Risky Business: Detecting RDC Deposit Fraud Today and Tomorrow

Digiliti Money, Inc.
Hunter Wolfe
Senior Vice President of
Service Delivery
Thank you for logging into today’s event. Please note we are in standby mode. All Microphones will be muted
until the event starts. We will be back with speaker instructions @ 2:55pm. Any Questions? Please email:
info@theknowledegroup.org
Group Registration Policy
Please note ALL participants must be registered or they will not be able to access the event.
If you have more than one person from your company attending, you must fill out the group registration form.
We reserve the right to disconnect any unauthorized users from this event and to deny violators admission to
future events.
To obtain a group registration please send a note to info@theknowledgegroup.org or call 646.202.9344.
Advanced Fraud Solutions
Jordan Bothwell
Business Development
Manager
Kaufman Rossin
Alejandro Mijares, CISA,
CRISC, MSMIS
Risk Advisory Services (RAS)
Manager
Risky Business:
Detecting RDC Deposit Fraud
Today and Tomorrow
June 22, 2017
1
UMACHA
Jen Wasmund
Vice President of Education
& Compliance
theknowledgegroup.orgKnow. Lead. Succeed

Risky Business:
in 2017 and BeyondSponsor Firm:
June 22, 2017
2
Digiliti Money, Inc. is a leading cloud-based, SaaS technology provider serving the financial
services industry with mobile money and remote deposit capture solutions for PC, Mac and
mobile. Founded in 2010, Digiliti Money has quickly grown into a technology leader and trusted
partner of some of the world’s largest and most respected financial organizations. With
remarkable growth, an impressive client base and award-winning technologies, Digiliti Money
continues to drive innovation and deliver world-class solutions to financial institutions of all
sizes.

Risky Business:
in 2017 and BeyondPartner Firm:
Advanced Fraud Solutions' mission is to help financial institutions prevent check deposit,
plastic card, and online banking fraud by utilizing a combination of their intuitive web-based
software solutions at the frontline and back office. On a daily basis, Advanced Fraud Solutions'
innovative fraud prevention tools help financial institutions of all sizes throughout the country
eliminate losses and safeguard their financial assets, providing the level of protection that end-
customers demand. At Advanced Fraud Solutions, they believe the best way to fight fraud is to
prevent it. For more information, please visit: www.advancedfraudsolutions.com
June 22, 2017
3theknowledgegroup.orgKnow. Lead. Succeed

Kaufman Rossin has represented Florida businesses for more than 50 years and serves
international clients in dozens of countries. The CPA and advisory firm is one of the largest in
the U.S., providing traditional accounting, audit and tax services, as well as business, risk and
forensic advisory services. The firm has won significant awards, including repeat honors as the
Best Accounting Firm to Work For among large firms nationwide and locally. With more than
300 team members, the firm prides itself on offering the resources of a powerhouse, personally
delivered. Go beyond the numbers at kaufmanrossin.com.
Risky Business:
in 2017 and BeyondPartner Firms:
UMACHA (Upper Midwest Automated Clearing House Association) is known for its extensive
knowledge base, high quality services, as well as its national presence in the payments
industry. UMACHA represents its members in the national market through participation in, and
through its membership in the National Automated Clearing House Association (NACHA) and
the Electronic Check Clearing House Association (ECCHO).
June 22, 2017
4theknowledgegroup.orgKnow. Lead. Succeed

Hunter is senior vice president of Service Delivery for Digiliti Money where he oversees
mobile technology Implementations for banks, credit unions and other financial services
organizations. He has more than 20 years’ experience in the financial services industry
facilitating development and implementation of complex technology and software
projects that increase operational efficiencies, customer satisfaction and revenues.
Brief Speaker Bios:
Jordan joined AFS in 2012, and is responsible for business growth and account
management in the western half of the U.S. In her time with AFS, the company has
grown from 300 clients in 30 states to over 550 across the U.S. With that growth,
Jordan has seen the fraud market evolve and expand, and has shaped the
corresponding new product lines to address these different fraud avenues. This
evolution has shone both a regional and national spotlight on Advanced Fraud
Solutions, recognized as one of “The Fastest Growing Private Companies in America”
and “Top 100 Financial Services Companies in the United States” by Inc. Magazine.
Hunter Wolfe
Senior Vice President of Service
Delivery
Jordan Bothwell
Business Development Manager
June 22, 2017
5
Risky Business:
in 2017 and Beyond

