Additional customer guidance should include: • Never provide usernames, passwords, PINs, tokens or one-time passcodes in response to an incoming call, email or text. • Do not click an online-banking link contained in an unsolicited message. • Access online banking through the bank’s official website or mobile application. • Hang up and call the bank using a known, independently verified telephone number. • Require dual control for ACH and wire activity. • Establish transaction and daily exposure limits that reflect the company’s actual needs. • Review new users, authorized devices and changes to account contact information. • Enable alerts for password changes, new-device enrollment and outgoing transactions. • Report suspicious communications immediately, even if no money appears to have left the account. Prompt reporting can help prevent or limit a loss. Customers should not wait until the next business day if they believe credentials or authentication codes have been disclosed. Banks Must Also Examine Their Own Procedures Customer education is only one part of the response. Banks should review how employees handle calls involving compromised credentials, new-device enrollment, changes to telephone numbers or email addresses and requests to add new treasury-management users. A fraudster who has compromised a customer’s email account may attempt to add a supposed new CFO or controller to the customer’s wire agreement. The request may come from the customer’s legitimate email address, but that does not establish that the request is authorized. Material changes to authorized users, callback numbers, transaction authority or security procedures should be independently verified with an existing authorized person using previously established contact information. Employees should not rely on the telephone number or contact information contained in the request being verified. The bank should also confirm that its written wire-transfer agreement clearly identifies: • Who is authorized to request wires • The predetermined telephone number to be used for callbacks • The PIN or passcode the requester must verify during the callback • The procedures for changing authorized persons or callback information Having a written agreement is only the beginning. Employees must consistently follow the security procedures contained in it. A callback to a number supplied in the fraudulent request is not an effective callback. Similarly, completing a callback without requiring the agreed-upon PIN or passcode may undermine the protection the procedure was designed to provide. The Insurance Question Is More Complicated Than It Appears When an account-takeover loss occurs, the customer, bank and their respective insurers may all examine who was compromised, who authorized the transaction and which security procedures were followed. Coverage is highly dependent on the specific facts and policy language. A bank’s Financial Institution Bond may distinguish between a direct compromise of the bank’s systems and a loss resulting from a customer voluntarily providing credentials or authentication codes. Computer-fraud, funds-transfer, fraudulent-instruction and social-engineering provisions may contain materially different definitions, exclusions and authentication requirements. The customer’s cyber or crime policy may also be relevant, particularly when the customer’s employee was deceived into disclosing credentials or approving a fraudulent transaction. However, the existence of insurance should never be assumed to eliminate the potential dispute between the customer and the bank. Banks should review both their operational procedures and insurance coverage before a loss occurs. That review should address customer credential compromise, account takeover, new-device authorization, fraudulent changes to authorized users and the failure to follow agreed callback or authentication procedures. The Takeaway for Community Banks PPP data has created a lasting roadmap that criminals can use to identify businesses and their banking relationships. The immediate scam may target the customer, but the resulting financial loss, customer dispute and reputational damage can quickly reach the bank. Community banks are particularly well-positioned to respond because they know their customers and can communicate with them directly. A timely warning from a trusted relationship manager may be more effective than a general fraud notice posted on a website. Banks should not treat the end of the PPP lending period as the end of PPP-related risk. The loans may have been forgiven, but the publicly available information remains — and criminals are finding new ways to use it. 21 Colorado Banker
RkJQdWJsaXNoZXIy MTg3NDExNQ==