Phishing Warning: Over the past few days there have been many emails coming out trying to get people to go to a purported ACH or NACHA site. They contain a link that directs you to a Phishing site – which appears to go to nacha.org. This seems to show that the Phishers (or perhaps they are simply trying to load a virus – we didn’t go to the site for obvious reasons )- are doing some more homework. This is evidenced by:

  • Reasonable language (in english) - even though there are some technical errors that non-Treasury people wouldn’t catch. They seem to be spending more time doing their homework.
  • NACHA Information In the Email Source Description. These emails include sources such as
    • Electronic Payments Association
    • NACHA.org
    • Automated Clearing House (ACH) Network

Please, be careful. These are not real notifications.

*******

Dear bank account holder,
The ACH transaction, recently initiated from your bank account (by you or any other person), was rejected by the Electronic Payments Association. Please review the transaction report by clicking the link below:

LINK NOT SHOWN

Copyright
©2009 by NACHA – The Electronic Payments Association

 

Scam – Money Transfer warning

The following scam, and ones just like it, targets individuals and not businesses. Nonetheless, one of Strategic Treasurer's employees was in the bank the other day overhearing (not intentionally mind you, the person was upset and quite loud) the complaint of someone scammed with a method similar to this one. They were trying to get their money back.  It is doubtful they will get their money back – unless the scammers had to attend a family emergency and forgot to clear everything out.

The basic process is:

  • Sign people up to be a 'mystery shopper'
  • Send them a fake check for, in this example, $3,400
  • Have them deposit it
  • Have them send $3,000 of real money right away…to find out if there are problems with the money transfer system
  • Find out the check bounced
  • Realize the $400 of easy money was really $3,000 of a real loss

Why would anyone trust an anonymous person with $3,400? Or pay them $400 for a rather simple task?

This clearly sounds too easy to be true. Unfortunately, this preys on many people in difficult situations.

We pass this on simply as a warning to friends and family.

———————————————————————————————————————
Text from a scam email. The last names have been altered in case they used someone's real name
———————————————————————————————————————


From: Annie Y******

To: undisclosed-recipients:;

Sent: May 5, 2009 7:53 AM

Subject: Attention!

 

FIRST ASSIGNMENT ON MYSTERY SHOPPER !!!

Shopper's Guide wants you to run a survey on two  prominent companies in

your area.

 

The 1st is a Western Union   Location

The 2nd a Restaurant

 

There have been reports about laps in the services of
their Management and

some of their staffs, Their complains   are based on reports which

their customers forwarded anonymously and Phone  calls which were also made

to the head office.

 

The Western union location was reported for evaluation
for the

following reasons:

I)    Customers
have reported their money missing

ii) Slow services

iii)  Unbalanced
transfer charges

 

The 2nd company was reported to be   rendering

(I) Poor services

(ii) Rudeness to customers

(iii) Excess charge

(iii) Late opening time and Closing before time.

 

Your Secret Evaluation would be

1) To make a transfer of funds from this western union
location to our

Mystery shopper, And the funds would be picked up by
another mystery shopper

at another location where a customer reported her funds
missing.

 

2) You would have to record the time at which you go to
the location and how

many minutes it took you to get service.

 

3) You would be sent a check/Money order which would
cover your payment of

$3000 and also for the duty. As soon as you receive the
check/money order,

you should cash in at your bank, and deduct your $400, and
use the rest of

the money for the services.

 

4) Upon receiving the funds, the locations address would
be forwarded to

you, and also the Name and address of whom the Mystery
shoppers

transfer would be made to. You would have to keep a
comprehensive report on

every activity you carry out.

 

5) You would also provide me with the name of the cashier
that attended to

you. So if you think you can take these Job get back to
Us

with these Full Information below .

 

First name……………….Last
name……………….Address

Line……………City…………………….State…………………..

.Zip/Postal code…………..

Age……………………..Marital

Status……………Nationality………………Occupation…………….

…..Home phone……………….Cell
phone……………….

ID or Reference …………….Email Address  ……………

 

Please send me a reply so that the check/Money order sent
out to you ASAP

 

Yours  Sincerely

 

Allens W***********

Stockton on Tees TS16 0RW

 

Payroll Fraud

Payroll often becomes the victim of fraud from within.  We’ve said that before and repost some of that entry and add just a bit more.  Very few people have access to timekeeping and salary systems and most organizations don’t review changes.  This is not a good idea.  Segregation of duties and a system enforced control process are often lacking – leaving the organization severely exposed.

Some months ago (see Fraud Friday) we posted a few examples of Payroll Fraud.  Here is another:

Additional Address/ACH Information.  The payroll operator adds an additional payment address (for example routing some or all of other employees pay to an account that they control).  The change is often not reported or reviewed by another person in PR or HR.  Infrequently is a change notice sent to the employee…so who notices?  If anyone catches this it is substantially after the fact – and typically when the crook masquerading as a Payroll employee or manager gets greedy and keeps this scheme going too long.

Some control steps you’ll want to ensure are in place

  1. Ensure KEY changes are systematically approved by a different person.  These include: Address, Banking Information, New Employees and Rate Changes.
  2. If you can’t have those KEY changes systematically approved before they happen, then make sure change reports are created and distributed to appropriate parties – so the quality will be high and the fraud will be low.
  3. Employees that leave must be removed- their Payroll records need to be rapidly updated so extra pay doesn’t inadvertently leave the building.
 

Check 21 Fraud

Check21 has many benefits and a few areas that require organizations to be careful -whether or not you are using RDC (remote deposit capture, remote capture, etc).

