CFE Exam Quiz 02

EXAMPLE OF A BUILDER BAILOUT SCHEME
A builder bailout scheme might unfold like this:
• The builder (or third party) recruits a straw borrower to purchase the property for no money down and cashback at closing.
• The builder obtains an inflated appraisal that is used as a basis for the loan amount. This the inflated loan amount will allow the builder to recoup the expense of the incentives, pay a
fee to the straw, and keep the loan current for two to four years.
• The builder (or third party) fails to disclose these monetary incentives to the lender.

The following characteristics are common in builder bailout schemes:
• New construction or renovated condo conversions in an overbuilt market
• The slight decrease in sales and volume, followed by a spike in both volume and sales price
• Non-local borrowers with no knowledge of the local market are recruited to purchase the homes at the inflated sales prices
• Missing the purchase contract addendums disclosing the incentives
• Originated as second homes
• Mortgage payments are made by the builder to avoid detection and prosecution
• A loan remains current for a period of time, but then goes into delinquency
• A property might remain vacant and the neighborhood might be deteriorating

These schemes are best detected through automated monitoring to identify red flags, with the manual examination of transactions that appear suspicious. Automated monitoring systems use a variety of factors to determine whether a transaction appears abnormal for that
particular customer, including:
• Daily or overall purchase patterns that substantially exceed the customer’s normal range
• Purchase volume substantially exceeds the customer’s anticipated income or credit limit
• The geographic location of transactions (online and mobile banking applications can typically collect such data)
• Identification of electronic devices (e.g., smartphones, tablets, PCs) that the customer registers with the institution
• Abnormal IP addresses that the user logs in from
• Whether the transacting parties make sense for the particular customer
• Abnormal transaction timing (e.g., a large volume of purchases late at night for the customer when there previously were none during this time)

The liquidity coverage ratio (LCR) requires banks to have sufficient high-quality liquid assets to withstand a 30-day stressed funding scenario that is specified by supervisors. In January 2013, the Committee issued a final revised standard on the LCR.
• An increase in the range of eligible assets that can be held as part of the required liquidity buffer (subject to the discretion of each national supervisor)
• Changes in cash outflow and inflow rates
• A revised timetable, keeping the original January 1, 2015, date for full implementation, but with a transitional period where the minimum level of liquidity coverage will gradually rise from 60 percent of the minimum standard to the full 100 percent
• A clarification that it is expected that supervisors will permit the use of the liquidity buffer in times of stress (i.e. banks will be allowed to use the buffer, and thus fall below the minimum ratio, in a liquidity stress scenario)

Developing banking practices suggest that risks other than credit, interest rate, and market risk can be substantial. Examples of these new and growing risks faced by banks include:
• If not properly controlled, the greater use of more highly automated technology has the potential to transform risks from manual processing errors to system failure risks, as
greater reliance is placed on globally integrated systems;
• Growth of e-commerce brings with it potential risks (e.g., internal and external fraud and system security issues) that are not yet fully understood;
• Large-scale acquisitions, mergers, de-mergers, and consolidations test the viability of new or newly integrated systems;
• The emergence of banks acting as large-volume service providers creates the need for continual maintenance of high-grade internal controls and back-up systems;
• Banks may engage in risk mitigation techniques (e.g., collateral, credit derivatives, netting arrangements, and asset securitizations) to optimize their exposure to market risk and credit risk, but which, in turn, may produce other forms of risk (e.g., legal risk); and
• The growing use of outsourcing arrangements and the participation in clearing and settlement systems can mitigate some risks but can also present significant other risks to banks.

