Strategies for Fraud Prevention in Business & Corporates

Strategies For Defeating The Cheats Within an Organization or Business

How Companies of All Sizes Can Prevent Fraud

Tips to Prevent Employee Theft and Fraud

Ways to Protect Your Business Against Employee Fraud

Strategies for Fraud Prevention in Your Business

Tips to Prevent Employee Theft and Fraud

How to Prevent Employee Fraud

How to Prevent Corporate Fraud

By Bill Trueman, Fraud & Risk Management Specialist.

With the recent high profile cases of senior fraud and online security managers being caught perpetrating fraudulent activity, there has been a degree of shock across the corporate world, combined with an initial feeling of helplessness. This is the worst thing that can happen in financial and banking organisations where one would expect the very tightest security to prevail. After a ll, if you can’t trust those executives in the most credible organisations who were specifically recruited to identify and counter fraudulent financial behaviour, then what can you do to ensure that your own organisation does not become a victim. The word victim is used advisedly, as internal fraud is not a victimless crime; rather it impacts in varying degrees on management, staff, shareholders and customers.

fraud and risk management specialist

Any crime committed by those in a position of trust is far more serious, so the penalties should surely be far higher than normal. This is particularly true with fraud prevention mangers that cheat. However, it does seem that once an internal fraudster is caught, that any offer to ‘return funds in return for a leverage for legal plea bargaining should be disallowed. The ideal must be for companies to find ways to decipher and identify such practices and to eradicate them at ground level.

Still reeling from the shock of the media coverage of the latest betrayals, UKFraud asked its independent corporate fraud prevention SIG (Special Interest Group) to draw up a new set of benchmarks which will help organisations identify the signs that something is awry from ground level up. The SIG also defined and deciphered the most effective strategies for countering these risks. The Corporate Fraud Prevention SIG consists of leading fraud prevention consultants from across a range of industries, coupled with a wide range of fraud industry skill sets. The aim of the SIG is to analyse approaches taken to fraud in the corporate sector and to make recommendations for change at local, national and global levels.

According to the SIG’s research, the most likely signs of wayward behaviour by fraud and security management are relatively easy to spot and yet often overlooked. They include:

  • Fraud Systems that are below par. The fraud systems chosen by an organisation can be unfit for purpose and may not deliver what is required. There is also often an unwillingness, due to the influence of the internal fraudster, to consider competitive fraud technology products that do deliver or that can deliver more quickly. Often, the SIG says, it is easy enough with hindsight to see that a change to effective systems had been deliberately avoided, and typically, career minded employees are reluctant to blow whistles.
  • Erratic,  incomplete, late or excuse laden management and system reporting is a classic sign that line managers are covering something up and says the SIG, this is just as likely to be the case with those fraudulently managing the security and anti-fraud systems of a company. Normally, further investigation will reveal that ‘lip service’ and increasingly tenuous explanations are given assertively to thwart follow up activity. When though one is dealing with an errant fraud manager, these explanations are more difficult to see through and more than likely to pass the plausibility test. Often the blame for the cause of any suspicion will be thrown onto inadequate IT systems or on the political gaps between corporate silos.
  • Frequent excuses are often based around IT related issues, such as technology compatibility problems between different company systems or even between international systems.
  • Unexplained wealth of managers outside of work. There will be plenty of evidence of the rewards of wrong-doing with fraudsters purchasing luxury housing, wardrobes, holidays, cars and home computing equipment together with other rewards for family and friends which can even extend to private school fees for children.
  • Work place rumours, jokes and tip-offs. These are often dismissed as political jibes but often this is a tell tale sign that something is wrong and that staff are too afraid to ‘blow the whistle’ formally.
  • Frequent use of the ‘privileged rank’ of Security or Anti-Fraud Manager to divert questions or to avoid enquiries from those who might raise suspicion, such as the internal or financial auditors. This also includes the robust use of the ‘we don’t want to compromise security by answering your questions’ excuse.
  • Where fraud specialists know the latest trick, for example how on-line fraud works, the unique symptoms of that particular scam will show up in the company where the internal fraudster is using it themselves.

UKFraud’s Corporate Fraud Prevention SIG believes that ‘maintaining an independent review perspective managed by those with the greatest experience’ is the most effective solution for combating inside jobs by fraud and security management. Amongst the strategies the SIG would recommend are:

