CISI Bristol John Horan BA (Hons) MICT Ltd Tel: 02071250147 Mob: 07733887262 www.mict-ltd.com john.horan@mict-ltd.com

1. CISI BristolJohn Horan BA (Hons)MICT LtdTel: 02071250147Mob: 07733887262www.mict-ltd.comjohn.horan@mict-ltd.com

2. Session 1. Fraud Wrongful or criminal deception intended to result in financial or personal gain. A person or thing intended to deceive others, typically by unjustifiably claiming or being credited with accomplishments or qualities. Defrauding people or entities of money or valuables is a common purpose of fraud, but there have also been fraudulent "discoveries", e.g., in science, to gain prestige rather than immediate monetary gain.

3. 5 Facts about fraud 1 - Fraud does not happen on the company’s timetable • Revenues are up. Revenues are down. It doesn’t matter. • The company could be experiencing the best of times, or the worst of times. • The fraudster doesn’t care. All he or she wants is money. • Fraud will happen on the fraudster’s timetable. They decide, if, when, how much and how often. • If the company has countermeasures in place, the fraud may be prevented, or the losses kept to a minimum. With little or no countermeasures in place, watch out…

4. 5 Facts about fraud 2 - Fraud scares people, especially senior executives • Senior executives are often apathetic when it comes to discussions regarding fraud. That is until they are made aware of an actual fraud taking place on their watch. • They become exceptionally nervous and spend a great deal of energy worrying about what will happen. • They don’t know what they don’t know and that makes them nervous, sometimes angry and generally apprehensive about the future. • Is this my fault? Will I be blamed? How much money will we lose? Will we get it back?

5. 5 Facts about fraud 3 - Fraud prevention is an after thought in most companies • Do you have an employee hotline? How do you measure its effectiveness? • Do you have a fraud case management database? • If so, when was the last time the information was used to develop proactive countermeasures? What controls do you have in place to prevent and detect fraud? Who “owns” control development, deployment and testing? • What policies and procedures do you have in place to ensure that employees are unable to steal your company’s intellectual property? When was the last time someone tested their effectiveness? • How often does fraud take place in your industry? • Have you incorporated “lessons learned” from fraud at other companies? • Who is responsible for fraud prevention, detection and investigation within your organization? If separate departments, how often do they meet to share intelligence?

6. 5 Facts about fraud 4 - Fraud investigations are easy to “screw up” • Investigating fraud, particularly employee fraud is much more complicated than it appears. • Employees have rights, lots of them (As they should). • If in the course of an investigation a company violates those rights, the “hunter” can become the “hunted”.

7. 5 Facts about fraud 5 - Fraud losses are rarely recovered • We’d like to think that law enforcement can reach out and claw back the proceeds from a fraud whenever needed. The truth is that most of the time, the proceeds are long gone. • Law enforcement is often unable or unwilling to help companies recover fraud losses • Financial crimes can be extremely complicated and time consuming to investigate, especially if the detective does not have a financial background. • A six figure loss may be devastating for your company, but it may barely raise the eyebrow of law enforcement

8. Fraud Risk Appetite • Lack of a formal fraud risk assessment • Too reactive rather than proactive • Risk defined in terms of budget • No special treatment all about RoI • Targets set for expected “losses” • Ignorance of non financial risk • Reputational risk • Regulatory risk

9. The cost of fraud • Recession has seen rises of 33% • Comparable to two previous recessions 1980-81 and 1990-91 • Global loss of £2.2 trillion = UK GDP • UK loss £30 billion (National Fraud Authority) • 58% in Public Sector • Private sector financial services worst hit. £3.8 billion

10. Senior Management responsibility • New concept – Management buy in • Championing the Fraud team • Procedures formal and documented • Well established procedures • Ensure proactive approach • Not firefighting/reactive • Shows commitment to the regulator

11. Communication and Coordination • Decided by need and size • Larger organisation should consider Hub and Spoke method • Spoke = fraud manager at each branch • Consistency in approach • Consistency in reporting • Hub = Central unit supporting and providing resources including training

12. Who commits fraud? • Majority of occupational fraud are committed by employees • 61% committed by men • Most perpetrators 87.9% never charged or convicted • Almost 40% committed by two or more individuals • Median loss greater with older employees.

13. Motivational factors • Ineffective internal controls • Insufficient or no supervision • Large turnover of employees • Low morale of employees • Feeling undervalued • Feeling underpaid • “I work twice as hard as him why is he the boss”

14. A victimless crime? • Hardly!! • Organised crime – drug traffickers, people traffickers, terrorist groups like the perception of “white collar crime” • Harm includes but is not limited to • Direct financial loss • Emotional damage • Consumer confidence

15. A victimless crime? • It affects the ability of a business to • Retain market share • Loss of profits • Loss of jobs, both directly and indirectly • Higher prices for consumers • Making victim non competitive. • Reputational damage • Association with a fraud with drive away customers at the least

16. Who are the victims • There is no one category • Individual investors • Corporate entities • Banks • Governments • Little old ladies! • YOU

17. Key areas • Insurance fraud • Staged accidents • Ambulance chasers • Over inflation of value of items • One in 10 people would exaggerate an insurance claim if they believed there was no chance of being caught out • 7% of the UK population admit to having actually committed at least one of the following: • Falsely reporting a mobile phone as lost or stolen to get a free upgrade • Exaggerating an insurance claim • Concealing an accident record to get a low car insurance quotation • Identity fraud • We live in an electronic world • Face to face less and less common • You can even order your groceries on the net.

18. Whistleblowers are seen as a threat in the workplace Snitches have always been viewed disapprovingly and those who ‘tell on other’, often find themselves ostracised by their friends and colleagues. But…………………………….this attitude will have to change in the workplace.

