Wire Fraud: A Costly Blind Spot for Banks
On a single day, five different customers of a large US bank fell victim to a Nigerian email scam. In all five cases, the funds were withdrawn from the bank by wire. By the time the frauds were discovered, one after another, the customers’ money was long gone, fully settled, irretrievable. The customers were poorer, embarrassed, and aggrieved. The bank likewise – tainted, embarrassed, and questioning its controls.
More than likely, the bank’s front-end controls for taking wire orders and executing them were sound and adhered to. At least one of the tellers involved was suspicious and asked pointed questions, but ultimately felt obliged by established procedure, and pressured by an insistent customer (fearful of losing an apparently fleeting and lucrative opportunity), to carry out the order without delay. More than likely, this bank, like most banks, considered its wire systems and processes to be among its most secure. And more than likely, it had not felt the need for systematic controls in the wire room that might have set off alarms.
How about your bank? Would your wire system have asked, in an automated way, what are the odds that five customers who do not normally send large wires at all, let alone to Africa, are all, on this same day, pressing your tellers to send sizeable funds to Nigeria? Even if it did not notice the first one, would it have noticed the second or the third?
Most banks have long applied filtering technology to other payment channels that they have not applied to the wire channel. They had their reasons. Wire systems are, by and large, remarkably secure and rarely compromised. Rarely is the wire infrastructure itself hacked, rarely are wires modified fraudulently. Rarely does a wire intended for one place end up in another. It is reasonable that in prioritizing their fraud prevention efforts, banks would have rated the wire channel as a comparatively low risk.
But consider this: the American Bankers Association finds that even after massive prevention efforts, check fraud attempts are still growing, as are check fraud losses outside of the largest banks. The Association for Financial Professionals surveyed its membership and found growing incidence of, and concern about, ACH fraud. The Association of Payment Clearing Services reported a rise of 85 per cent in ATM fraud in the year leading up to June 2004. Credit card fraud, debit card fraud, online frauds like phishing and spoofing all continue to grow at disturbing rates.
In this fraud-fertile environment, what is the likelihood that wire transfer – with its seductively large dollar amounts, its promise of same-day settlement, and its seamless global reach into centers of corruption – would not become a favorite channel for fraudsters? Possibly it has, if wire fraud is viewed as fraudsters view it – one of the surest ways to spirit away ill-gotten funds, regardless of the way the actual fraud was perpetrated. It could start with a counterfeit, an identity theft, an account takeover, or a half-literate email from the purported widow of a Nigerian potentate. But if the bank and/or customer sustain a fraud-related loss of funds that leave the bank via wire, the bank that counts that as a wire fraud loss will begin to think differently about wire fraud. And most important, it will seek channel-focused ways of preventing such incidents in the future.
Why do wires carry greater exposure than commonly supposed?
If all of these types of occurrences were added up, wires would be seen as an area of major opportunity to close risk gaps. Moreover, it would be clear that closing those gaps must take place early in the wire process, before the funds leave the bank.
Banks can quickly seize on five opportunities to better deter fraud that is executed via wire. They involve applying technology solutions that the banks probably already apply, in some fashion, to other channels or for other purposes, but adapted here for the specific attributes of wires.
No doubt most banks, as standard practice, check wire requests against the Office of Foreign Assets Control (OFAC) list, but it is common knowledge that some countries as a whole represent much greater risk than others. Why not flag wires to those countries for further investigation, even though the wire order has already passed all the front-end controls?
Banks that do not have their own methods for rating country risk can refer to an annual publication from the Bureau of International Narcotics and Law Enforcement Affairs (BINLEA). It ranks the perceived money laundering risk of almost 200 countries and jurisdictions, based on information compiled from several US agencies with anti-money laundering responsibilities.
The BINLEA list ranks these areas as ‘primary concern’, ‘of concern’, and ‘others monitored’ – labels that could easily be correlated to high, medium and low risk for a bank’s wire fraud filter. (Nigeria, it is worth noting, is solidly ensconced in the ‘primary concern’ category, an awareness of which might have prevented the debacle at the start of this article).
It is less apparent but no less true that, just as countries vary widely in the risk they represent, so do financial institutions. Most banks could easily begin building their own lists from infamous cases appearing in the news, from their own experiences, and from other trusted sources.
This filter would be especially useful for raising alerts in special circumstances such as a receiving bank known to be high-risk even though it is chartered in a country known to be low-risk. This ‘high risk bank’ list could also be the repository for the names of ‘shell banks’, immediately filtering out transactions destined for or coming from accounts of known foreign shell correspondents, which are expressly forbidden by the US Patriot Act.
Ideally, a bank bent on reducing losses through fraudulently obtained wires would examine both the sender and receiver. Is a sender originating wires to a number of different recipients – perhaps to high or medium risk countries? Is a single receiver receiving wires from a number of different senders?
Since many fraudsters attempt to escape detection by spreading their wires over several days, suspicious circumstances like these multiple senders/receivers should be accumulated over several days and evaluated as an event, not separate transactions that would on their own excite no suspicion.
Banks call the police while a criminal is still in the branch. If the verifications discussed above are not made before the funds leave the bank, they do not matter much except for keeping score later. If a loss is to be prevented, alerts need to be issued in real time, and evaluations made in real time – in part to catch the fraud but also to meet legitimate customer expectations of rapid service.
Online requests represent a special challenge because sender authentication is imperfect, and online senders expect not to wait for additional, time-consuming verifications. In such cases, a bank’s ability to evaluate a wire on other aspects (country risk, bank risk, and so on) can provide a safety net until online authentication is made more reliable.
It has been said before that you can risk-manage your way right out of business. Not all risks are equal, and in a high-volume business like payments processing, the best risk managers use many methods to make sure that they assign the greatest priority to the highest-risk transactions.
Suppose a single transaction triggers alerts on more than one filter? Suppose it is a high-risk country but only one transaction? Suppose it is many transactions to a bank of unknown risk in a medium-risk country?
A good wire filter needs methodology for weighting each alert trigger, combining the weights to score the alert, and using the score to assign priority. When an alert is raised on an account, and the transaction in question is found to be fraudulent, not only should the transaction be blocked, but the associated account should be closed or at least flagged for ongoing monitoring.
These enhancements to a bank’s fraud filtering system will fully justify themselves in terms of losses prevented, customers protected, and bank reputation unsullied. But there are other side benefits worth mentioning:
As risk rises in almost every aspect of banking, and wires remain one of the most popular services for moving very large amounts around the world, it seems that a wire risk filter is one of the least risky steps a risk manager could take.