Driving Payments Security and Efficiency During COVID 19

Kyriba.com Copyright © 2020 Kyriba Corp. All rights reserved.
Driving Payments Security and
Efficiency during COVID-19

Today’s Agenda
1) What does fraud look like during the COVID-19 crisis
2) Emerging threats in payments fraud
3) Best practices to combat payment fraud
• Security practices – especially while working from home
• Workflow controls – standardizing how transactions are initiated,
approved, and transmitted to the bank(s)
• Payment screening – External sanctions lists and internal fraud
scenarios
Driving Payments Security and Efficiency during
COVID-19

Polling Question

What does Fraud look like during this
crisis?
4

Advances in technology and growing sensitivity to support flexible work-life
balance have changed perceptions and expectations about remote work
options for many employees and organizations
5
Statistics & Trends
• Over the last 5 years there has been
a 44% increase in remote work, and a
91% increase in the last 10
• Currently 3.6% or 5 million US
employees work at home at least half
the time
• Currently 43% of US employees work
remotely with some frequency
• Currently 80% of US employees want
to work form home at least some of
the time
Employee Sentiment Employer Breakdown
• 35% of employees would change
jobs for the opportunity to work
remotely full time (47% of millennials
and 31% of baby boomers)
• Flexibility is one of the highest
ranked benefits by millennials, above
student loan or tuition reimbursement
• More than 33% of workers would
take a pay cut of up to 5% in
exchange for the option to work
remotely at least some of the time,
25% would take a 10% pay cut
• US employers offering flexible
workplace options increased by 40%
over the last five years
• 69% of US employers offer remote
work on an ad hoc basis to at least
some employees
• Larger companies are most likely to
offer telecommuting options to most
of their employees
• Full-time employees are 4 times
more likely to have work-at-home
options than part-time workers

Research has shown us that this change in the modern workforce benefits
not only the employees but has substantial benefits for employers
6
Transactional relationship
EmployersEmployees
Remote workers make more and retain more of their salary
Achieve optimal work/life balance without sacrificing
productivity or career trajectory
Remote workers experience less job-related stress
Remote workers are more likely to be satisfied with their
job than the average American
Overall increase in productivity and quality of
employee work
Reduced overhead costs such as office space and supplies
Higher attraction and retention of top talent
Contrary to popular belief 85% of businesses confirm flexible
working options have increased productivity
Increased employee moral resulting in the increased
productivity and talent retention above
Ensures continuity of operations in the event of a disaster
(such as COVID-19)

Kyriba.com Copyright © 2020 Kyriba Corp. All rights reserved.7
These benefits do not come without risk, as organizations struggle to
combat the technical and security challenges introduced by remote
work
Using personal networks and devices
• Most workers will be in their homes where they are responsible to secure their wireless internet connection. Organizations have little control over how
remote workers configure their wireless networks, or what other devices could be connected to them.
• Some will have to use unsecured public networks which are prime spots for malicious parties to spy on internet traffic and collect confidential personal
and business-related information.
Lack of training and awareness
• In addition to the technical considerations, cybersecurity training and awareness-building initiatives are critical to reducing risk. Most notably, how to
keep work and personal activities as separate as possible.
• Organizations need to ensure employees know how to use the tools and technologies that support remote collaboration, as well as how to
recognize and prevent COVID-19 cyber threats, such as phishing, fraudulent emails, and phone calls offering tech support or posing as solicitations
from charities.
Phishing and other scams by bad actors
• The COVID-19 related spike in malicious phishing emails has seen cyber criminals using the pandemic to steal data and blackmail individuals for
money.
• Researchers found a 667% increase in phishing emails using the coronavirus as the hook to trick individuals into clicking links or downloading
attachments that included malware, ransomware, and viruses.
Using personal devices and applications
• Many workers are using personal devices for work tasks. These often lack the tools built into their organization’s approved devices such as strong
antivirus software, customized firewalls, and automatic online backup tools.
• This increases the risk of malware finding its way onto devices and both personal and work-related information being leaked.

8
Public Health
Government Checks
Business Emails
I.T. Support
Distraction & Deception
Bad actors impersonating the CDC or WHO asking for individuals
SSN, Tax IDs, or financial information
Impersonation of the IRS or other federal agencies
regarding the checks being sent to Americans
Fraudsters acting as the CEO or other executives, requesting
employees wire money or transfer funds to a fake account
An individual from IT is impersonated and requests an employee's business login
credentials or asks them to download malicious software
With more people working from home with increased distractions,
it makes it easier to fall victim to fraud
01
05
04
03
02
Top
COVID-19
Scam
Scenarios
More than ever, organizations must remain vigilant to protect
themselves, customers and employees from these targeted attacks

Emerging Threats in Payments Fraud
9

As a historically targeted area, Payment Fraud has seen an increase
given the recent increased shift to remote work
10
81%
Percent of companies
reported being targets
of payment fraud in
2019
80%
Percent of
organizations who
experienced
Business Email
Compromise (BEC)
in 2019
54%
Percent of
organizations
reporting financial
loss as a result of
BEC
64%
Percentage of
payment fraud
committed by an
individual outside the
organization
As of 4/7/2020 the FTC had received 13,372 complaints related to the
virus outbreak, with more than 7,500 of these being a direct result of
coronavirus fraud.
The COVID-19 work environment places business-specific
communications at high risk for BEC. As a result bad actors will
focus on those with high-value information or access to an
organizations money.
3
1
Victims have reported over $9.6 million in losses due to these COVID-
19 related scams.
2
COVID-19 and Payment Fraud