Alejandro Mijares is Risk Advisory Services Manager at Kaufman Rossin where he provides
internal IT audit, system validation, and information security review services to financial
institutions supervised by the FDIC, FRB, State of Florida, and OCC. He has performed IT
and Cybersecurity risk assessments, IT controls reviews, and evaluation of IT governance
regulations and processes for more than 25 banks and foreign agencies in Florida.
Alejandro’s work experience also includes analyzing and evaluating information technology
security risks and internal controls, process mapping, system validation, SSAE 16 review
services, and providing Sarbanes-Oxley external and internal audits for clients in a variety of
industries, including financial services companies, healthcare, retail and technology.
Brief Speaker Bios:
Jen joined UMACHA in March 2012 and has conducted hundreds of ACH Audits, Risk
Assessments and RDC Risk Assessments. She is also a nationally recognized speaker on
electronic payments topics. Her current role as Vice President of Education and
Compliance is to develop the strategy for UMACHA’s Compliance and Education Services
programs. Jen is a graduate of the Olin School of Business at Washington University in St.
Louis. Prior to joining UMACHA, Jen managed the operations and compliance for ACH
origination, remote deposit capture, electronic banking and debit card programs at a
community bank. Jen currently holds the AAP, CTP and NCP certifications.
Kaufman Rossin
Alejandro Mijares, CISA, CRISC,
MSMIS
Manager
UMACHA
Jen Wasmund
Vice President of Education &
Compliance
theknowledgegroup.orgKnow. Lead. SucceedJune 22, 2017
6
Risky Business:
in 2017 and Beyond

As mobile banking continues to rise, so do more sophisticated fraud attempts using mobile banking the channel. In fact, a 2016
industry analysis across 400 financial institutions found 72% of mobile banking fraud included use of RDC and fraudulent checks.
What can FIs do to further mitigate risk for fraud and other attacks using mobile RDC? Innovative advances in risk mitigation can
better detect fraudsters of today and tomorrow—and help FIs reduce overall loss.
Key objectives with this webinar:
• Understand 5 key fraud trends to watch for in 2017 and beyond.
• Learn new technologies and approaches to fraud that reduce exposure for financial institutions.
• Best practices in RDC risk management
7
Risky Business:
in 2017 and Beyond

Agenda
• mRDC rise and fraud landscape (current usages of mRDC—popularity with specific demographics, popular features; research
around increase with RDC fraud)
• 5 key trends with fraud for banks to watch for (including duplicate presentments, scams, altered items)
• New technologies and approaches to fraud that reduce exposure for financial institutions (including smart limits, endorsement
analytics, etc.)
8
Risky Business:
in 2017 and Beyond
SEGMENT 1:
Hunter Wolfe
Senior Vice President of Service Delivery
SEGMENT 1:
Jordan Bothwell

Mobile Banking on Rise
• 5.6 billion—# of mobile subscribers by 2019
• 70% of world’s population
• 2 billion—# of mobile banking users by 2020
• Currently 1 billion
• 53%—smartphone users that have used
mobile banking in last 12 months
67%
58%
34%
18%
18-29 Yrs 30-34 Yrs 45-59 Yrs 60+ Yrs
Use of mobile banking in
past 12 months by age
Sources: “The Rise in Mobile Banking and the Fraud that Comes with It,” Advanced Fraud Solutions; “Mobile Banking Fraud Trends: Fraudulent Checks Meet Remote Deposit Capture,” Guardian Analytics; “Consumers and Mobile Financial
Services 2016,” Board of Governors of the Federal Reserve System

Popular Mobile Banking Features
• 70%—mobile banking users that are highly
active, checking accounts multiple times per
week
• 31% of those highly active users checked
accounts at least once per day
• 97%—Financial institutions (FIs) supporting
mobile deposit in 2016
87%
77%
73%
Displaying user
deposit limits
Reviewing check
images
Displaying funds
availability
Additional mobile banking features
supported by FIs
Sources: “The Rise in Mobile Banking and the Fraud that Comes with It,” Advanced Fraud Solutions; “2016 Mobile Banking Financial Institution Scorecard: Mobile Becomes the Remote Control for Banking,” Javelin

Mobile Transaction Volume to Skyrocket
• 46%—consumers using only digital channels for
banking, up from 27% four years ago
• 41.7%—increase in mobile payment
transaction volume 2015-2020
• IBM recently launched mainframe built to
handle transaction volume mobile devices will
bring to market in next 5 years.
• 2.5 billion transactions per day, or 30,000 per second
$
Sources: “The Financial Brand,” PwC; “Global Mobile Payment Transaction Market to Increase at a CAGR Of 39.1% through 2020 and Reach US$ 2.89 Trillion in Revenues,” Persistence Market Research; “The Rise in Mobile Banking and the
Fraud that Comes with It,” Advanced Fraud Solutions