  1. A greater emphasis on the use of Non-Executive Directors. This is crucial, says the SIG, as usually Non-Execs are appointed for their experience of skills and operations in other organisations and sectors. They have that ‘other worldly’ eye that is able to cast a different perspective. They should have the ability to review all aspects of a company’s anti-fraud strategy and to ask awkward questions ‘from the top’ as this carries more weight.
  2. Up-to-date reporting must be a core mantra of good company management, with the details of repeated exceptions thoroughly investigated. Organizations should also ensure that reports are not only timely but that they are also complete, real and updated as required. These processes should also then be built into the internal audit schedule for checking. This in turn should feed into the main GRC (Governance Risk and Compliance) systems. In addition, wherever appropriate, organisations should adopt an enterprise-wide approach to technology as this will help with systems issues. Thus, if the technology works well in all other parts of an enterprise, it is highly noticeable if it fails in the management of the fraud department or the control of online and financial systems.
  3. From the ground up, organizations need to establish records both electronically and on paper. This should include specifying where documents are and when they should and should not be stored. One should identify who is in control of these systems, processes and procedures and who has ownership of specific records. Organizations also need to decide who is responsible for checking that these measures are followed. The scanning, and indexing of work needs to be carried out to professional standards and there must be rules to ensure that no-one can intercept/edit documents at an inappropriate stage or in a fraudulent way. It is also important, the SIG believes, to ensure that your storage capacity is controlled properly.
  4. Where acquisitions and mergers are concerned, organizations need to ensure that all documents are available and stored appropriately and securely, especially those that relate to IP protection, IP development records, audit trails and staff contracts. In particular, when acquiring a business, companies must make sure that they have indemnities and penalty clauses built into the acquisition agreements which relate to the availability of data, logs, audit trails and so forth.
  5. An extra fraud prevention ‘task-set’ should be drawn up for auditors and IT auditors whether they are internal or external. This can have a real impact, although sadly most auditors are simply there to either report on financial results or check asset lists and software licence compliance. There are though many specialists that can undertake ‘special’ tailored checks to find frauds within all manner of business systems including: payroll, invoicing or payments. By turning them towards checking the efficacy of the security and fraud systems in place, says the SIG, it is not only a greater deterrent but also a far more certain way of catching wrong doing whilst in flight.
  6. Getting HR more involved. This allows organisations to define responsibilities and handle warnings for non-compliance and to do so at all ranks from the ground level upwards.
  7. Organisations should actively consider the use of external risk consultants who can offer solutions which benefit from an independent viewpoint that resides outside of a company or   its politics.
  8. Where doubts exist, organisations should contemplate the use of private investigators to look deeper into the processes used by those who are deemed to be high risk people. These need to be the breed of computer literate investigators with corporate fraud experience.

A leading member of the SIF is Malcolm Gardner. He believes that the situation may be worse than many fear. In his view, “Typically, when fraud or security managers are caught, it is either because they went too far, having become complacent, or where there has been a tip off. This tends to suggest that those who are caught might simply be the tip of the iceberg. With sectors such as the online market, now so very tempting to fraudster, it can also be tempting for internal cheats too. Corporations need to be sure of their staff and need to put the right systems in place to help the loyal staff who are the ones still working for the good of the company.”

So to conclude it is especially negative situation whenever any fraudster is identified within a business as they are the person who has the responsibility for fraud prevention themselves. IT is a complete betrayal.  The first step in planning the fight back is finding these people and then managing the problem. The trouble is that many of them are exceptionally well hidden. Whether one can ever be 100% certain that there is no problem internally is probably too much to expect. However my belief,  is that if you start to introduce the kind of checks and measures the Corporate Fraud Prevention SIG has outlined, there is every chance that the risk will be minimised or driven away.

Bill Trueman (an independent fraud and risk specialist) is director of RiskSkill and UKFraud.

This article originally published here.

Other Useful Posts You Would also Like:

What is Risk Management? Definition & Importance

11 FAQs on EMV Chip & Pin Credit Card Technology

Is EMV Chip and Pin Really the ‘Money Pit’ for Retailers?

Riskskill Appointed by Visa Inc. as an Approved GARS Reviewer

Is EMV ‘A Colossal Waste of Time’ for Retailers?

Top Technology Trends in Payments, Risk and Fraud in 2014

25 FAQs on Risk Review and Risk Management

Top Technology Trends in Payments, Risk and Fraud

fraud and risk management specialist

1. Big-Data – Big-data has become a buzz-word to capture many things, but in finding risks and fraud, the more data that we look at, the better chance we have of finding unusual features and problems that should not be there. The manipulation of data and looking for such anomalies and patterns is getting ever faster and better – and there are generally lots of clues on ways to make better decisions – e.g. merchants looking at their own trading / selling for unusual sales.

2. Sharing Data within the confines of Data Protection laws (In Uk DPA s29) – This might sound complex, but it is not. Data Protection laws vary slightly market to market across Europe, but the principles are the same as they are governed by EU Data Protection law. Organisations cannot share much data between them because of Data Protection laws that protect us as consumers – and quite rightly so. But they can and do share details of fraudsters and confirmed fraud, and without the same constraints, but there are VERY strict rules on how this can be done and what can be shared in order to protect you and me from abuse of this. There are increasingly more people understanding what the rules are and what can be done, which will help stop more cheats. But equally there are many projects that have been going on for a long time that will never work because of the understanding of the restrictions on what can, and what cannot be done.

3. Making greater use of public data / bureau data. More and more, the value and usage of data bureaux data is being expanded, by the development of new products in the market and the need for organisations to use publically available data to better effect. With much better and stronger payments data, voters’’ role and default data (like County Court Judgments etc.), but also more shared databases available and more people using and sharing such information there are many more things that then can be done with the data. Remember, that every time that we get an insurance quote, ask for a loan, request a credit card or a new phone or gas contract, we are leaving ‘footprints’ at the Data Bureaux, that is all making our habits much more accessible.