**We edited this entry just before going to press due to a concern that it might aid certain people in their efforts to defraud banks and corporates.  Some of the better current control methods will catch the type of fraud that we described and have since deleted from this entry (positive payment, payee match positive payment, rapid reconciliation (using the so-called reverse positive pay services), segregation of duties and outsourcing.**

Is it fraud or is simply honest mistakes in the process?  Check21 has opened up some doors for fraud on the disbursement side of the house that must make us vigilant in the fraud detection and fraud prevention area.  Rather than outlining ‘how to commit fraud’ – we’d like to touch on what controls that worked historically are of less value and what must be emphasized.

Former controls of less value:

  • Secure check stock.  How effective is the micr printing when a check is imaged?  Will the check protection that shows up if someone washes a check work on an imaged item?

Controls of great value:

  • Positive Payment.  Regular positive payment and payee match positive payment are of great value.  Isn’t this a commercially reasonable practice?
  • Rapid Reconciliation.  Doing it quickly is very important – though not the most exciting activity.  And, make sure the reconciliation staff don’t just identify a ‘reconciling item’ and move on when it may be fraud.
  • Segregation of Duties.  Nearly as popular as double entry accounting -segregating the key disbursement functions remains wise.
  • Outsourcing.  Not only a good use of resources – it can provide the ultimate in segregated duties.  What to do with the freed up time (from stuffing, licking and sticking) – convert more customer to electronic payments – the ACH.
  • Convert to ACH.  The restricted network is the best, least expensive and most efficient. Plus, it’s good for the environment.

Treasury and accouting will need to re-examine the controls they are using/depending upon in light of Check21 and the new bank produces like remote deposit capture.  Some controls may need be dropped – and others emphasized.  Yes, we did say some controls may need to be dropped since they aren’t protecting you any longer.

There are greater controls surrounding those organizations who enter transactions into the ACH network than those who can get RDC software.  Banks need to be diligent and organizations need to be careful to avoid problems and losses.  Companies must have clear procedures for handling and controlling their funds.  Hiring honest people – and doing credit checks on them annually is wise for those responsible for handling your organizations funds.

Also, working with banks who can RAPIDLY detect/stop these situations is the only way to fight fraud effectively (along with your own diligence).

 

Treasury and A/P Fraud

If you want to look for inefficiences and areas for fraud – a good place to start for both is with the exception processes.  This is true with paying regular old accounts payable items with wires.  Many A/P systems don’t support a straight through process for generating wire transfer from within the A/P area all the way to the bank.  Therefore, paying a vendor by wire results in an exception process.  A separate wire request to treasury…separately recording the accounting entry.

Who is to say that the payment won’t be made by check in a week or a month?  The A/P system must be updated to reflect a payment that was made by another system.  Quickly too - since the normal ‘duplicate payment’ report that most A/P systems have set up won’t be able to pull up a wire entered into a bank system.  You just bypassed that control – and astute A/P and Treasury folks will make sure that they handle that exception appropriately to prevent a duplicate or fraud problem from occuring.

What should be done?  Well, here are a few points to get you started (but don’t end here):

  • Eliminate or reduce the need for special handling of A/P wires.
  • Clearly document those transfers – and require up front accounting before wiring A/P payments.
  • Challenge all A/P wires (treasury and A/P staff)
  • If these wires hit a special account on the ledger – monitor this closely.  Self audit religiously.
  • Set up ACH payments for domestic items

Exception processes are necessary for some items, but some use the exception to drive everything else through that hole.  Monitor those exceptions and you should have good payback for your effort.

 

Payment Creation Outsourcing as a Fraud Tool

Segregation of duties is a challenge in all but the largest organizations.  Additional opportunities with fraud for checks abound:

  • Stolen check stock
  • Lifted signed checks from within the building
  • Access to the signature plate
  • No control counting on the printing, signing or mailing of checks

Many people are outsourcing the payment creation (print checks, generate the ACH) for financial gain or improved flexibility of staff.  Outsourcing the payment creation can help keep a clean segregation of duties and the file control discipline that is needed and will often help catch an quality control issues more quickly.  Outsourcing check printing (payment creation) as a control…something to look at carefully.

 

Payroll Fraud

Payroll often becomes the victim of fraud from within.  Due to the sensitivity of the data, very few people have access to timekeeping and salary systems.  Segregation of duties and a system enforced control process are often lacking – leaving the organization severely exposed.

"We trust our Payroll administrator" are famous last words.  "Trust but verify (some key activities)" as a former President used to say (emphasis and additional text added).  Here are a few examples of Payroll Fraud:

1. Departed Employee.  Keep paying them for a few pay cycles – change the address or banking information, then stop it before anyone notices.

2. Fictitious Employee.  Payroll knows who checks their budget figures and who doesn’t.  If there are no clear segregation of duties controlled systematically, setting up a fictitious employee can add some additional funds to the perpetrator’s coffer. (stub distribution, direct deposit each have different characteristics).

3. Rate Changes.  If the payroll information (changes) are reviewed, it may be easy to give oneself a raise without detection.

Some control steps you’ll want to consider:

  1. Ensure KEY changes are systematically approved by a different person.  These include: Address, Banking Information, New Employees and Rate Changes.
  2. If you can’t have those KEY changes systematically approved before they happen, then make sure change reports are created and distributed to appropriate parties – so the quality will be high and the fraud will be low.
  3. Employees that leave must be removed- their Payroll records need to be rapidly updated so extra pay doesn’t inadvertently leave the building.