Fraud PresentationFraud PresentationNorwayNorway

Anne GreenAnne Green

Fraud ConsultantFraud Consultant

0044 (0) 7813 8558720044 (0) 7813 855872

anne.green@uk.experian.comanne.green@uk.experian.com

BackgroundBackground

• BA (hons) Law/Social Science combined studiesBA (hons) Law/Social Science combined studies

• Member Institute of Credit Management (MICM)Member Institute of Credit Management (MICM)

• Member International Association for Financial Member International Association for Financial Crimes Investigators(IAFCI)Crimes Investigators(IAFCI)

• Five years as a Private InvestigatorFive years as a Private Investigator

• Six Years in Credit Management/ Civil LitigationSix Years in Credit Management/ Civil Litigation

• Thirteen Years HSBC BankThirteen Years HSBC Bank

• Last two years on attachment to the Dedicated Last two years on attachment to the Dedicated Cheque and Plastic Crime Unit (DCPCU)Cheque and Plastic Crime Unit (DCPCU)

Fraud In an International Fraud In an International PerspectivePerspective

The UN estimates that between $590 billion and $1.5 trillion per year is laundered globally by arms and human traffickers, drug dealers and other criminals

Identity theft annual losses are estimated at $5-8 billion; some estimates as high as $19.8 billion (US alone) Financial Insights, Celent, Javelin

Global fraud losses are expected to reach $15.5 billion dollars by the end of 2005 Meridien

30% of consumers would close all accounts and move their business to another financial institution if their personal information was compromised EDS

Fraud in an International Fraud in an International PerspectivePerspective

CIFASCIFAS

Meridien

$67.2 billion: FBI estimates of what US businesses lose annually because of computer related crime Source USA Today

On-line banking fraud up 90% 2004 –2005) APACS

An incidence of card fraud takes place on average every 9 seconds in the UK APACS

• Insurance fraud in the UK costs an estimated £2 billion per year

Fraud AwarenessFraud Awareness

• Fraud is happeningFraud is happening

• Many companies think this its not hitting themMany companies think this its not hitting them

• Think they have adequate controlsThink they have adequate controls

• They don’tThey don’t

• It is costing themIt is costing them

• They don’t know how muchThey don’t know how much

Organised Financial CrimeOrganised Financial Crime

• Financial services based on trustFinancial services based on trust

• People, families knownPeople, families known

• Local KnowledgeLocal Knowledge

• No longer Opportunist white collar crimeNo longer Opportunist white collar crime

• Removal of bordersRemoval of borders

• EU MembershipEU Membership

• Economic MigrantsEconomic Migrants

Organised Financial CrimeOrganised Financial Crime

• Importation of foreign criminals for fraudImportation of foreign criminals for fraud

• Cross-border nature of this crimeCross-border nature of this crime

• Networks of corrupted staffNetworks of corrupted staff

• Cellular workingCellular working

• Technical sophisticationTechnical sophistication

• Criminal gangs working internationallyCriminal gangs working internationally

• Global patterns, the scams travelGlobal patterns, the scams travel

Fraudsters ProfileFraudsters Profile

• Who predicts fraud?Who predicts fraud?

• The fraudsters, what are they doing?The fraudsters, what are they doing?

So it’s growingSo it’s growing

Fraud against financial institutions is increasingFraud against financial institutions is increasing FrequencyFrequency Average value of fraudAverage value of fraud

Not just BanksNot just Banks Criminals target public & private sectors indiscriminatelyCriminals target public & private sectors indiscriminately Look for weak linksLook for weak links Find weaknesses in the system & the peopleFind weaknesses in the system & the people

Most fraudsters are not opportunists – they are linked Most fraudsters are not opportunists – they are linked toto

serious and organised criminal groupsserious and organised criminal groups

Finding the links can be difficultFinding the links can be difficult

Real size of the problemReal size of the problem

• Real size of the problem unknownReal size of the problem unknown

•Many go undetectedMany go undetected

•Many institutions `bury’ fraud in their bad debt numbersMany institutions `bury’ fraud in their bad debt numbers Because they don’t knowBecause they don’t know Or because they can’t be certainOr because they can’t be certain Collections staff are generally not fraud expertsCollections staff are generally not fraud experts

• All we know for sure is:All we know for sure is:

It’s bigger than we think!It’s bigger than we think!

