A low-tech fraud scheme proves financial institutions must be ever mindful of their security and due diligence gaps. On March 11, authorities arrested LuQuada Dixon of Oakland, Calif., on allegations of duping bank tellers out of thousands of dollars through a cash-advance scam. Using aliases and counterfeit driver's licenses, as well as other forms of identification, Dixon and other accomplices allegedly convinced tellers at bank branches to advance cash on stolen credit cards.
The scheme, though well orchestrated from a social engineering perspective, is almost archaic by today's cyber-savvy criminal standards. But John Buzzard of FICO's Card Alert Service says that's what has made the scheme successful in several states. Banks and credit unions have let their guards down. "It comes down to financial institutions needing to devoutly follow the procedures they have for cash advances," Buzzard says. "They just need to be sure they are following procedure."
FICO, which provides decision management and predictive analytics for card issuers, first picked up on the scheme in July 2009. Since then, FICO has issued bulletins to its financial institution members about the methods used to fool tellers.
"These guys were not hitting really large, busy financial centers," Buzzard says. "They went to small towns, and they were talking with tellers, who often can be very junior by nature."
How the Scam Works
Dixon was arrested on March 11 in Urbana, Ohio, after a teller contacted local authorities. Buzzard says Dixon and her alleged accomplices typically request advances totaling $8,000. For a small institution, an $8,000 hit can be "devastating to the bottom line," Buzzard says.
According to FICO's bulletin, Dixon was able to convince tellers to push the advances through offline, after swiping the stolen cards resulted in declines. "Dixon will suggest that the teller contact her card issuer, using either her cell phone or the bank teller's phone," the bulletin states. "The individual on the other end of the telephone will talk to the teller and confirm that the money is available on the credit card. Then this individual will suggest that the teller push the transaction through."
The 2009 incident involved a small group of individuals who perpetrated a similar scam, requesting an advance for $5,000 and then asking the teller to call a fictitious 800 number to get approval to force the transaction through. A few days after the cash-advance scam hit Michigan, the same group hit a credit union in Oregon. The teller in Oregon notified local police, which led to an arrest. The teller-cash-advance scheme seemed to have fallen from the radar, until February, when consecutive incidents hit small institutions in Georgia and Oklahoma, just before landing in Ohio in March.
"We have this gap in time, from July 2009 to February 2011, but I wonder if this was going on all along and just was not reported," Buzzard says. "I don't think it was the same people from '09 to '11, but they may be linked in some way, because the behavior is similar. This is why it's really important that everybody become aware of the scam itself and understand the importance of coming forward to keep everybody on the lookout."
Prevention: Communication Among Banks
The scheme is unique, but very easy to catch if banks and credit unions know what to watch. Buzzard says it's important for institutions to share information about any fraud scheme, whether it's face-to-face or more cyber in nature, like phishing.
He also recommends notifying local authorities and payments networks and processors, as well as any associations with which the bank or credit union might be affiliated.
"There are a lot of things that people could do to get the word out," Buzzard says. "It would not adversely affect their reputation, and it could stop a lot of these events before they are able to happen." The U.S. Secret Service is actively investigating incidents of teller-cash-advance fraud.
Secret Service on Cash-Advance Fraud
Secret Service Agent Todd Bagby says cash-advance schemes are easy to fight, if banks follow best practices and in-house guidelines. A recent wave of credit card cash advance scams that have targeted smaller banking institutions in Georgia and Oklahoma highlight the need for financial institutions to fill security and due diligence gaps.
"A lot of it is probably what the banks already know," says Bagby, resident agent in charge of the U.S. Secret Service office in Dayton, Ohio. Last month, the Dayton, Ohio, office brought charges against LuQuada Dixon of Oakland, Calif., on allegations she duped bank tellers out of thousands of dollars through cash advances on stolen credit cards.
"If someone comes in and is not a customer and wants a cash advance, some bells and whistles should go off," Bagby says. "Banks should just follow their own protocol and use their own contacts to identify the person on the other end of the line" when a request for a forced cash advance is made by the fraudster or approved by someone the fraudster asks the teller to call.
Problem is Not Isolated
Though the most recent cash-advance schemes have targeted smaller institutions in the southeastern U.S., Bagby says cash-advance crimes occur throughout the country. "It's a nationwide scheme," he says. "Geographically, it's pretty common, and it's not something that takes a lot of forethought. The forced transaction request is somewhat uncommon, but the credit card advance scheme goes way back."
Bagby says Secret Service offices across the country are working in tandem to track these incidents, since the perpetrators appear to have some knowledge of the banking industry and system. Most of the schemes to date have involved stolen cards, but the cloning of card numbers for the creation of fake or so-called white cards also has been identified by investigators tracking these incidents.
-bankinfosecurity.com
Tidak ada komentar:
Posting Komentar