Operational risk event types that the Committee—in cooperation with the industry— identified as having the potential to result in substantial losses include:
• Internal fraud (e.g., intentional misreporting of positions, employee theft, and insider trading on an employee’s own account)
• External fraud (e.g., robbery, forgery, check kiting, and damage from computer hacking)
• Employment practices and workplace safety (e.g., workers’ compensation claims, violation of employee health and safety rules, organized labor activities, discrimination
claims, and general liability)
• Clients, products, and business practices (e.g., fiduciary breaches, misuse of confidential customer information, improper trading activities on the account, money laundering, and sale of unauthorized products)
• Damage to physical assets (e.g., terrorism, vandalism, earthquakes, fires, and floods)
• Business disruption and system failures (e.g., hardware and software failures, telecommunication problems, and utility outages)
• Execution, delivery, and process management (e.g., data entry errors, collateral management failures, incomplete legal documentation, unapproved access given to client accounts, non-client counterparty performance, and vendor disputes)

The decline in check usage is largely attributable to the efficiency and ease of alternative forms of payment, namely online payment services, credit cards, debit cards, and wire transfers. For example, in most European countries, it is customary for businesses to publish their bank details on invoices so that the customer can pay via giro. Giro is a method of transferring money by instructing a bank to directly transfer funds from one bank account to another without the use of checks. This method of payment is predominantly used in Europe, where girls are seen as an effective way for companies to receive payments from foreign customers. Despite the declining use of checks, financial institutions and merchants that still use and accept this form of payment must be aware of the red flags of a fraudulent check.

The cashier or teller is the frontline defense in preventing check fraud. It is important that these individuals receive the training necessary to identify fraudulent checks. They should:
• Be aware of magnetic routing numbers.
• Use extra care in examining a check drawn from a non-local bank and require positive identification.
• Examine the date on the check for accuracy of day, month, and year. Do not accept the check if it is not dated, if it is postdated, or if it is more than 30 days old.
• Be aware of fonts used to print the customer’s name that is visibly different from the font used to print the address.
• Be aware that the magnetic ink (MICR) used for routing codes should appear nonreflective and dull.
• Look for MICR coding that does not match the bank district and the routing symbol in the upper right-hand corner of the check.

• Be aware of the date that the account was opened.

The cashier or teller is the frontline defense in preventing check fraud. It is important that these individuals receive the training necessary to identify fraudulent checks. They should:
Be aware of stains or discolorations on the check possibly caused by erasures or alterations.
• Have easy access to the signature card.
• Look for perforated edges on the checks.
• Be aware that a color copy might reflect odd colors at times due to a failure of the toner to mix satisfactorily.
• Notice the absence of any design in the background of the check paper.
• Notice the absence of a bank logo and the printing of the bank name in the regular lettering.
• Notice the absence of the bank’s address on the check.
• Be cautious of information that is typed or stamped.
• Do not accept a check that is not legibly written. It should be written and signed in ink and must not have any erasures or written-over amounts.
• Be aware of what is acceptable identification.
• Recognize forged/altered information.
• Recognize forged negotiable instruments.
• Telephone the business or account officer for approval on suspicious requests.
• Be familiar with patterns of behavior related to potential culprits:
 Overly polite
 Nervous
 Aggressive and hurried

During a check fraud investigation, look for the following:
• Frequent deposits and checks:
 In the same amounts
 In round numbers
 With checks written on the same (other) bank
• Frequent ATM account balance inquiries
• Many large deposits made on Thursday or Friday to take advantage of the weekend
• Large periodic balances in individual accounts with no apparent business
• Low average balance compared to a high level of deposits
• Many checks made payable to other banks
• Bank willingness to pay against uncollected funds
• Deposits not made daily or intact
• The entity uses receipts that do not indicate mode of payment
• One or more personal checks in the cash drawer by the fund custodian
• Deposit timing lags
• Irregular check endorsements
• Amount of deposit does not agree with the daily activity report
• Inappropriate access to signature plate
• Check numbers, payee name, date, and amount do not agree with entries in the check register
• Voided checks are not retained
• Checks issued to individuals for large, even dollar amounts
• Supporting documentation for checks is not available or has been prematurely destroyed
• Cash is withdrawn when depositing checks