Rise in Transactions ≠ Rise in Analysts
• For most institutions, a rise in transaction counts has not provided a rise in analysts
to review these transactions for fraud, which means:
• Employees spread thin: staff members split duties between card fraud, online banking fraud,
and loan fraud
• Small value transactions not reviewed: typically only higher dollar value transactions get
reviewed due to resource and staff time required
• Burden of proof is more difficult: institution to prove reasonable doubt to place hold, and it’s
nearly impossible to prove without review

Increased Mobile Banking, Increased Fraud
• 72%—mobile banking fraud included RDC
and fraudulent checks
• 400%—increase in financial institutions
suffering losses from RDC activity from
2012-2014
• From 2014-2015, there was an additional
400% increase in impacted institutions
• 90%—FIs who offer mRDC that say
benefits outweigh risks
Financial institutions reporting attempted
check fraud using RDC
50%
90%
100%
Community and mid-
size banks
Regional banks Superregional
Staying vigilant about fraud is essential to account holder retention–research shows consumers are more
likely to move their money elsewhere within six months of a fraud incident
Sources: “The Rise in Mobile Banking and the Fraud that Comes with It,” Advanced Fraud Solutions; “Mobile Banking Fraud Trends: Fraudulent Checks Meet Remote Deposit Capture,” Guardian Analytics

5 Key Fraud Trends to Watch For

Fraud Trend: Duplicate Presentments
• 5-7—# of duplicates per 1M items from RDC that banks expected in 2006
• 40-100—# of duplicates per 1M payments processed actually intercepted by
high-volume banks today
• Impact of duplicate presentment
• To consumer: return check fees, spending money that is erroneously deposited in their
account, perception of institution’s capability
• To institution: employee resources spent tracking down consumer, money and check
Source: “Why Banks Must Find Dupes Sooner,” Digital Transactions

Fraud Trend: Altered Items
• Altered items are still a source of significant fraud today, and are a threat in
mobile deposit channel
• Washed checks – Payee names and amounts
• MICR alteration – Account information
• Duplicate detection avoidance – Check number

Fraud Trend: Biometrics
• Analysts predict 50% of smartphones will have
fingerprint sensors by 2019
• Different modes of biometric authentication that
institutions can adopt include fingerprint, voice,
retina, heartbeat, facial recognition, etc.
• Biometrics believed to be more safe, unless
secondary authentication defaults
• Passwords and pins then come into play
• 47% of consumers use a password that is 5+ years
old
• 77% use password that is 1+ years old
Sources: “Fingerprint Sensors Market in Smart Mobile Devices” Research and Markets; Balancing Security & Customer Experience,” Iovation

Fraud Trend: Scams
• Scams = social engineering of victim and/or account takeover against which classical
forms of authentication and newer forms of static biometrics are defenseless
• Wells Fargo example: James Simmons selling scooter for $675
• Sweetheart scam
Source: “Remote Deposit Capture Increasing Mobile Banking Fraud,” Guardian Analytics

Fraud Trend: KYC
• As risk mitigation and monitoring has shifted from “Know Your Data” (KYD) to
“Know Your Customer” (KYC), fraudsters are learning how to exploit mobile
channels
• Fraudulent or altered identification
• Exploiting automation

New Approaches to Reduce Fraud Exposure
Security Customer
Experience

13 Best Practices to Detect Fraud
1. Automation—Have a tool or product to analyze transaction data for risk and fraud,
eliminating need for manual review of every item
2. Real-time Visibility—Time is money…the sooner an item is reviewed, the sooner
accurate holds can be placed and the less time a fraudster has to siphon out
money
1. Collaborative Data—Communicate with other institutions, locally and across the
country, to identify trends and curb damage from fraud and duplicate
presentment. Tie in to regional and national databases for account and check
information to mitigate the risk of accepting fraudulent or duplicate items.

4. Cross-channel Review—Look across all points of deposit in the institution for trends
and similar scenarios
4. Predictive Analytics—Could help predict probability of account abuse, duplicate
deposit or other forms of fraud
1. Consumer Education—Equip account holders with best practices, “dos and don’ts” in
check deposit and fraud world

6. Smart Limits—Create based on attributes such as account tenure, risk score or
account type
7. In-app Verification of Transactions—Remind mobile users at login of most
recent access and activity is quick way to help customers detect unauthorized
access

8. Policy Rules—Flag leading indicators of account abuse or blocking money
order deposits
9. Mobile Authentication—Authenticate customer, device and account at carrier
level, monitor for changes in device/account owner information