4.Greater use of Identity and Authentication Data – almost an extension of the data from the Data Bureaux, but with many more people doing things in the market to ‘know the customer’ better electronically and using data. We have almost gone full circle on this – as we evolved from a) Knowing who we were dealing with, b) Letters of introduction and c) “My word is my bond”. uberrimae fidei through to formal identification through d) the submission of passports and utility bills etc., and now to more and more e) electronic pattern analysis identification and crypto-based authentication services. The Electronic identification methods are becoming more refined and using more sources and more data to check that we are kind-of who we say we are, which in a way is a more complex way of knowing the person that we are dealing with (a) and letters of introduction (b). With government initiatives on identity management setting the ‘gold-standard’ of people identifying themselves through approved data identity bureaux, this can only change things for the better in the next 2-3 years.

5. Device identification / fingerprinting. Whenever we are ‘connected’ to the internet, the connectee can see how we are connected – and knows, with some degree of accuracy, what type of device it is that we are connected to and where it is. They have to know to deliver content to us. There are also companies evolving services that are going to become a lot more important who look at the devices that we are using in much more depth to make sure that when we connect to them, they recognise us. This is why, recently, when I tried to pay quite a large bill with my new iPhone, I was asked by the merchant to wait until I was using my normal computer. It realised that I might not be me, because they did not recognise my device. This technology area has a long way to go.

6. Movement away from ‘profiling types of people’ towards ‘knowing individuals’ – this is again a step towards a time in history when one knew exactly who one was dealing with. Insurance companies and loan providers historically have looked at the ‘groups that we fall into’ to predict the type of repayments or claims history that we might exhibit from the post-code / area that we live in, our age, the type of car/house that we have, how long we have been doing something etc.  This of course assumes that we all act the same as our neighbours, people who drive the same type of car/live in the same type house, or geography, or have the same job or family size.; which of course is not usually the case in today’s faster-moving world.  Whether for targeted marketing purposes or more targeted risk assessment and understanding, technology is helping us to be assessed as individuals and increasingly our behaviours are being used to determine what we can purchase and price what we pay for. For instance, insurance companies can price using telematics – devices attached to our car to assess our driving ‘style’ and thereby determine the potential risks involved to the insurance company.

7. Better use of the technology that we already have. The typical example of this today for me is the way that Apple has seen a commercial opportunity to enter the payments sector with ApplePay in the USA. The USA has not yet adopted EMV (CHIPs on payment cards) like the entire rest of the globe, and is losing more fraud than everywhere else, and has an outdated infrastructure that is causing problems for the financial services industry worldwide. The EMV backbone in the UK and across Europe is 15 years old, but the USA infrastructure dates back nearly 50 years. In one announcement, Apple did nothing new, but pulled together EMV, tokenisation (linking payment details at the point of purchase to the real payment credentials stored securely elsewhere and using a standard that exists today, but not widely used), NFC (again a common ‘tap & go’ technology used by millions on the London underground and more increasingly across the UK, but mandated by MasterCard for all payment terminals by 2020 across Europe; fingerprint identification/authorisation on the phone, and less talked about; geolocation technology to determine that the phone is physically where it is supposed to be when making a transaction.  They packaged this with some clever commercial arrangements to get issuer, acquirer, card scheme and merchant buy-in. This ‘sets a standard’ by using existing technology and ‘pulling it all together’ without inventing anything new. Despite the efforts of others, we should see a lot more of this type of using the current technology more in the year to come.

8. CHIP and PIN –  again in the same arena, the use of EMV Chip and enhanced cardholder verification, e.g. PIN, will evolve quickly in the USA to catch up with the rest of the globe. The losses and the stakes are too high for this not to happen. Despite continuing resistance in parts of the US market, with a desire by some people to stick with signature to verify transactions, or no cardholder verification at all; it must change. Signatures, however captured, take longer, are less secure, cannot be electronically checked, put the onus onto sales staff at every store and generally cause more disputes, chargebacks and fraud.  It is also a market acceptance of payment cards is still seen as expensive and with complex rules – so a major reason why Apple and others are invading this ‘space’. The USA strategy must be to move decisively towards EMV CHIP and PIN – and the recent presidential order for the US government to lead the way in this direction must help with this.  There is no denying that migrating to CHIP and PIN usage and acceptance on debit cards is an easier challenge due the familiarity with PIN usage already, but the real issue will be PIN on credit and charge cards amongst others. There was a co-ordinated national (not just industry) engagement in the UK to drive CHIP and PIN success. It is hard to see the national or industry cohesion across the US market today on these issues.  The final ‘doubters’ must however be persuaded to put aside their own commercial interests in favour of the wider community interests, the answer is not signature.

9. Large-Scale thefts of data – not a month, not a week in many cases goes by without us learning that clever IT hacks have caused another major retailer to lose the card details (and much more) of millions of cardholders and customers. Home Depot lost 56million earlier this year, but similar lost data sizes have been seen at TKMaxx, Target, JP Morgan and more recently at Kmart and Staples.  The attacks exploit technical and procedural weaknesses in the management of systems holding sensitive data as well as the POS terminals and systems. The data would not be so valuable or costly to deal with if there was an EMV payments infrastructure (see above). Misuse of card data would be more easily identifiable in an EMV-compliant set-up, but this type of attack will continue to happen until the data security technology is in place to stop it from happening or being worth stealing the data.