In simple termsIn simple terms

• Theft Theft

• DeceptionDeception

• Dishonestly obtaining and retaining creditDishonestly obtaining and retaining credit

Fraud Methods TraditionalFraud Methods Traditional

• Application FraudApplication Fraud

• Account TakeoverAccount Takeover

• 33rdrd Party Fraud Party Fraud

• Clearing Cycle FraudClearing Cycle Fraud

• 419’s419’s

• TelemarketingTelemarketing

• Insurance ClaimsInsurance Claims

• Money LaunderingMoney Laundering

Current TrendsCurrent Trends

• Identity TheftIdentity Theft

• Account takeoverAccount takeover

• CybercrimeCybercrime

• PhishingPhishing

• HackingHacking

• 11stst Party Fraud Party Fraud

• Data compromiseData compromise

• Internal/staff FraudInternal/staff Fraud

• Bust out/credit manipulationBust out/credit manipulation

CybercrimeCybercrime

• Criminal economy that’s robs US businesses of $67.2b Criminal economy that’s robs US businesses of $67.2b

• FBI & US Secret Service work on disruptionsFBI & US Secret Service work on disruptions

• Typical cost of goods and services in Forums:-Typical cost of goods and services in Forums:-- $1,000 to $5,000 Trojan program that can transfer funds between online - $1,000 to $5,000 Trojan program that can transfer funds between online

accountsaccounts

- $500 credit card number with pin- $500 credit card number with pin

- $80 to $300 change of billing data, to include account number, address, social - $80 to $300 change of billing data, to include account number, address, social security number, DOBsecurity number, DOB

- $150 driver licence- $150 driver licence

- $150 Birth certificate- $150 Birth certificate

- $100 social security card - $100 social security card

- $7 to $25 credit card with security code and expiry date- $7 to $25 credit card with security code and expiry date

- $7 paypal account logon and password- $7 paypal account logon and password

» USA Today

Application Fraud Application Fraud

• Application fraud involves criminal using stolen or false Application fraud involves criminal using stolen or false documents to open credit accountsdocuments to open credit accounts

• Criminals may obtain details from public sources Criminals may obtain details from public sources Telephone directoryTelephone directory NewspapersNewspapers InternetInternet Electoral registerElectoral register

• Criminals will pay for dataCriminals will pay for data Internal staff fraud an increasing threatInternal staff fraud an increasing threat Corrupt staffCorrupt staff Example, bank clerk using false documents to open 60 Example, bank clerk using false documents to open 60

accountsaccounts

Application FraudApplication Fraud

• Prosecutions for individuals making fraudulent applications Prosecutions for individuals making fraudulent applications for credit are rarefor credit are rare

• Credit reference agencies place great trust in Voters RollCredit reference agencies place great trust in Voters Roll

• Council departments do not verify identityCouncil departments do not verify identity

• Can change your name at any timeCan change your name at any time Form completed, taken to Solicitor £5 fixed fee, sworn on Form completed, taken to Solicitor £5 fixed fee, sworn on

oath oath No identity checks undertakenNo identity checks undertaken Form can be used to have passport amendedForm can be used to have passport amended

Application FraudApplication FraudAlternately they may try to steal documents such as utility bills Alternately they may try to steal documents such as utility bills and bank statements to build a personal profileand bank statements to build a personal profile

They may use counterfeited documents for identification They may use counterfeited documents for identification purposespurposes

•Driving licencesDriving licences•PassportsPassports•ID CardsID Cards

All readily available over the internet cheaply All readily available over the internet cheaply •A convincing driving licence in any name for $33A convincing driving licence in any name for $33

Total loss through application fraud over $24million in 2004 in Total loss through application fraud over $24million in 2004 in the UK alonethe UK alone

Spoof web SiteSpoof web Site

Web sites set up to obtain detailsWeb sites set up to obtain details Know CasesKnow Cases Credit RecordsCredit Records Cheap Car InsuranceCheap Car Insurance Internet Service Transaction SupplierInternet Service Transaction Supplier

Be wary of sites selling goods/services at unbelievable prices, Be wary of sites selling goods/services at unbelievable prices, the old adage `if it seems too good to be true it probably isthe old adage `if it seems too good to be true it probably is

Identity Theft/ImpersonationIdentity Theft/Impersonation

• Identity theft fastest growing financial crimeIdentity theft fastest growing financial crime

• Home Office figures state costing UK Home Office figures state costing UK economy £1.7bneconomy £1.7bn

