ChopTwilightZoneofFraud - TEXAS - PRESENTATION VERSION

Webinar:The Twilight Zone of Cyber Fraud and Escrow TheftJune 3, 2015

Sponsored By:

6/2/2015

1

Twilight Zone of Cyber Fraud & Escrow Theft

JONATHAN BIGGS, VICE PRESIDENT OF RISK MANAGEMENT & EDUCATION

National Investors Title Insurance Company

1

Of Cyber Fraud & Escrow Theft




2

6/2/2015

2




3

The Twilight Zone is an intrinsic part of our American pop culture. This iconic television series was a delicious mix of the far reaches of Rod Serling’s grey matter combined with human drama, psychological intrigue, science fiction, fantasy and our own worst fears. Each week Serling would tell the story of an unsuspecting person, who could be you or me, who found themselves in a normal mundane circumstance that was somehow twisted by the macabre, into a wicked nightmare with an unexpected twist of fate. Serling would tactically draw the viewer in to the work‐a‐day life of his unsuspecting average Joe, and then play upon our fears, and then banish said average Joe into a personal horror and leave him stranded in The Twilight Zone.




4

By the end of the episode, we might well think, “There but for the grace of God go I.” Fortunately for us, the story usually had a science fiction flair that prevented us from believing that it could actually happen to us.

Cyber‐Crime is the indiscriminate menace that personally escorts unsuspecting practitioners into a real life Twilight Zone.

The primary difference between our stories and Serling’s is that the stories which we are about to share are TRUE.

(The names have been changed and the facts slightly embellished to protect the innocent.)

6/2/2015

3




5

DISCLAIMER

No Claim is Made to the ownership of the images from the Twilight Zone. These images are the property of CBS.

No Members of the Twilight Zone Cast were injured during the preparation of delivery of this presentation.




6

6/2/2015

4




7




8

6/2/2015

5




9

Imagine if You will . . .

A world where Certified Checks are worthless . . .

CHARLIE BROWN




10



• A “Simple” Cash Closing• Purchase Price $298,750.00• Buyer Sends Certified Check• Deal Falls Though• Buyer Asks for Refund

Scenario #1

CHARLIE BROWN

6/2/2015

6




11



• A “Simple” Cash Closing• Purchase Price $250,000.00• Buyer Sends Certified Check for $298,750.00• Buyer asks for Refund of Overage

Scenario #2

CHARLIE BROWN




12


A world where your own Trust Account Checks are questionable . . .

Scenario #3

6/2/2015

7




13




14

1. Question the Source of All Funds

2. Never Disburse on Un‐Collected Funds

3. If In Doubt, Wait It Out

6/2/2015

8




15

1. Question the Source of All Funds

2. Never Disburse on Un‐Collected Funds

3. If In Doubt, Wait It Out




16

6/2/2015

9




17




18

You are about to meet Flo . . .You are about to meet Flo . . .• Age: 32• Occupation: Administrative Assistant at a

prestigious Title Agency• Social Butterfly• Loved By All • Matriarch of the Office• Makes It Her Personal Responsibility to look after

everyone

6/2/2015

10




19

Flo Found a Flash Drive on the Floor . . .

• Put it in her computer• Directory Filed named “PartyPictures”• Opened to See Who Was In the Pictures• Unlocked Trojan Horse Virus• Unlocked Trojan Horse Virus• Virus Emailed to Everyone in Flo’s Contact List• Virus Emailed to Everyone in Flo’s Contact List• Wiped Hard Drive of Every Infected Computer• Wiped Hard Drive of Every Infected Computer




20

6/2/2015

11




21

1. Never permit access to your network from unknown source

Downloads Flash Drives

If the flash drive had been a diseased and infected dead animal, would Flo have touched it?




22


Downloads Flash Drives

If the flash drive had been a diseased and infected dead animal, would Flo have touched it?

If the flash drive had been a gun or explosive device, would Flo have touched it?

6/2/2015

12




23


Downloads Flash Drives Emails




24



2. Install a secure firewall that blocks known malware

3. Scan All Incoming & Outgoing Email

4. Scan All Peripheral Connected Devices

6/2/2015

13




25



2. Install a secure firewall that blocks known malware

3. Scan All Incoming & Outgoing Email

4. Scan All Peripheral Connected Devices




26

6/2/2015

14




27




28

Submitted for your perusal . . .

• Felix: 82, a widower, has worked his whole life to pay for his house, which is his only real asset.

• Last week, he came to you to refinance his home to get the equity for his move to a retirement facility.

• Felix cannot sell his house in this market and needed the cash now.

• Felix planned to move into Open Arms Retirement Village – but instead moved into . . .

6/2/2015

15




29

Fast forward to today, when he picked up the phone and the caller pretended to be someone at your office.

Caller ‐ “Felix, I am with the Trusted Firm, and I need to confirm a few things to close your file.”

Felix ‐ “How do I know you are who you say you are?”

Caller ‐ “You were in our office last Monday, to refinance your home at 1234 Twilight Boulevard, with Big Bank for a loan in the amount of $247,750 at a rate of 4%. . . . I just need one more thing.”