10. Data ‘in flight’ or data ‘at rest’ – whether sensitive data is being stored, temporarily or longer, or if transmitted between various endpoints, it is always at risk of being ‘snooped-upon’, captured, deleted, redirected, or amended – generally for financial or nuisance. Further to point 9 above, the data security issues that we hear more and more about can be prevented or significantly  reduced through proper controls and monitoring, whether PCI DSS, ISO, POS terminal estate management, Point-to-Point Encryption (P2PE), or just by using a little common sense. ‘Cyber security’ is another new ‘buzzword’ but an old problem. It challenges our current thinking on making things secure, regular monitoring, mitigation, proper management, plus real ownership and accountability – from the CxO level down.  ‘Cyber criminals’ seeking financial gain, test systems either to prove a point, or just for their own entertainment because they can. It is no longer called hacking or theft of data and money, but now it is called cyber crime.

11. Increasing IT skills of the global fraudster – Probably the weakest bullet point here to be described as a ‘trend’ – because this is not new; it has been happening for 2,000 years, where the crook always uses his slightly better knowledge or technology than the good guys. Dick Turpin used an alibi that he was somewhere else because the horses and roads available at the time were not developed enough to place him at the scene of the crime and at that time. On this occasion law enforcement matched his guile; but this rarely happens this quickly today as the crooks develop the attacks with new methods and technology quicker than we can implement the counter-measures.  The only thing that we can do, is ‘stay awake’, look out for the issues, ensure the controls and procedures are ‘fit for purpose’, and stay ahead of the market. We should worry that many attacks start with inside information, knowledge and access. Staying awake means constantly looking internally as well as externally. Bat note too that sometimes, if you are being chased by a hungry bear,  you do not have to outrun him, you just have to out-run the rest of the crowd!

12. The answer is mobile – what’s the question? – Industry pundits challenge the traditional card payment brands as ‘dinosaurs’, particularly now that we all transact, bank and shop more online than face-to-face. The mobile, PDA, tablet, watch or similar devices are now seen as the place to transact with customers.  Traditional card payments are being tested, alternative payment methods and new authentication solutions that are more flexible and more adaptable to the virtual space are entering the marketplace every DAY and  with a real vengeance. But how security-enabled are the devices, the new ‘apps’ and gateways. Leaving aside concerns about interoperability, commercial success, etc., the biggest challenges rest with sensitive data being stored or accessed by personal devices with uncontrolled hardware/software security standards, questionable accreditation, payment/security apps with potential weaknesses and users who believe that if there is a problem – that someone else will deal with it.

Author Bill Trueman, is an independent Payments, Fraud & Risk Specialist and Managing Director of UK Fraud and Riskskill

Other Posts Which You Would Also Find Useful:

25 FAQs on Risk Review, Risk Management, Compliance, Due Diligence and Fraud Prevention

Is EMV ‘A Colossal Waste of Time’ for Retailers?

Riskskill Appointed by Visa Inc. as an Approved GARS Reviewer

11 FAQs on EMV Chip & Card Technology

10 Mistakes to Avoid on Your Management Plans to Prevent Losses

 

Business Loss Prevention Techniques by RiskSkill

10 Things to Avoid on Your Management Plans to Prevent Loss in Your Business

If you’re on a mission to turn away your investors then by all means explain to them how you want them to sign a non-disclosure agreement or that you don’t have any competitors. But if you’re serious about attracting competitors then you’d do best to steer well clear of these 10 classic business plan mistakes. Make an attractive business plan and a powerful power point presentation to convey all the information about your business so that they get right information about the business and can turn into real investors. Below I am going to explain some such important aspects one by one which can really help you:

1. Asking Investors to Sign an NDA

NDAs (Non-Disclosure Agreements) are not usually signed by investors, angel investors or venture capitalist , because the strategy or concept of a business is not normally confidential. Although an important partnership may be confidential, it is the execution of the concept and strategy that make the company successful. When the concept or strategy has to stay confidential this indicates that there are no blocks to competitive entry, and if it can be copied by a competitor then it probably won’t be sustainable.

Proprietary technology, however, is confidential. Although the business plan does not want to mention aspects of the technology that are confidential, it should include details of what the benefits are and how they fulfill the need of customers. During the due diligence process, serious investors will review the technology itself, and this is when the NDA should be discussed.

business management tips

2. Excluding Thriving Firms from the Competitive Analysis

Although you may be tempted to show how unique you are in your business plan by saying you have very few competitors, this doesn’t normally look too good from the investor’s point of view. If there are not many companies in the market space then this suggests that there may not be a large enough customer base for the company’s products or services. Including successful firms can often be positive because it suggests a large market size, as well as assuring investors that the company has a large potential for profit and liquidity:

3. Focusing on First Mover Advantage

It is not a good argument to focus on first mover advantage alone. Rather, it is imperative that a business plan includes the strategies that show how the company will develop long lasting barriers around the customers.

The business plan should discuss how the company will retain customers, which could include building network externalities, value-added services over time and the implementation of customer relationship management tools.

4. Presenting Generic Market Sizes

If you define the size of the market too broadly, the value to the investor will be very low. Far more meaningful is the relevant market size, which is equal to the sales of the company if it managed to capture a large % of its niche in the market.