An attractive crimeAn attractive crime

• Relatively low riskRelatively low risk

• Offers high returnsOffers high returns

• Easily attemptedEasily attempted

• Frequently regarded as victimless crimeFrequently regarded as victimless crime

• Many organisations have weak defencesMany organisations have weak defences

IdentificationIdentification

A variety of documents are used as evidence A variety of documents are used as evidence of identity and will vary between countries. of identity and will vary between countries. No harmonisation amongst EU CountriesNo harmonisation amongst EU Countries

UKUK

Driving LicenceDriving Licence

PassportPassport

Birth certificateBirth certificate

National insurance NumberNational insurance Number

NHS CardNHS Card

USAUSA

Social Security Number (SSN’s) used universally for credit applications Social Security Number (SSN’s) used universally for credit applications

Photo driving LicencePhoto driving Licence

IdentificationIdentification

NetherlandsNetherlands

• No unique Identifier – antipathy towards ID historical No unique Identifier – antipathy towards ID historical resonance from world war 11resonance from world war 11

• Uses Verification of Identity System (VIS) lost/stolen Uses Verification of Identity System (VIS) lost/stolen documents Dutch Policedocuments Dutch Police

• Six Million records including deceased file, also includes Six Million records including deceased file, also includes other country documents Passportother country documents Passport

Database can be accessed by public & Private Database can be accessed by public & Private sectorssectors

3million checks to data base made each year3million checks to data base made each year Specific offence for identity, e.g.. Forging a driving Specific offence for identity, e.g.. Forging a driving

licence 5 yearslicence 5 years Strict controls for changing names ‘reason’Strict controls for changing names ‘reason’ Can change forename by disposition in front of a Can change forename by disposition in front of a

JudgeJudge

IdentificationIdentification

BelgiumBelgium

Compulsory Identity CardsCompulsory Identity Cards

10 million Belgium's must notify their address to 10 million Belgium's must notify their address to policepolice

Check made to home address to confirmCheck made to home address to confirm

SIS card for social security purposesSIS card for social security purposes

FranceFrance

60 Million Citizens hold Identity cards, but not 60 Million Citizens hold Identity cards, but not compulsorycompulsory

IdentificationIdentification

• Passport presented for formal proof of IDPassport presented for formal proof of ID

• ID valid for 10 years but numbering not continuousID valid for 10 years but numbering not continuous

• Legal constraints on Public/private sharing of dataLegal constraints on Public/private sharing of data

SPAINSPAIN

• Compulsory ID Card Issued by local police at age 14Compulsory ID Card Issued by local police at age 14

• 46 million cards valid for ten years46 million cards valid for ten years

• Must be carried at all timesMust be carried at all times

• Contains, name, address, photo, nationality, Contains, name, address, photo, nationality, signature,place, DOB, parents namesignature,place, DOB, parents name

• Also used as a travel documentAlso used as a travel document

IdentificationIdentification

GermanyGermany

• 82 million Citizens obliged to carry Photo ID82 million Citizens obliged to carry Photo ID

• Passport for claiming benefitsPassport for claiming benefits

• Passport for driving licence or offencesPassport for driving licence or offences

• Home addresses registered with local civic Home addresses registered with local civic authoritiesauthorities

Processes used in the issuing and checking of Processes used in the issuing and checking of documents used as evidence of identity are documents used as evidence of identity are not securenot secure

IdentificationIdentification

• DenmarkDenmark

• All 5 Million Citizens have a unique ID numberAll 5 Million Citizens have a unique ID number

-linked to centralised civil registration System-linked to centralised civil registration System

-holds data on name, address, place of birth, kinship, -holds data on name, address, place of birth, kinship, marital status, spouse detailsmarital status, spouse details

• System introduced in 1968System introduced in 1968

• Id number used almost entire public administration, Id number used almost entire public administration, including tax, banks and insurersincluding tax, banks and insurers

• Citizens legally advised to inform government when Citizens legally advised to inform government when they move housethey move house

• Between 1968 and 1995 individuals were issued with Between 1968 and 1995 individuals were issued with a card bearing their name, ID number, dob, but no a card bearing their name, ID number, dob, but no photo on cardphoto on card

• Stopped as ineffective and expensiveStopped as ineffective and expensive

Identification The ProblemIdentification The Problem

• Identification Legacy systemsIdentification Legacy systems

• Pre computersPre computers

• No world experts on document validationNo world experts on document validation

• Fake/genuine documents easily boughtFake/genuine documents easily bought

• Demographic changesDemographic changes

Account OpeningAccount Opening

• New accounts, essential New accounts, essential

- Authentication of people- Authentication of people

- Validation of documents- Validation of documents

- Verification of data- Verification of data

- Cross matching for data irregularities- Cross matching for data irregularities

Fraudsters know to make multiple requests on Fraudsters know to make multiple requests on assumption one will passassumption one will pass