19. Statutory Protection The Public Interest Disclosure Act 1998 Employees have rights….therefore to gain the special statutory protection The disclosure in question must relate to one of six specified categories of subject matter and must be through one of the six specified procedures.

20. Qualifying disclosures • A criminal offence has taken place, or is likely to take place. • There has been, or is likely to be, a miscarriage of justice. • The environment has been, is being, or is likely to be damaged. • The health or safety of any individual has been, or is likely to be, endangered. • Information tending to show any of the above has, or is likely to be deliberately concealed.

21. Investigating fraud • Who should do the investigation? • Carried out by qualified investigators • In house • Trained and qualified • Consider outside training courses • Professional diligent and competent • Able to give evidence • Consider training for evidence giving • Attendance as a spectator in court at a trial is good preparation

22. The investigation • Who should do the investigation? (continued) • Consider employing outside expert • Liaison throughout with HR • Know the employees rights if under investigation • No expression of opinion • Stick to facts • Ensure no conflict of interest

23. The investigation • What should be gathered/covered • Documentary evidence • Properly exhibited • Continuity of evidence • Witness statements • Factual • Reference to documents • In witnesses own words • No opinion

24. The investigation • What should be gathered/covered (continued) • Maintain the security of evidence • Much of it will be confidential • Retain all documentary evidence gathered • Do not “cherry pick” discarding evidence which does not suit a theory or opinion on the case • Collect evidence which may exonerate as well as evidence which may convict

25. The Investigation • Consider data mining • allows all transactions, balances, data or events to be tested according to pre-defined parameters. • It can be used proactively to assist the search for indicators of fraud or error. • It is also used once a fraud is suspected to search for the entire universe of similar or related transactions. This can then indicate the extent and cost of any wrong doing prior to interviewing witnesses or suspects and performing other checks.

26. The investigation • Who should not do the investigation? • Suspects line manager • Peer of the suspect • Employee junior to the suspect • Anyone conflicted e.g. • Close personal friend of the suspect • Relative of the suspect • The final judge/disciplinary panel who will adjudicate on the investigation (to maintain objectivity)

27. The investigation • The interview • Suspect has rights • Respect them • Ensure familiarity with company policy and local laws • Allow suspect legal or other representation • No illegal means to gather evidence e.g. • Illegal phone tapping • Demonstrate fairness • Stick to facts not personal opinion or observations

28. The investigation • The interview • Innocent or guilty both will be nervous/apprehensive • Guilty suspect’s biggest fear is what he thinks you might know not what you may actually know • Be fair but do not show your hand too early • Listen carefully to what you are being told • Give him/her time to speak

29. IT FRAUD • Six Steps to Protect your Business from Espionage: • Recognize there is an insider and outsider threat to your company. • Identify and valuate trade secrets. • Implement a proactive plan for safeguarding trade secrets. • Secure physical and electronic versions of your trade secrets. • Confine intellectual knowledge on a "need-to-know" basis. • Provide training to employees about your company's intellectual property plan and security.

30. IT FRAUD • The use of Trojans • Legitimate site is infected • User of the legitimate site is unknowingly redirected to another site where an “exploit” kit is waiting a “trojan” is loaded on (specific type of malware) • User accesses his online account and all key strokes are reported by the trojan to the criminal • Usually located in a different jurisdiction the criminal now has access to the users account and empties it

31. IT FRAUD • The use of Trojans (continued) • In the banking sector described as “man in the middle attacks” • Bank believes instructions emanating from customer • Transfers money from customer’s account to a “mule account” • In some cases the customer’s account is used a mule account and the repository for criminal proceeds later moved to a second mule account.

32. IT FRAUD • Phishing • A form of social engineering • Use of e-mail to coerce individuals or companies to release information • Information used to steal identity and/or exercise control over financial data or accounts • Usually mass targeted • Variants include • Spear fishing • Pharming

33. IT FRAUD • Spear fishing • Targeted at indivual or specific group • Pharming • Misdirection to a bogus website posing as a legitimate web site • Uses software to confuse the computers ability to read the IP • Use of social networking sites • Facebook 845million active users Dec 2011

34. IT FRAUD (Extortion) • Tend to involve threat of disruption of networks and websites through denial of service attacks • Theft of information • Reputational threats • website defacement • publicity on security gaps in the IT system or the protection of customer information.

35. IT FRAUD Scare ware • Ads that promise to delete viruses or spyware, protect privacy, improve computer function and remove harmful files or clean registries. • Alerts about malicious software or illegal pornography on computers • Invitations to download free software for a security scan or to improve computer systems. • Pop-ups that claim security software is out of date, and computers are in immediate danger. • An unfamiliar website that claims to have performed a security scan and prompts the user to download new software.

36. IT FRAUD Scare ware what to do if infected • The FTC advises users who suspect scare-ware infections to not click “No” or “Cancel” on the warning box or even the “x” at the top right corner of the screen, which can activate the scare-ware. The FTC recommends users to shut down their browsers by pressing Ctrl + Alt + Delete to open the task manager and clicking “End Task.” • Mac users press Command + Option + Q + Esc to “Force Quit.”

37. FRAUD Case study • Large manufacturing company with big IT needs “ABC products” • Appointed an IT director • He had authority for all IT sign offs • Set up his own IT Company XYZ Software • Invoiced ABC products • Signed off the invoices • Loss to ABC products 7 figures+ • How was he caught?

38. CISI BristolJohn Horan BA (Hons)MICT LtdTel: 02071250147Mob: 07733887262www.mict-ltd.comjohn.horan@mict-ltd.com