5. Giving too Much Attention to Proprietary Technology

Proprietary technology is important when it comes to investment decisions, but what is more important is to display how this technology satisfies a large and as-yet-unfulfilled customer need. Unsuccessful companies often fail to truly understand the needs of their customers. Identifying the target markets that show these needs and detailing a plan to penetrate the markets is key to the success of funding and execution.

6. Exaggerating Partnerships with Known Companies

Even though forming partnerships is common practice, more important than who a partnership is with are the terms of the partnership. The equitable terms of the partnership must be explained in the business plan, along with the partnership structure and how the partners will both improve operations and sales for you.

7. Too Much Focus on the Future

Rather than just focus on projections of future performance, it is far more important to study the previous track record of a company. Demonstrating the past success of a company is a good practice for providing investors with confidence for the future, and it is therefore important for a business plan to show the company’s previous accomplishments.

8. Failing to Change the CVs of the Management Team to the Ventures Development Cycle

CVs of the key members of the management team should be included in the business plan, along with their responsibilities. These need to be tailored specifically to the growth stage of the company because different skills are required for launching, growing and maintaining a company. Whereas a start-up company would do better to focus on the success of the management in launching other companies, a mature company would get more from showing how members of the team operated successfully within larger enterprise frameworks.

9. Aggressive Financial Projections

The projections in the financial section of the business plan have to be realistic because many investors will go straight to this section. If a plan shows unrealistic or inconsistent operating margin and penetration then this will damage the credibility of the whole plan. Instead, accurate and credible projections and assumptions will translate into increased credibility and maturity. Companies can prove that their projections and assumptions are attainable by basing these projections on the performance of public companies in their marketplace.

10. Ignoring Fraud Prevention System

Whether you are 100% confident about the loyalty of your employees still you need to put a proper and effective fraud prevention and fraud detection system to curb any fraud losses. One can see in history that most of the time loyal employees and relatives have been found indulged in the frauds and scams which results in a huge loss to the enterprises. Even some CEOs, loyal employees and close persons have committed such financial crimes in many companies and organizations. By putting a proper fraud detection and fraud prevention system enterprises can save millions and billions.

If you are following these steps then definitely it is going to help you in raising capital for your business, but just remember these facts which i have mentioned above, as many entrepreneurs know everything but do not stick to the plan.

Bill Trueman is payments, fraud & risk specialist and director of the UKFraud and RiskSkill based in UK which provide valuable consultancy services for fraud prevention, fraud detection, risk review, risk management, due diligence, compliance solutions to corporates, banks, business, banks, insurance companies, telecom companies, enterprises and government organizations worldwide. Bill Trueman is also an active member of AIRFA a global fraud & risk management organization. One can also visit him at Google+

Other Posts Which You Would Also Find Useful:

What is Risk Management? A Detailed Guide

25 FAQs on Risk Review, Risk Management, Compliance, Due Diligence

Is EMV ‘A Colossal Waste of Time’ for Retailers?

Riskskill Appointed by Visa Inc. as an Approved GARS Reviewer

11 FAQs on EMV Chip & Pin Card Technology

Top Technology Trends in Payments, Risk and Fraud

 

Two Key Fraud Organisations Support Charity Commission Proposals

UKFraud and Welfare Reform Group join forces in full agreement and support of the Cabinet Office consultation to propose greater powers for the Charity Commission that, in the cases of abuse of charities would effectively allow it to seize assets, replace trustees and/or put in managers to take over and to strengthen its ability to prosecute.

Many will have assumed that these powers would already have been in place given the size of the abuse of the problems and the £millions that get diverted by dishonest charities and errant charity trustees; and no-one would disagree that the money raised by charities should always reach the recipients that the money was intended for.

UKFraud and the Welfare Reform Group also strongly believe that the reforms should be extended to incorporate thinking that would support preventative measures too, as the focus on these proposals only cover the ways in which the Charity Commission should deal with abuse when it is discovered.

To deter and prevent fraud, consideration must also be given to requiring charities to provide full details on all key publicity, web-sites, documentation, correspondences and collection boxes that includes:

  • Fund-raising size of the charity
  • The percentage (or pence in the £) spent on charity staff salaries and expenses
  • The Percentage (or pence in the £) delivered directly in the hands of the intended recipients.

…. and then that these details would become a principle part of the auditing by the Charity Commission for accuracy.

Controls over the appointment of, duties required of and remuneration arrangements for all trustees, senior management and donation handling should also be key parts of an abuse-control regime.