How can Finance protect themselves?
CFOs need to leverage their technologies as
proactive weapons against payment fraud
instead of reacting to breaches or passing the
security responsibilities to another business
unit.
Finance teams need to assume the cybersecurity
responsibilities for the payments function and its
technology. This will require working with IT to
develop best solutions and risk mitigation plans,
and assuming ownership of those newly
developed methodologies.
There is no substitute for educating employees
about payment fraud and other cyber risks they
and the company face, based on COVID-19
working environment.
11
Leveraging
Payments
Technologies
Collaboration &
Responsibility
Secure
Payments
Workforce
Education
1
3
2
1
3 2
A robust and secure payments function
utilizing its technology to its fullest
potential, collaborating with other
business units to produce the best
solutions, educating other employees
about the cybersecurity risks they
individually and the company face,
especially during these uncertain
times, and the end-to-end ownership of
the payments cybersecurity function.
Secure Payments

Best Practices to Combat Payments
Fraud
12

Information Security Practices
1) Embrace the cloud (your IT does)
2) Application security
3) Vendor security

2019 Kyriba Corp. All rights reserved. | Proprietary & Confidential
Embrace the Cloud
• IT favors the cloud as they know
that payments data and connectivity
can be safer when hosted externally
• But IT/Security has questions
because not all “clouds” are alike
when it comes to information
security
• Finance should align to information
security policies

Application Security
• UserID/Password by themselves should not grant access
to the system
• 81% of data breaches from stolen/weak passwords Source: Verizon DBIR
• Especially when working from home, your systems should
use a combination of password controls and encryption:
 Strong password policy controls
 Multi-factor authentication (hard or soft token)
 IP Filtering
 Single Sign-On
 Data encryption at rest and in transit

Vendor Security
The systems you use invest in safeguards to protect your data – but are
those safeguards good enough:
Typical questions to ask:
1) Are there detailed information security questionnaires (e.g. Cloud Security
Alliance or CSA)?
2) Does their governance & risk program follow an established standard (e.g.
ISO 27001)?
3) Frequent third party vendor risk assessments (e.g. penetration testing)?
4) What kind of Security Incident Event Management (SIEM) tools do they
have (e.g. Splunk)?
5) Does their RTO/RPO align to your needs?
6) Do they have a Network Operations Center?

Workflow Controls
1) Eliminate exceptions
2) Standardization
3) Consistency

• Exceptions to a standardized process opportunity
• Consistency is the key: standardize controls across all
payments, in all geographies, by all people, within all
payment systems
You Your banks
Payment
Initiation
Payment
Approval
Payment
Documentation
Payment
Transmission
Payment
Request
Defending against fraud: Standardize Controls

• Global Financial Services Firm – lost
$18M in payment fraud in less than a
week in a phishing scheme.
• Large Manufacturing Firm – lost
~$3M over 1 year in a drip campaign
• Tech Firm – released $1.2M wire
from Deepfake CFO impersonation
• Engineering firm – lost $31M over
several years due to internal wire
fraud
Fraud Examples: Breakdown of Controls

• Multiple ERPs with different approval processes
• Regional treasury/shared services require lesser
numbers of approval due to limited in-country
staff
• CEO and/or CFO have ability to execute or
influence payments with only one other approval
• Payments backup documents stored in a
different system than payment approvals
• Payment files can be opened and modified
• No automated detection for duplicate and
unusual payments
• Lack of real-time visibility into all payments
Scenarios that are ripe for payments fraud

Payment
Hub
ERP(s)
Document
Attachment
Single
Source of
Record
Automated
Confirmations
One Set
of
Approvals
Consistent
Security
Protocol
One Set of
Limits
Real-time
Visibility
Encrypted
Transfer
Banks
Consistency of Controls: Digitization helps

Payment Screening
1) Sanctions lists
2) Enforce payment policy
3) Detect payment anomalies

Payment Screening
• Screening payments is as much about
compliance with internal policies as it is about
preventing fraud
• OFAC, EU, UN – sanctions list screening is a
good start, but not the complete picture
 What finance really needs is the ability to
screen against custom scenarios – to construct
a digitized version of your payment policy

To detect fraud, finance must…
Payment Policy Screening Rule
Payments should only go to approved
suppliers in approved countries
All payments to non-approved countries must
be stopped
Payments initiated by A/P within the ERP are
only approved or rejected by finance
Any payments that are modified after import
must be stopped
Single or multiple payments to same
beneficiary must not exceed a specified limit
Hold for review any payments that
cumulatively exceed specified limit per
day/week/month
All payments to a newly modified bank
account must be reviewed by Treasurer
First payment to a new or modified bank
account must be held for review
Exceptional payments should be reviewed by
Controller
All payments with a standard deviation of x%
from typical payments of the same type must
be stopped for further review

Rules-based automation and machine learning to detect violations of
payment policy and detection of payment anomalies (from normal behavior)
Dashboards expedite the
review process
Screening Payments: enforce payment policy

In Conclusion….
Threats Have Increased
Threat of fraud has raised the bar for
finance to prove that fraud controls
meet internal compliance and risk
policies
Consistent Policies
Finance controls and procedures
need to be aligned with the
organization – exceptions are the
danger
Standardized Controls
Standardized payment workflows =
critical to combat fraud
Payment Screening
Payment policies must exist within
the workflow, automatically screened
in real-time

Thank You!

Driving Payments Security and Efficiency During COVID 19

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Driving Payments Security and Efficiency During COVID 19

Similar to Driving Payments Security and Efficiency During COVID 19 (20)

More from Kyriba Corporation

More from Kyriba Corporation (20)

Recently uploaded

Recently uploaded (20)

Driving Payments Security and Efficiency During COVID 19