During a check fraud investigation, look for the following:
• Frequent deposits and checks:
 In the same amounts
 In round numbers
 With checks written on the same (other) bank
• Frequent ATM account balance inquiries
• Many large deposits made on Thursday or Friday to take advantage of the weekend
• Large periodic balances in individual accounts with no apparent business
• Low average balance compared to a high level of deposits
• Many checks made payable to other banks
• Bank willingness to pay against uncollected funds
• Deposits not made daily or intact
• The entity uses receipts that do not indicate mode of payment
• One or more personal checks in the cash drawer by the fund custodian
• Deposit timing lags
• Irregular check endorsements
• Amount of deposit does not agree with the daily activity report
• Inappropriate access to signature plate
• Check numbers, payee name, date, and amount do not agree with entries in the
check register
• Voided checks are not retained
• Checks issued to individuals for large, even dollar amounts
• Supporting documentation for checks is not available or has been prematurely destroyed
• Cash is withdrawn when depositing checks

There are several tips for businesses to use when cashing business and payroll checks:
• Examine all checks.
• Insist that the check be signed in front of the clerk.
• Compare the signature written on the check with the signature on the driver’s license or government-issued identification.
• Be particularly careful with large-dollar checks presented by noncustomers.
• Examine all checks for signs of counterfeiting, such as a glossy, wax-like appearance and any lack of detail and sharpness.
• Look for signs of alterations or erasures, especially in the signature or numerical and written amounts.
• Compare the bank identification and routing numbers for a match.
• Verify that the texture of the check appears smooth; a rough document might signal erasures

There are several tips for businesses to use when cashing business and payroll checks:
• Be cautious of information that is typed or stamped.
• Know that all checks, except government issue, should have at least one perforated edge.
• Know that the magnetic ink used for routing codes should appear nonreflective and dull.
• Look for faded colored paper, which can indicate that the check has been chemically bleached.
• Know that a color copy might reflect odd colors at times due to a failure of the toner to mix satisfactorily.
• Know that black lettering might have a slightly greenish cast when examined under a magnifying glass.
• Know that a light-colored or delicate background might fade out when copied.
• Look for the absence of any design in the background of the check paper.
• Look for the absence of a bank logo and the printing of the bank name in regular lettering.
• Look for the absence of the bank’s address on the check.
• Examine checks for an overall appearance of poor-quality printing and paper.
• Know that a payroll check will usually be for an odd amount and will appear neat, clean, and usually unfolded

Banks should send cardholders occasional reminders of steps that can be taken to safeguard their credit card identities, including the following:
• Always carry the least amount of credit cards with you as necessary.
• Do not supply credit card information to unauthorized people.
• Do not leave credit cards unattended with merchants.
• Routinely review credit card statements and immediately report any unrecognizable charges.
• Immediately report the loss or theft of any credit card to the card issuer.
• Obtain credit reports annually in order to detect any suspicious activity in which credit cards or other extensions of credit have been granted or applied for without your consent.
• Never reveal account numbers or other credit card account information to persons attempting to gain your information on the telephone after they represent themselves as agents of a bank.
• If you are aware of suspicious activity, immediately inform the relevant credit reporting agencies and have a “Fraud Alert” placed on your account. This will prevent any potential new creditor from granting new credit without first contacting you personally.
• Always keep credit card receipts in a safe place, and destroy them after you have received the billing statement that reflects the charges.
• If you receive a credit card you did not apply for, call the issuer and determine why it sent the card. Someone might have applied in your name and missed the opportunity to steal the card from your mailbox when it arrived.
• Void incorrect receipts and destroy carbon copies of credit card slips.

While any of the following can occur in a perfectly legitimate transaction, these characteristics are frequently present during fraudulent transactions. Tellers and merchants should be advised to be alert for the customer who:
• Purchases an unusual number of expensive items
• Makes random purchases, selecting items with little regard to size, quality, or value
• Does not ask questions on major purchases
• Signs the sales draft slowly or awkwardly
• Charges expensive items on a newly valid credit card
• Cannot provide photo identification when asked
• Rushes the merchant or teller
• Purchases a large item, such as a television, and insists on taking it at the time, even when delivery is included in the price
• Makes purchases and leaves the store, but then returns to make more purchases
• Becomes argumentative with the teller or merchant while waiting for the transaction to be completed.
• Makes large purchases just as the store is closing.

