addresses, passwords and DOB Yahoo-July 2012-400,000 accounts LinkedIn-June 2012-6 million accounts Zappos (online shoe store) January 2012-24 millionaccounts exposed, including passwords Dropbox-July 2012-used stolen usernames & passwordsfrom other hacks to sign into accountsslide4 Recent Password Hacks When you consider approximately55%ofAmericans use the same login and passwordacross multiple | 800-ASK-4 FMS When you consider approximately55%ofAmericans use the same login and passwordacross multiple of Layered | 800-ASK-4 FMSOut-of-WalletQuestionsLogin /Passwordslide6 Corporate Account TakeoverCorporate account takeoveris a type ofbusiness identity theft in which a criminalentity steals a

4 Business s valid online results in a fraudulent | 800-ASK-4 FMSC orporate account takeoveris a type ofbusiness identity theft in which a criminalentity steals a business s valid online results in a fraudulent About Statistics? | 800-ASK-4 FMSslide8 Monetary Losses to Fraud55%22%7%8%8% | 800-ASK-4 FMS22%< $100K$100K-$500K$500K-$2 million> $2 MillionNot SureSource: 2012 Faces of Fraud Survey, ISMG slide9 Non-Monetary Losses Due to Fraud29%37%59%No LossReputationLoss of | 800-ASK-4 FMS14%26%29%Regulatory ScrutinyCustomer AccountsNo Loss0%10%20%30%40%50%60%70%Source.

5 2012 Faces of Fraud Survey, ISMG slide10 Origin of Breach Threats30%18%7%5%12%PercentMost threats from Chinaare not monetarily | 800-ASK-4 FMS28%18%ChinaRomaniaUnited StatesBulgariaRussiaOtherslide11 Attack Techniques32%54%72% | 800-ASK-4 FMS1%9%18%ErrorPhysicalMisuse0%10%20%30% 40%50%60%70%80%slide1270%40%50%60%70%80% % of ATO Where Funds Left the | 800-ASK-4 FMS32%12%9%0%10%20%30%40%200920102011201 2 Source: 2012 FS-ISAC Survey (1/2 of 2012)slide13 More Statistics65%26%9%82%91%14%9%4%40%50%60% 70%80%90%100% | 800-ASK-4 FMS65%No Monetary TransactionTransaction StoppedFunds Left Institution82%91%0%10%20%30%40%20122011 WiresACHO therSource: 2012 FS-ISAC Survey (1/2 of 2012)slide14 Reasons for Decrease?

6 Customer Education Temporarily shutting down affected online customeraccess Manual review of ACH/ wire Transactions over a specificdollar amount Analysis of customer login patterns Interrogation of customer sessions to detect | 800-ASK-4 FMS Customer Education Temporarily shutting down affected online customeraccess Manual review of ACH/ wire Transactions over a specificdollar amount Analysis of customer login patterns Interrogation of customer sessions to detect anomaloustrafficslide15 How Does ATO Work? Thieves mimic an institution s website Malware or viruses are installed oncustomers computers Social engineering attacks to gain | 800-ASK-4 FMS Thieves mimic an institution s website Malware or viruses are installed oncustomers computers Social engineering attacks to gain logincredentialsslide16 How Does ATO Work?

7 Malicious document attached to an email Links within an email to an infected website Employees visiting legitimate websites anddownloading infected/malicious files Introduction of other devices (flash drives) | 800-ASK-4 FMS Malicious document attached to an email Links within an email to an infected website Employees visiting legitimate websites anddownloading infected/malicious files Introduction of other devices (flash drives)slide17 Who Are The Players? Organized Criminals often overseas Commercial Customers usually a smallbusiness Financial Institutions Money | 800-ASK-4 FMS Organized Criminals often overseas Commercial Customers usually a smallbusiness Financial Institutions Money Mulesslide18 The they | 800-ASK-4 FMSslide19 What is a Money Mule?

8 Someone who moves stolen funds from oneaccount to another. Recruited via email/phone/online Often out-of-work Scammer will say we found you or some other job search site Offer work from home jobs with no | 800-ASK-4 FMS Someone who moves stolen funds from oneaccount to another. Recruited via email/phone/online Often out-of-work Scammer will say we found you or some other job search site Offer work from home jobs with no priorexperienceslide20 What is a Money Mule? Money mules receive the funds in their bankaccount. The money mule then forwards the funds toanother account, usually overseas.

9 They keep a small portion of the funds aspayment. Most money mules only receive about $5K-$10 Kto transfer , so their fee is rather | 800-ASK-4 FMS Money mules receive the funds in their bankaccount. The money mule then forwards the funds toanother account, usually overseas. They keep a small portion of the funds aspayment. Most money mules only receive about $5K-$10 Kto transfer , so their fee is rather Does It WorkThiefrecruitsmoney muleThief hackscustomeraccountMoney | 800-ASK-4 FMST hief hackscustomeraccountThiefsubmitswire/ACH I nstitutionprocesseswire/ACHM oney muleredirectsfundsCustomerrealizesthefts lide22 Example #1-Details When-January 2013 Institution-$1 billion community bank Customer-small business How-thief hacked customer | 800-ASK-4 FMS When-January 2013 Institution-$1 billion community bank Customer-small business How-thief hacked customer emailslide231.

10 Thiefhackscompanyemail2. Bankemails thief5 acct # sw/balances4. Thiefrequests$7K wiretransfer5. Bankprocesses& sendswireExample # | 800-ASK-4 FMS1. Thiefhackscompanyemail2. Bankemails thief5 acct # sw/balances4. Thiefrequests$7K wiretransfer5. Bankprocesses& sendswireslide24 Example #1-Result Bank contacted customer after-the-fact andlearned request was fraudulent Contacted receiving institution and got a holdplaced on funds Bank ultimately recovered the $ | 800-ASK-4 FMS Bank contacted customer after-the-fact andlearned request was fraudulent Contacted receiving institution and got a holdplaced on funds Bank ultimately recovered the $ 3monthsslide25 Bank didn t follow its own procedure wire requests via email werenotallowed byinstitution policy Board more concerned with