10. Business Intelligence—Ensure necessary tracking, measurement and reporting
processes in place
10. Endorsement Analytics—Endorsement detection, restrictive endorsement
policy and utilization of restrictive endorsement feature in mobile deposit
11. Test and Learn—Test tailored limits and funds availability modifications

Findings from the field
• Funds availability and the impact of agreements
• Regulatory coverage
• Current environment
• Changes effective July 1, 2018
• Why does funds availability matter?
• Returns
• Adjustments
26
Risky Business:
in 2017 and Beyond
SEGMENT 2:
Jen Wasmund
Compliance
UMACHA

• Limits
• Corporate capture
• Mobile capture
• Sound business practices
• What to do – a success story
• What to avoid if you can
27
Risky Business:
in 2017 and Beyond
SEGMENT 2:
Jen Wasmund
Compliance
UMACHA

• Dealing with duplicates
• Operational considerations
• Monitoring and reporting
• Forthcoming changes to Regulation CC
• Agreements and termination of users
28
Risky Business:
in 2017 and Beyond
SEGMENT 2:
Jen Wasmund
Compliance
UMACHA

• Strategic and operational controls
• Customer suitability and due diligence
• Reviews – reporting and monitoring
• Determination of product lines and ownership
• Vendor management and system controls
29
Risky Business:
in 2017 and Beyond
SEGMENT 2:
Jen Wasmund
Compliance
UMACHA

• Takeaways to prepare for your next exam
• Policies and procedures
• Agreements
• Reporting
30
Risky Business:
in 2017 and Beyond
SEGMENT 2:
Jen Wasmund
Compliance
UMACHA

Agenda
➢ FFIEC update (Management & RDC)
➢ RDC Risk Management
31
Risky Business:
in 2017 and Beyond
SEGMENT 3:
Alejandro Mijares, CISA,
CRISC, MSMIS
Manager
Kaufman Rossin

➢FFIEC Management Booklet - Updated in November 2015
✓ Refocus on IT/IS Risk
▪ Introduce Risk Management cycle:
• Identify
• Measure
• Mitigate
• Monitor & Report
Risky Business:
in 2017 and Beyond
FFIEC Retail Payment Systems
32

➢Risk Management of Remote Deposit Capture - January 2009
➢FFIEC Retail Payment Systems Booklet - Updated in April 2016
✓ RDC Guidance
✓ Examination procedures
✓ Appendix E: Mobile Financial Services
Risky Business:
in 2017 and Beyond
FFIEC Retail Payment Systems
33

34
Risky Business:
in 2017 and Beyond
Risk Measurement
https://www.ffiec.gov/pdf/pr011409_rdc_guidance.pdf

35
Risky Business:
in 2017 and Beyond
RDC Risk Management Cycle
Risk Identification
Risk Appetite/Risk Tolerance
Legal/Compliance/Oper./Reputational
Risk Measurement
Risk Assessment
Inherent/Residual Risk
Risk Monitoring & Reporting
Updates to the Board/Committee
Metrics
Risk Mitigation
Design/Effectiveness of control
Risk Management
Cycle

➢ Lack of appropriate Legal/Contractual Agreements
➢ Unauthorized access to technology systems and electronic data images
➢ Inability to maintain system compatibility with financial institution systems
➢ Ineffective controls over physical deposit handling and storage procedures
➢ Inadequate record retention programs, and exposure to money laundering and
fraud
➢ Customers with high volume of transactions
36
Risky Business:
in 2017 and Beyond
Risk Identification

Risky Business:
in 2017 and Beyond
Risk Measurement
Ref # Threats Category
Likelihood
Low = 1
Mod = 2
High = 3
Impact
Low = 1
Mod = 2
High = 3
Inherent Risk
Low = 1-3
Mod = 4-6
High = 7-9
Control
Environment
Assessment
Mitigating = 1.0-1.5
Moderately
Mitigating = 1.6-2.4
Deficient > 2.4
Residual Risk
Low = 1-3.9
Mod = 4-6.9
High = 7-9
1
Insider Threat (i.e Fraud such as changes to the MICR, physical
alteration of a deposited check, counterfeit, duplicate
presentment of checks, etc. )
3 3 9 2.0 4.4
2
Ineffective controls at the customer location (i.e. inadequate
separation of duties)
3 3 9 2.2 4.2
3 Unsecure third party service providers 2 3 6 2.0 3.0
4 Hardware/Software failures or errors (Faulty equipment) 2 3 6 2.0 2.9
5 Human Error or failure (Untrained/Careless Employees) 2 3 6 2.0 2.9
6 Missing, Inadequate, or incomplete policies & procedures 2 3 6 2.1 2.8
7 Inadequate training of customers and their employees 3 2 6 2.1 2.8
8 Environmental Hazard 2 3 6 2.2 2.8
9 Improper disposal of NPI (hardcopies, hardware) 2 3 6 2.3 2.6
10 Changes/Upgrades to RDC associated software/hardware 2 2 4 1.9 2.1
11 Unpatched Systems 2 2 4 2.1 1.9
37