At the consumer level, the credit card user should remember the following:
• Know where your card is at all times.
• Never leave your card unattended.
• Do not leave the store or ATM without all receipts.
• Do not leave your card in plain sight where others can get the number.
• Do not leave receipts in a public trash can, hotel, or shopping bag.
• Review monthly statements for accuracy and any items that you might not have charged.
• Review your statements via electronic means rather than waiting for paper statements. If possible, cancel paper statements altogether.
• Destroy expired cards.
• Never reveal your card number over the phone to anyone who has offered you a prize.
• Report missing cards immediately.
• Do not reveal personal information such as your address and telephone number.
• Do not allow a salesperson to record your credit card number on your check.
• Keep your card out of the view of others in a store or at a public telephone so they cannot read the name and account number.
• Use a tiered, see-through container in your wallet for credit cards, so it will be easier to notice missing cards.
• Always check your card when it is returned to you after purchase. Make sure it is your card.

At the consumer level, the credit card user should remember the following:
• Know where your card is at all times.
• Never leave your card unattended.
• Do not leave the store or ATM without all receipts.
• Do not leave your card in plain sight where others can get the number.
• Do not leave receipts in a public trash can, hotel, or shopping bag.
• Review monthly statements for accuracy and any items that you might not have charged.
• Review your statements via electronic means rather than waiting for paper statements. If possible, cancel paper statements altogether.
• Destroy expired cards.
• Never reveal your card number over the phone to anyone who has offered you a prize.
• Report missing cards immediately.
• Do not reveal personal information such as your address and telephone number.
• Do not allow a salesperson to record your credit card number on your check.
• Keep your card out of the view of others in a store or at a public telephone so they cannot read the name and account number.
• Use a tiered, see-through container in your wallet for credit cards, so it will be easier to notice missing cards.
• Always check your card when it is returned to you after purchase. Make sure it is your card.

A card-not-present (CNP) transaction is a credit card purchase made without the cardholder physically presenting the credit card to the merchant (e.g., via the Internet, over the phone, through the mail). With these transactions, vendors never have the opportunity to see the customer’s credit card. The only fail-safe, self-protective measure available to them is to postpone the delivery until the transaction has cleared the customer’s account. In our next-day delivery society, however, this might be detrimental to some vendors’ business. There are, however, some options available to merchants:
• Check the billing address against the delivery address. Beware of orders with different “bill to” and “ship to” addresses unless the item is intended as a gift.
• Compare shipping addresses against a log of addresses previously associated with fraudulent orders.
• Compare IP addresses for internet orders to those used with previous orders by the same customer.
• Require all information printed on the back of the card to be produced. In particular, the card verification value—the three-digit number above the signature panel on the back of the card—should be requested.

Potential signs of card-not-present fraud:
• First-time shopper—Criminals are always looking for new victims.
• Larger-than-normal orders—Because stolen cards or account numbers have a limited life span, perpetrators need to maximize the size of their purchase.
• Orders that include several of the same items—Having multiples of the same item increases a criminal’s profits.

• Multiple cards used from a single IP (Internet protocol) address—These transactions occur online.
• Orders consisting of expensive items—These items have maximum resale value and therefore maximum profit potential.
• “Rush” or “overnight” shipping—Fraudsters want these fraudulently obtained items as soon as possible to ensure they are received before the company identifies the fraudulent activity and cancels the order.
• Shipping to an international address—A significant number of fraudulent transactions are shipped to fraudulent cardholders outside of the country from which the order was placed.
• Transactions with similar account numbers—These transactions are particularly useful if the account numbers used have been generated using software available on the Internet.
• Shipping to a single address, but transactions placed on multiple cards—This could involve an account number generated using special software or the use of several stolen cards.
• Multiple transactions on one card over a very short period of time—This could be an attempt to “run a card” until the account is closed.

