Fraud Prevention and Security
Fraud Prevention and Security tests whether you can spot a fraudulent transaction or manipulation attempt before money leaves, and how you escalate. Expect check fraud, account takeover, social engineering and elder exploitation scenarios.
Core rules
- Verify identity against the record, not against information the caller supplies. Call back on the number on file, never the number in the email or on caller ID.
- Common schemes: forged or altered checks, counterfeit cashier's checks, check kiting, unauthorized ACH debits, phishing and vishing, business email compromise, and account takeover through SIM swaps or credential theft.
- Red flags: urgency, secrecy, a new payee or changed wire instructions, a change of address followed by a debit card request, unusual channel or timing, and a customer who cannot answer verification questions.
- Elder financial exploitation signs include a new 'friend' managing finances, sudden large withdrawals, fear or confusion, and a caregiver answering for the customer.
- Controls: dual control on cash and wire release, callback verification, document and signature checks, holds, and device or behavioral monitoring.
- Escalate to fraud/BSA immediately, preserve records, and follow Reg E error-resolution timelines for disputed electronic transfers.
Worked example
An email purporting to be a long-standing business customer asks to change wire instructions to a new bank, marked urgent. This is a classic business email compromise. Confirm by calling the signer at the number on file, require dual approval, and hold the wire until verified - even if the customer is annoyed.
Traps
- Trusting caller ID or an email domain that looks nearly right.
- Using contact details supplied in the suspicious message.
- Delaying escalation to avoid embarrassing a customer.
- Assuming a cashier's check cannot be counterfeit.