Malcolm Gardner of the Welfare Reform Club said “Donations to charities are often made by people who have little to give themselves.  It is wrong that money given in good faith should end up funding lavish lifestyles for the greedy or to be lost through poor management, regardless of how noble the intentions.  It is important that charities and not-for-profit organisation are properly policed and regulated by a strong and focused Charities Commission.”

business & corporate risk review and mangement consultancy

Bill Trueman emphasised: “It is important that the Cabinet Office should strive to implement more and more preventative and deterrent measures against fraud attacks, in addition to their favoured tactical reactive/audit measures.” For more information on fraud prevention and detection strategies visit http://www.ukfraud.co.uk/

UKFraud Mobile Payment SIG Urges Greater Stakeholder Collaboration

business3

Leading corporate risk prevention consultancy and analyst UKFraud (www.ukfraud.co.uk) has released an interim update on their on-going research and market analysis of mobile payments and related mobile initiatives. The findings follow an earlier warning to stakeholders about a ‘cocktail of emerging risks’ as a consequence of rapid growth in the global mobile payments market. Key findings of the interim report are as follows:

The marketplace and market activities continue to be exceptionally fast-moving as regular announcements from many parties herald major changes in available offerings, applications and technologies. These are becoming increasingly complex in a crowded market. New entities join the melee all the time, trying to stake their claim and demonstrate their role in the mobile payments process.

Few of the companies or stakeholders appearing in any one part of the market have a comprehensive view of the whole market (e.g. web developers trying to become payment gateways).

People think, write and discuss this market only in the relative terms of today’s marketplace and as such they are generally constrained by traditional payment models. This ensures that what they write is often out of date reasonably quickly.

Nomenclature is a problem. When industry pundits and stakeholders talk about “mobile wallets”, this can mean many things to different people. Areas can include: Web applications and in particular web-payments, Near Field Communications, online banking services and device loaded payment solutions. However, the term also encompasses ‘ticket’ repositories, loyalty voucher storage, password vaults, club membership passes and password encryption.

The definition of a ‘wallet’ is likely to change too. Initially, stakeholders have thought about a ‘wallet’ solely as a money repository. We should think about it more as somewhere where we put all those other personal items like tickets, coupons, vouchers, payment details and log-on credentials. The market should be  talking not about electronic wallets but about the  new ‘bigger thinking’ i.e. caring about our ‘handbag’ or ‘briefcase’, which might also contain other essential possessions, e.g. a wallet, ticketholder and list of passwords as well as a wide assortment of the other things that we collect and store there.

Technology advances and tech start-up innovations have led to a surge of many innovative products and services for consumers to keep abreast of and surveys show that people are confused. So how do these things all work, and how can they be integrated? Innovation and advances are positive and people are ever-chasing‘first-mover advantage’ – without the tools to deliver sustainable and secure solutions.

But this means that many will fail. They will not meet the challenges of scale, or develop a critical mass in terms of profitability or market presence. Most will be at risk of major fraud attacks as they grow. The legal or other losses could be overbearing once they start to attract the attention of criminals, regulators and other parties that raise the need for payment system compliance enforcement.

Noting the element of competition that exists and despite the flurry of activity to date, there still appears to be a distinct lack of broader collaboration, coordination and vision for where the market is or will be going.

Conversely, larger organisations and participants may have the market and brand presence, the necessary infrastructure and technology platforms, etc., but they suffer from the constraints of their own size and governance. Such players are typically more deliberate and laboured in their innovation development process. Where they are large payment organisations, for example, they often have a reputation to protect and secure infrastructure to maintain, upon which their reputation is founded.

They are typically more aware of risk management concerns plus the implications of regulatory input and feedback on their proposition. Consequently, these participants are unable to move as fast as they would like or as others would expect.

So, for both existing and for new participants in this market, as well as competing, they also need to think about how their product fits into the wider market and customer needs. Whilst speed to market is important, they need to achieve this with a robust, secure, future-proofed product or service. This should use today’s technology but that which is both business-proof, and commercially viable. This is difficult for any one organisation to achieve in isolation of others. The answer lies in collaboration and also in setting appropriate shared standards and governance.

Authentication of an ‘extended’ identity,  including that of devices, will be one of the single most important factors in the evolution of solutions, products and the global direction of standards.

Kevin Smith, Chair of UKFraud’s Mobile Payments & Wallet SIG reports on the state of evolution taking place in the marketplace and key findings. In his view, “There needs to be room for innovation and competition in payment systems, to ensure that the evolution of these new technologies and business-models is combined in ‘life-managing’ value-add solutions.  To be truly effective, this requires sector wide collaboration.

“The technologies, applications and solutions consist of many more components than suppliers can handle; and the solutions that are being evolved often miss the security and risk infrastructures required. Particular areas of weakness include: AML checks on identities and refer-listings, controls over and monitoring of hardware validation and the business being undertaken. Security of the software and the data transmitted is another area that requires greater focus. As the market is growing so rapidly the SIG is concerned that controls and proper infrastructure is often inadequate.”

The SIG sees the on-going challenge as putting in place the basics of proper checking, standards procedures, processes and highlighting the infrastructures needed. It also sees a requirement for setting base security thinking in place; to prevent the inevitable ‘crash’or a series of likely expensive regressions. This will prevent:

Different systems, standards and ‘languages’ that evolve needing to be merged

Big losses from criminal attacks

Abuse of systems for illegal and disreputable activity

Major failings of all of those parties who invest in the ‘wrong direction’

Adverse brand damage for key participants and stakeholders.

Commenting on the findings Bill Trueman CEO of UKFraud commented; “Every boardroom is confused about where this market is going and how to act and direct its efforts. This is because it is so clear that this will be the global future for consumers and suppliers. The big challenge is how to be successful as the landscape changes globally.