An electronic funds transfer (EFT) is any transfer of funds, other than one originated by a check or similar paper instrument, that is initiated through an electronic terminal, telephonic instrument, or computer or magnetic tape that orders or purports to authorize a financial
institution to debit or credit an account. Each of the following could be considered an electronic funds transfer:
• A customer’s withdrawal of funds from his own account by an ATM
• A customer’s transfer of funds from his checking account to his savings account at the same financial institution initiated by him through his personal computer
• A customer’s transfer of funds from his checking account to his savings account at the
same financial institution initiated by him through the bank’s automated telephone service
• A customer’s use of a debit card to purchase goods from a merchant who swipes the card through a point-of-sale (POS) device to authorize the deduction of the amount of the sale from the customer’s checking account
• A customer’s transfer of funds from his bank account to a third party initiated by the customer through his personal computer
• An employer’s instruction, initiated by computer or through the magnetic tape, to a financial institution to deposit funds representing an employee’s pay into the employee’s account
• A noncustomer’s instruction, initiated by computer or through the magnetic tape, to a financial institution to withdraw funds from the checking account of a customer and transfer the funds to a noncustomer’s bank account

There are several ways in which fraud can be perpetrated through EBPP and P2P systems since passwords that allow access to customer bank accounts must be made available to third parties. Also, bills that contain significant information about customers must be passed through multiple parties. Potential sources of fraud include the following:
• A biller might send a bill for services not rendered or for goods never sent.
• A person who has obtained information about another person’s bank account might instruct a biller to obtain payment from the other person’s account.
• A hacker might obtain passwords and usernames from an aggregator and use that information to direct transfers from a consumer’s bank account.
• An employee at the site providing EBPP services who knows consumers’ usernames and passwords for screen-scraping purposes might use that information to direct transfers from consumers’ bank accounts.
• A bank employee might use customer information to direct transfers from a customer’s account.

Electronic funds transfer fraud often involves individuals who use the information to obtain access to the accounts of others. As a result, bank personnel can prevent fraud by exercising care in the initial decision to allow an individual to access the bank’s computerized services. Banks offering EBPP or P2P systems to customers should:
• Confirm phone and mailing addresses on the application to ensure that they are consistent with information about the applicant that is available from other sources and, with respect to existing customers, consistent with current records about these customers. This might involve obtaining credit reports about the applicant or obtaining copies of utility bills that show the applicant’s address.

• Make sure that the area or city code on the applicant’s telephone number matches the geographical area for the applicant’s address.
• Send a “welcome” letter to the address on the application with the bank’s return address so that the letter will be returned if the applicant does not live there.
• Verify by telephone or additional mailings any change of address requests in the same way that new account applications are verified.
• If a customer reports the loss or theft of an access device, cancel the existing card, PIN, or other forms of access and issue a new one.
• If a customer reports that a person previously authorized to use an access device no longer has that authority, cancel all cards, PINs, or other access devices and issue new ones to the customer.
• Always mail PINs separately from other information, such as usernames, with which they are associated.
• Separate the responsibility of bank employees who have custody of information relating to access devices from those who have responsibility for issuance, verification, or reissuance of PINs.
• Ensure that any communication concerning usernames or passwords is sent in a secure, encrypted format.
• Require customers who register for EBPP or P2P systems to provide information indicating that they are authorized to use the bank account or credit card from which payments will be made.

Banks that participate in EBPP or P2P systems can take steps to detect fraudulent transactions, either by providing information to customers or by analyzing transactions that have characteristics associated with the fraud. These measures include the following:
• Send customers email alerts when a new bill arrives or payment is sent. The email should advise the customer to contact the bank immediately if the bill was not expected or the payment was not authorized.
• Refuse or scrutinize any transactions from a payer or recipient who has been the subject of a notice from a credit card issuer indicating that the person was involved in an unauthorized credit card transaction or unauthorized transfer to or from a bank account.
• Ensure that the name on the bank account associated with the P2P account matches the name on the P2P account itself.
• Track and verify payments of similar amounts to the same recipient.
• Since P2P systems are frequently used to make payments for online activities, be aware of activities that are typically associated with fraud and scrutinize transactions with customers who engage in such activities. These activities include pyramid schemes, online auctions, and sale of items that have a delayed delivery date.