Willing to sit on accounts for years before Willing to sit on accounts for years before attack attack

Data ProtectionData Protection

• Data protection Act set up to protect privacy Data protection Act set up to protect privacy of individualsof individuals

• Fraudsters exploiting the DPA to their Fraudsters exploiting the DPA to their advantageadvantage

• Organisations unwilling or unable to share Organisations unwilling or unable to share fraud outcome datafraud outcome data

• Cross border/Cross EU communities Cross border/Cross EU communities interpretation or understanding of DPA interpretation or understanding of DPA

Organised CriminalOrganised Criminal

• Will cross organisationsWill cross organisations

• Different sectorsDifferent sectors

• CountriesCountries

• Understand fraud detection systems, hot listsUnderstand fraud detection systems, hot lists

• Company policies and proceduresCompany policies and procedures

Internal Staff FraudInternal Staff Fraud

Weakness within any organisationWeakness within any organisation

THE PEOPLETHE PEOPLE

Internal Staff FraudInternal Staff Fraud

• As measures are put in place to combat fraud like Chip N PinAs measures are put in place to combat fraud like Chip N Pin

• Fraudsters moving with the times to exploit weaknesses and Fraudsters moving with the times to exploit weaknesses and look for new opportunities, they need help from within!look for new opportunities, they need help from within!

Account takeoverAccount takeover Data compromiseData compromise Genuine Plastics/Bank accountsGenuine Plastics/Bank accounts ID Fraud / ImprovisationID Fraud / Improvisation CNP FraudCNP Fraud Bust out/credit manipulation Bust out/credit manipulation

• New technology utilised to transfer dataNew technology utilised to transfer data Mobile phonesMobile phones Key catcherKey catcher Portable data storage devices (e.g: Pen)Portable data storage devices (e.g: Pen)

MethodologiesMethodologies

• Staff recruited whilst at night-clubs, bars,cafes close to Staff recruited whilst at night-clubs, bars,cafes close to financial institutions premisesfinancial institutions premises

• Generally young and impressionableGenerally young and impressionable

• Easy target / weaknessesEasy target / weaknesses

• Low paid jobs – call centre, data inputtingLow paid jobs – call centre, data inputting

• Unmotivated, lack of loyalty, bravadoUnmotivated, lack of loyalty, bravado

• Motive for employees to supplement incomeMotive for employees to supplement income

Case StudiesCase Studies

Operation HorizonOperation Horizon

• High performance sales staff at a high street bankHigh performance sales staff at a high street bank

• Opened 1,200 accounts over nine months periodOpened 1,200 accounts over nine months period

• Losses c.£3mLosses c.£3m

• Had accepted false ID’s and documentsHad accepted false ID’s and documents

• Used same on all accountsUsed same on all accounts

• Audits on accounts would have highlighted same Audits on accounts would have highlighted same details useddetails used

Operation EcruOperation Ecru• Eight bank staff members identifiedEight bank staff members identified

• Unknown/unconnected to each otherUnknown/unconnected to each other

• Recruited in the street and offered £1,000 a Recruited in the street and offered £1,000 a time for account informationtime for account information

• Targeting “high status” accountsTargeting “high status” accounts

• Changed address then opened up card Changed address then opened up card facilitiesfacilities

• Fraudulent CHAPS payments to transfer Fraudulent CHAPS payments to transfer money from premier account to card accountmoney from premier account to card account

• Attack on bank bears hallmarks of organised Attack on bank bears hallmarks of organised level two criminal group with access to bank level two criminal group with access to bank procedures, personal information and procedures, personal information and stolen/counterfeit documentsstolen/counterfeit documents

Operation EcruOperation Ecru

• CHAPS (Clocks) password changed dailyCHAPS (Clocks) password changed daily

• Used stolen bank CHAPS forms. Faxed over to CHAPS, Used stolen bank CHAPS forms. Faxed over to CHAPS, altered to reflect a recognisable fax numberaltered to reflect a recognisable fax number

• Post-arrest, `how to defraud the banks’ book recovered on Post-arrest, `how to defraud the banks’ book recovered on suspectsuspect

• One staff member had Rolex watch and drove top range One staff member had Rolex watch and drove top range Mercedes. Previously sacked from another bankMercedes. Previously sacked from another bank

• Also found Dun Bradstreet.com company searches showing Also found Dun Bradstreet.com company searches showing directors home address and bank detailsdirectors home address and bank details

