Security, Fraud Prevention, and Risk Management
This domain, Security, Fraud Prevention, and Risk Management, tests how credit unions protect members, assets, and data. Expect scenarios on identity verification, social engineering, insider abuse, incident response, and business continuity.
Fraud and controls
Common threats include phishing, account takeover, check and ACH fraud, card skimming, synthetic identities, elder financial exploitation, and wire fraud. Controls include multi-factor authentication, call-back verification to a known number, dual approval for wires, positive pay, transaction monitoring, and member education. The Bank Protection Act requires a written security program appropriate to the institution. Internal controls-mandatory vacations, job rotation, dual custody, and surprise audits-reduce insider risk. Suspicious activity should be escalated promptly; a SAR may be required, and tipping off the subject is prohibited.
Risk management
Enterprise risk management identifies, measures, monitors, and controls risk across credit, liquidity, operational, compliance, strategic, and reputational categories. A business impact analysis supports continuity planning. Vendors and third parties need due diligence and ongoing oversight. Incident response should preserve evidence, contain harm, notify per policy and law, and capture lessons learned.
Worked example
A caller says he is a member, gives the correct account number and date of birth, and asks to change the address and wire $18,000 to a new domestic bank. Reasoning: correct static data does not prove identity; the wire and address change are high-risk. Use a documented call-back to the number on file, require additional authentication, and consider a hold or in-person verification. If the caller pressures or refuses verification, escalate as suspected fraud and document. Do not process the wire because the caller is friendly or “already verified.”
Traps
Do not treat caller ID or a known account number as authentication. Do not discuss a SAR or fraud investigation with the subject. Do not let urgency override dual approval. Do not assume small credit unions are too small to be targeted.