The Information Systems Audit and Control Association (ISACA) recommends several steps for prevention of EFT fraud in companies. The following is a brief overview:
• Define the EFT process and controls points.
• Define EFT policies and procedures.
• Ensure physical security surrounding all EFT components.
• Implement effective EFT application security.
• Implement effective network operating system security.
• Implement effective security surrounding EFT data.
• Implement effective system logging that establishes a baseline that can be used to measure unusual activity.
• Conduct reconciliations to allow for the determination of whether data have been modified during any stage of the EFT process.

A company employee might submit the following false information to obtain unlawful financial gain:
• Improper medical information to obtain a better insurable rate for the prospective policyholder (for example, standard to preferred rate)
• Improper date of birth to obtain a cheaper premium on the new policy
• Improper home address to obtain a cheaper premium for home or automobile insurance
• Improper driving history prior to purchasing automobile insurance to reduce the annual premium or obtain insurance where the individual would normally have to apply through the risk pool.

Red flags of insurance fraud might include any of the following:
• The claim is made a short time after the policy’s inception, or after an increase or change in the coverage under which the claim is made.
• The insured has a history of many insurance claims and losses.
• The insured previously asked an insurance agent hypothetical questions about coverage in the event of a loss similar to the actual claim
• The insured is very assertive and insistent about a fast settlement, and exhibits more than the usual amount of knowledge about insurance coverage and claims procedures, particularly if the claim is not well documented.
• In a burglary loss, the claim includes large, bulky property, which is unusual for a burglary.

Fraud schemes involving infusion care treatment include:
• Services billed at abnormally high rates in comparison to cost
• Bills for patients who are not covered by insurance or beneficiaries of the health care program
• Bills in excess of the physician’s prescription
• Bills for unnecessary treatment
• Kickbacks were given to the prescribing physician

Reusable medical equipment, often called durable medical equipment (DME), includes items such as crutches, wheelchairs, and specialized patient beds. Fraud schemes perpetrated by reusable medical equipment suppliers frequently involve:
• Falsified prescriptions for equipment or supplies
• Intentionally providing excessive supplies
• Equipment not delivered or billed before delivery
• Billing for equipment rental beyond when the equipment was checked out
• Billing for supplies not covered by the insurance policy or health care program
• Scooter scams (i.e., billing for electric-powered wheelchairs that are either unnecessary or are of poorer quality than the model billed for)

Under some health care programs, patients who are confined to their home are eligible to receive home health care services. Fraud schemes involving home health care providers include:
• Forging physicians’ signatures on plans of care to make it appear that patients qualify for home health visits
• Altering the approved number of home health care visits on a legitimate plan of care
• Billing for home health care visits that were never made
• Billing for costs incurred during home health care visits that are not reimbursable

Pharmaceutical fraud is the largest source of provider fraud in the health care industry and can involve pharmaceutical manufacturers, pharmacies, and providers who prescribe such products. Fraud schemes stemming from pharmacy transactions include:
• Merchandising—substituting something of value for a prescription drug
• Billing for brand name drugs but dispensing generic drugs
• Billing beyond amount prescribed
• Billing for drugs not prescribed
• Billing for a high-priced generic drug but dispensing a lower-priced generic drug
• Inflating the price of drugs sold to government-backed health care programs above those sold to private parties
• Package size differential—billing third-party payers for the price of drugs purchased in small package sizes when they were purchased at less cost in larger quantities
• Black-market purchasing—purchasing drugs at significantly reduced rates and then dispensing at regular prices
• Off-label marketing—illegally inducing medical providers to order a drug for off-label purposes (i.e., a purpose not approved by the appropriate drug-regulating agency)
• Providing kickbacks or bribes to providers to induce them to prescribe pharmaceutical products.