Operation RheaOperation Rhea

• Referral from high street bankReferral from high street bank

• Premier accounts compromised and fraudulent transfers Premier accounts compromised and fraudulent transfers made to student accountsmade to student accounts

• Students recruited to accept bill payments into their Students recruited to accept bill payments into their accountsaccounts

• On receipt of funds, taken shopping to obtain goods/cashOn receipt of funds, taken shopping to obtain goods/cash

• Common link on premier a/accounts (point of compromise) Common link on premier a/accounts (point of compromise) identified by bank as a major insurance companyidentified by bank as a major insurance company

Operation RheaOperation Rhea

• Insurance company holding bank details to send insurance Insurance company holding bank details to send insurance creditscredits

• Originally problems in insurance company’s audit trails – no Originally problems in insurance company’s audit trails – no system in place to see who had viewed accountssystem in place to see who had viewed accounts

• Fix put into place and staff member arrestedFix put into place and staff member arrested

• Evidence that data from most of the high streets banks had Evidence that data from most of the high streets banks had been compromisedbeen compromised

• Student turned victims as payments reversed off a/accounts Student turned victims as payments reversed off a/accounts so left with the debtso left with the debt

Easy PolicingEasy Policing

• Assumption or fact, most internal fraud in Assumption or fact, most internal fraud in call centrescall centres

• Temporary staffTemporary staff

• Systems in place to detectSystems in place to detect

• High volumes found/low valueHigh volumes found/low value

• Other areas, procurement, acquisitions high Other areas, procurement, acquisitions high valuevalue

• Technology in criminal fraternity, greater Technology in criminal fraternity, greater than found in most organisationsthan found in most organisations

• If not looking, will not findIf not looking, will not find

Who’s at risk ?Who’s at risk ?

• Any organisationAny organisation

• Fraudsters know no boundariesFraudsters know no boundaries

• Despite best practice (audit, compliance etc), Despite best practice (audit, compliance etc), fraudsters have the motivation, incentive and time to fraudsters have the motivation, incentive and time to look for weaknesses in your systemslook for weaknesses in your systems

Warning signsWarning signs

• LifestyleLifestyle Living beyond meansLiving beyond means Obvious sighs of wealthObvious sighs of wealth

• Exceptional performerExceptional performer

• Experienced staff, not wanting job changes or promotionsExperienced staff, not wanting job changes or promotions

• Excessive (unpaid) sick time with no explanationExcessive (unpaid) sick time with no explanation

• Complaints (customer / external)Complaints (customer / external)

• Increase in lossesIncrease in losses

Lessons to be learnedLessons to be learned

• Customer sign up procedures more rigorous than staff Customer sign up procedures more rigorous than staff recruitment ?recruitment ?

• Know your customer vs. know your staffKnow your customer vs. know your staff

• Thoroughly check CV’sThoroughly check CV’s

• Identify discrepanciesIdentify discrepancies

• ID’sID’s

• Exam certificatesExam certificates

• Status enquiries (voters roll, credit enquiries)Status enquiries (voters roll, credit enquiries)

• Limiting computer access/regular password changesLimiting computer access/regular password changes

• Regular audit trailsRegular audit trails

Lessons to be learnedLessons to be learned

• Third party suppliersThird party suppliers Regular auditsRegular audits Processes / ProceduresProcesses / Procedures Staffing policiesStaffing policies Seasonal Staff, urgencySeasonal Staff, urgency

• Upon identifying internal staff fraud, decide early in the Upon identifying internal staff fraud, decide early in the process which route to takeprocess which route to take

Criminal / PoliceCriminal / Police Civil / Employment lawCivil / Employment law

ControlsControls

• Do your staff know where to go if they have Do your staff know where to go if they have suspicions ?suspicions ?

• Have you got controls in place to identify and deal Have you got controls in place to identify and deal with suspicions of fraud ?with suspicions of fraud ?

• Are they adequate, up to date, reviewed ?Are they adequate, up to date, reviewed ?

• Are staff aware of potential consequences if caught Are staff aware of potential consequences if caught committing fraudcommitting fraud

• Are they applied ?Are they applied ?

Sharing IntelligenceSharing Intelligence

Experian Fraud solutionsExperian Fraud solutions

• Product solutionsProduct solutions HunterHunter AuthenticateAuthenticate DetectDetect Detect Credit ScoreDetect Credit Score Fraud BureauFraud Bureau Backgroundcheck.comBackgroundcheck.com