“Companies of all sizes face concerns. Many major corporates with strong security and infrastructure are worried that they can’t adapt to the future just as the thousands of smaller entities are trying to ‘create a solution or market’ with only a small piece of the jig-saw and none of the infrastructure or security or standards based upon interoperability required.

“There is no crystal ball for anyone to rely upon and there is still a tremendous amount of bravado with people developing new and ‘sexy’ solutions that will probably not work. Typically there are the 90% that will fail and the 10% that might be successful. The simple truth, from the SIG’s findings, is therefore that those that collaborate will be better positioned for success.”

About UKFraud (www.ukfraud.co.uk)
UKFraud is a leading UK based consultancy, with an impressive international track record of eliminating the risk of fraud. Its founder Bill Trueman is widely accepted as one of Europe’s leading fraud experts and a frequent commentator and writer on the issues involved. Trueman has extensive experience of the banking, insurance and the financial services sectors and is a thought leader at the forefront of many industry wide and international debates.

News Source

UKFraud Seeks To Reduce Mobile Wallet Payment Risks

Following the recent launch of its mobile wallet consultancy practice, risk and fraud prevention consultancy UKFraud (www.ukfraud.co.uk) has launched a range of analytical, consultancy and advisory services aimed at helping businesses in the mobile commerce and payment solutions space to ensure that their products are ‘right’ before they hit the market.

The consultancy practice was established to provide strategic advice and direction to protect mobile solution providers from creating new payment architecture solutions with insufficient protection from data breaches and other risks.  In addition, the new services offered by the practice are designed to deliver a comprehensive  assessment of new wallet product strategies. In particular, the UKFraud services will ensure that wallet providers incorporate the right customer ID and authentication technologies and processes.

In advising producers of future wallet type products, the practice’s services draw upon the research, findings and in-depth analysis of the market by UKFraud’s own Mobile Payment Special Interest Group (SIG). In its findings, the SIG recognised the need for all financial product stakeholders to develop risk reduction strategies capable of matching the projected rapid growth of the global mobile payments sector over the next eighteen months.

The launch of the new range of services  reflects a significant increase in the development and appearance of a range of wallet type products in the market. These include a number of recent, positive and influential developments, such as those from Google with their Wallet, mPowa, Skrill, and Apple with the launch of its well-received iPhone 5S with integral fingerprint reader.

The UKFraud practice also advise on a broad range of devices, architectures and platforms including smartphones, tablets and app software along with the likely fraud risks of transporting mediums such as the internet and/or mobile carriers, including NFC, Bluetooth or Wi-Fi, and entry into traditional payment gateways.

A key element of this advice is in the areas of ID and authentication. There are a number of different forms of ID and authentication techniques that wallet products can use.  These  combine traditional physical processes and technology checks with increasingly more contemporary ones such as biometrics. UKFraud aims to ensure that all elements of these technologies and processes are developed or evolved to be ‘user-proof’ as well as ‘fraudster-proof’. Key elements of a proper wallet infrastructure should include:

1. Authentication of user identity.
Someone, somewhere must always be able to verify the identity of the individual who owns the device, or at least to have protection against possible identity theft attack in the future. This is as true for any such form of identification, whether it is through a traditional approach or through evolving biometric checks. Currently there are few consistent standards in the methods with which a user’s bank account, payment preferences, or even credit history is  tied into biometric records in order to gain access to such details. This area is especially significant, as there are serious existing layers of legal requirements for identifying customers for all money transmission providers who have to meet Money Laundering, Drug Trafficking and Prevention of Terrorism compliance standards. Future Wallet providers cannot be exempt here if they are involved in the creation or handling of financial ‘events’. Thus the authentication of IDs to meet these current standards must accompany all biometrics validation tools and not be replaced by them. For this reason there must be careful planning to ensure that new identification methods are founded on strong foundations.

2. Validation of the technology architecture.
Emphasis also needs to be placed on any secure repository for the data collected. This includes analysis of where the data is securely held and how accessible such repositories are to others and just how well encrypted the data is. However, equally all transmissions that contain sensitive data need to be ‘looked after’ and protected over time. In addition, the processes, technologies, validation of identity and the transmission of sensitive data must all be based upon a technology and process base that is globally useable, acceptable and safe. UKFraud feels that this explains why so many organisations are baulking at the prospect of taking action in a non-standardised direction which risks everything.

3. Interoperability
As so many solutions are still evolving, ‘wallet events’ especially those where payment occurs, can be very different in nature. Equally where any biometrics or codes and/or passwords are used and transmitted this must also be stored somewhere in the ‘wallet’, in a device or in a cloud based solution. This is a point of risk and the potential target for attack. Further, there is  also other personal user identity data such as  entry tickets, vouchers, discount codes, club memberships, allegiances, contacts and diaries that the market has have not yet contemplated storing electronically on the mobile ‘wallet’.   This all needs to be compatible or interoperable. This interoperability often needs to be global too. The only global operability standards today rest with the major Card Scheme payment solutions which are globally linked, and completely standardised, by virtue of the authentications and controls that have evolved over decades. These are also safe and robust when dealing with criminal attacks and failures.