Risky Business:
in 2017 and Beyond
Risk Measurement
38

➢ Risk Assessment on an annual basis
➢ Monetary and time limits (per client, per transaction, etc.)
➢ Multifactor authentication
➢ Logging of all transactions including attempts
➢ Due diligence for new and existing customers
➢ Onsite visits – customer training
Risky Business:
in 2017 and Beyond
Risk Mitigation
39

➢ Separation of duties
➢ Business Continuity Plan
➢ Ability to integrate with BSA/AML systems and procedures
➢ Duplicate item detection
➢ Limited access to change routing number, account number, amount
➢ ABA validation
Risky Business:
in 2017 and Beyond
Risk Mitigation
40

Risky Business:
in 2017 and Beyond
Risk Mitigation
41

➢ Report to the Board on an annual basis
➢ Metrics:
✓ Volume of transactions per customer, per month, etc.
✓ Velocity (spikes in volume, exceeding approved limits)
✓ Return rates for all customers
✓ Duplicate Presentment report
✓ Large item reports (transactions outside normal parameters)
Risky Business:
in 2017 and Beyond
Risk Monitoring & Reporting
42

Contact Info:
43
Risky Business:
in 2017 and Beyond
SEGMENT 1:
Hunter Wolfe
hwolfe@digilitimoney.com
(952) 698-2341
SEGMENT 1:
Jordan Bothwell
jbothwell@advancedfraudsolutions.com
(916) 293-3294
SEGMENT 3:
Alejandro Mijares, CISA, CRISC, MSMIS
Risk Advisory Services (RAS) Manager
Kaufman Rossin
amijares@kaufmanrossin.com
(305) 646-6084
SEGMENT 2:
Jen Wasmund
Vice President of Education & Compliance
UMACHA
jenniferw@umacha.org
(763) 201-9607

Q&A:
44
Risky Business:
in 2017 and Beyond
SEGMENT 1:
Hunter Wolfe
hwolfe@digilitimoney.com
(952) 698-2341
SEGMENT 1:
Jordan Bothwell
jbothwell@advancedfraudsolutions.com
(916) 293-3294
SEGMENT 3:
Alejandro Mijares, CISA, CRISC, MSMIS
Risk Advisory Services (RAS) Manager
Kaufman Rossin
amijares@kaufmanrossin.com
(305) 646-6084
SEGMENT 2:
Jen Wasmund
Vice President of Education & Compliance
UMACHA
jenniferw@umacha.org
(763) 201-9607
► You may ask a question at anytime throughout the presentation today. Simply click on the question mark icon located on the floating tool bar on the bottom right side of your screen.
Type your question in the box that appears and click send.
► Questions will be answered in the order they are received.

ABOUT THE KNOWLEDGE GROUP
The Knowledge Group is an organization that produces live webcasts which examine regulatory changes and their impacts across a variety of industries. “We bring
together the world's leading authorities and industry participants through informative two-hour webcasts to study the impact of changing regulations.”
If you would like to be informed of other upcoming events, please click here.
DISCLAIMER:
The Knowledge Group is producing this event for information purposes only. We do not intend to provide or offer business advice.
The contents of this event are based upon the opinions of our speakers. The Knowledge Group does not warrant their accuracy and completeness. The statements made
by them are based on their independent opinions and does not necessarily reflect that of The Knowledge Group‘s views.
In no event shall The Knowledge Group be liable to any person or business entity for any special, direct, indirect, punitive, incidental or consequential damages as a result
of any information gathered from this webcast.
Certain images and/or photos on this page are the copyrighted property of 123RF Limited, their Contributors or Licensed Partners and are being used with permission
under license. These images and/or photos may not be copied or downloaded without permission from 123RF Limited
45
Risky Business:
in 2017 and Beyond

Risky Business: Detecting RDC Deposit Fraud Today and Tomorrow

Recommended

Recommended

More Related Content

What's hot

What's hot (10)

Similar to Risky Business: Detecting RDC Deposit Fraud Today and Tomorrow

Similar to Risky Business: Detecting RDC Deposit Fraud Today and Tomorrow (20)

Recently uploaded

Recently uploaded (20)

Risky Business: Detecting RDC Deposit Fraud Today and Tomorrow