4. Transferability
Taking it a step further; consumers will most likely require the ability to change ‘wallet’ or data solution provider, so that we can have everything that we need still available to us when our ‘device’ breaks or changes. This facility needs to be built into the wallet and UKFraud will question whether  the new and innovative solutions they examine  follow the same or common standards that enable customers to move their funds, data and information from one provider to another with ease.

5. Reliability
A challenge that some biometric authentication has traditionally had, in addition to the commercial rollout realisation, is how well it actually works. Some of these technologies, through lack of global standards and specifications, have on occasion been the subject of perceptual concerns about some of the systems’ reliability in storing and validating data against biometric records as a consistent form of identity.

UKFraud believes that it is essential that the issues of what is stored, along with where and how it is stored need to be governed well. This includes a wide range of issues around what the fall-back is – i.e. what happens when users get locked out of their smartphones for instance – and where the data is stored and how recoverable / retrievable is it?

According to Bill Trueman the CEO of UKFraud, “Our clients understand these practical ID and authentication issues as part of their ‘wallet’ designs, and we assist them in closing gaps and weaknesses. Once these are ironed out, they can plan for the future in what is a fast and growing market filled with uncertainty and challenge. It is inevitable that many of the growing businesses in this area will fail simply because of criminal attacks or because the consumer, the merchant, the supplier or market simply ‘goes in a completely different direction’. Future-proofing is a prudent course of action and one which UKFraud helps with but of course no-one has a crystal-ball.

“As there are already so many new technology developments in mobile payments and m-commerce in general, we still haven’t seen a ‘full-on’ response from some of the main traditional ‘payment’ organisations yet. Equally, outside of  the excellent steps being taken by the European Payments Council, there is not enough heard from governments and regulators relating to governance of the sector, controls and requirements for eMoney, enforcement direction or  strengthening of the Money Laundering requirements to cover the sector. We are confident though that The European Payments Council will take a strong lead here soon.

“Fortunately, the recent launches by sector leaders such as Google and Apple have had extremely positive impact and have influenced the market greatly for the better. Our aim in recognising both the beneficial impact of recent market developments and the prospect of announcements from Europe will help other organisations navigate the best route forward for their products, thereby helping them reduce the risks of their own solutions within the broader mobile solutions and mobile ‘wallet’ space.”

News Source

UKFraud Launches New Mobile Wallet Consultancy Practice

Against a backdrop of recent developments in the mobile wallet and mobile payment device technology sectors, risk and fraud prevention specialist UKFraud (www.ukfraud.co.uk) has launched a new mobile wallet consultancy practice. The move reflects recent positive and influential developments from Google with their Wallet and more recently from Apple with the launch of its latest iPhone with an integral fingerprint reader. The announcement also reflects the in-depth analysis of the market by UKFraud’s own Mobile Payment Special Interest Group (SIG), which has recognised the need for all financial product stakeholders to develop risk reduction strategies capable of matching the projected rapid growth of the global mobile payments sector over the next eighteen months.

The new consultancy practice will provide strategic advice and direction to a wide range of mobile payment sector organisations that aim to reduce the risk of moving their products and services to an emerging wallet architecture. This could apply to new devices (including phones, PDAs and tablets), software (including Apps and browsers) and most importantly to the authentication systems that are to be considered, validated and used. The consultancy also advises on the fraud risks of transporting mediums such as the internet and/or mobile carriers, including NFC, Bluetooth or Wi-Fi. The service will also aim to ensure that money and time invested is not wasted by developing superfluous wallet based products that will not ‘fly’.

Kevin Smith, the Chair of UKFraud’s Mobile Payment SIG, can see a role for the provision of detailed guidance to mobile wallet and mobile payment organisations whilst key sector bodies grapple with how the markets need European wide codes of practice. In his view, “The European Payments Council is just one leading body that is working hard and well to evolve a common understanding and nomenclature for this complex and fast changing  environment. We are keen to see both their vision and the on-going fruits of their labour. However, in the meantime, the global mobile payment market and other key stakeholders have recently been influenced in a very positive and promising way by a series technological launches by market leaders such as Apple, Google and locally by mpowa.

“Those who choose to hone their products around these technologies need urgently now to ensure that there are clear technical rules and constraints, understandable principles and frameworks around what they develop. This includes the related requirements of authentication, reliability, interoperability and transferability. There is therefore clearly a role for advisors to deliver defining guidance to such organisations as how they can minimise the risks involved to both their organisations and their customers. This guidance should also point to the likelihood of emerging standards both at a European and indeed global level.”

Bill Trueman, CEO of UKFraud acknowledged Kevin Smith‘s view and commenting on the launch of the new practice added, “There are already so many new technology developments in mobile payments and we still haven’t heard from many of the main traditional players yet, probably because they are still gathering their thoughts or formulating business cases. Fortunately, the recent launches by sector leaders such as Google, PayPal and Apple have had an extremely positive impact and have influenced the market greatly for the better. Our aim in recognising both the beneficial impact of these recent developments and the prospect of announcements from Europe is to help organisations navigate the best route forward for their products and to help them reduce the risks of their own solutions within the broader mobile wallet ‘space’. Consequently, we hope to make a number of major announcements shortly regarding the specific areas of help related to particular mobile wallet and payment device products and propositions.”

News Source