Felix ‐ “What is that?”




30

It Could Be Any of the following:

• Your Credit Card Number

• Your Driver’s License Number

• Your Health Insurance Membership Number

• Your Social Security Number

• Your Checking Account Number

6/2/2015

16




31




32

1. Preach Protecting Personal Information

2. Talk About Common Scams to Clients & Customers to Continually Raise Awareness

3. Support Those That Confirm Identity Before Supplying Personal Information

4. Guard Personal Information Electronically & Physically

5. Ask for ID – ALWAYS!

6/2/2015

17




33

1. Preach Protecting Personal Information

2. Talk About Common Scams to Clients & Customers to Continually Raise Awareness

3. Support Those That Confirm Identity Before Supplying Personal Information

4. Guard Personal Information Electronically & Physically

5. Ask for ID – ALWAYS!




34

6/2/2015

18




35




36

The Time: is NOW.The Place: a far corner of Earl’s mind. The Problem: the pressure of the world is focused

on Earl – at least in his mind.

PRESSURE

Motive for Theft or

Fraud

6/2/2015

19




37


on Earl – at least in his mind.The Opportunity: Entrusted Funds in the Trust Account

OPPORTUNITYPRESSURE

Ability to carry out

Theft or Fraud




38


on Earl – at least in his mind.The Opportunity: Entrusted Funds in the Trust AccountThe Rationale: “Only Borrowing” the Money

RATIONALIZATION

OPPORTUNITYPRESSURE

Justification for Theft or Fraud

6/2/2015

20




39


on Earl – at least in his mind.The Opportunity: Entrusted Funds in the Trust AccountThe Rationale: “Only Borrowing” the Money

RATIONALIZATION

OPPORTUNITYPRESSURE




40

RATIONALIZATION

OPPORTUNITYPRESSURE

6/2/2015

21




41

1. Earl was not a criminal at heart, but became one out of convenience and weakness.

2. Cannot Remove the Pressure or Rationalization from the Fraud Triangle.

3. Must Remove Opportunity from the Fraud Triangle.

4. Separation of Trust Account Duties: Check Writing Wire Authorization Reconciliation

5. More When We Get to Tammy

RATIONALIZATION

OPPORTUNITYPRESSURE




42

6/2/2015

22




43




44

Meet Tammy• Your Most Trusted Employee• She is 45 & you hired her right out of high school• Most Trusted Employee for 20 years• Never Takes a Vacation• Always Offers to Balance the Checkbook• She has a generic classification as a, quote, girl with a

head on her shoulders, end of quote.

All of which is mentioned now because the head on her shoulders will be put to a test. Circumstances will assault her sense of reality and a chain of nightmares will put her sanity on a block.

The Accountant comes on Monday to audit the Trust Account.

6/2/2015

23




45

Today is Saturday, and You are at Home Watching Your Favorite Blue Devils Play Basketball.

• The fire alarm goes off at your office.• Someone has created a fire in your file room.• First Files Burned . . . the Trust Account Records.




46

RATIONALIZATION

OPPORTUNITYPRESSURE

6/2/2015

24




47

1. Separate Check Writing Authority from Check Signing Authority

2. Separate Wire Initiation Authority from Wire Approval Authority

3. Separate Check and Wiring Authority from Reconciliation

4. Hire Independent Third Party to Audit and/or Reconcile Trust Accounts

5. They RESPECT what you INSPECT

RATIONALIZATION

OPPORTUNITYPRESSURE




48

1. Separate Check Writing Authority from Check Signing Authority

2. Separate Wire Initiation Authority from Wire Approval Authority

3. Separate Check and Wiring Authority from Reconciliation

4. Hire Independent Third Party to Audit and/or Reconcile Trust Accounts

5. They RESPECT what you INSPECT

RATIONALIZATION

OPPORTUNITYPRESSURE

6/2/2015

25




49




50

6/2/2015

26




51

You're looking at Act One, Scene One, of a nightmare . . . one not restricted to witching hours or dark shadows, it is happening in broad daylight and in living color.

Observe, Community Karl, . . . He is the perfect example of what you expect a good citizen to be. For the past 35 years, he has been an avid volunteer and friend to all in need.

He volunteers at his church, the YMCA, and the local drug rehab facility.

All that Community Karl wanted to do was help. Who knew that his last good act would harm so many?




52

Karl’s Copier is old, but it still works. However, it cannot handle the load of his active office.

Karl decides to donate the copier to the drug rehab facility.

Karl is getting numerous calls from various clients about dealing with identity theft.

The police investigation leads to past residents at the drug rehab facility. Disappointed, Karl vows to volunteer additional time at the facility in hopes that he can help make sure that this type of thing never happens again.

6/2/2015

27




53

While he is volunteering, the police come by to complete their investigation. Karl asked how these individuals could get their hands on so much information.

The detective tells him, “It’s simple, see that copier. It has a hard drive which retains a digital copy of everything that it copied or scanned.”

Karl’s life passed before his eyes, in which he and his staff copied or scanned thousands of client documents on that very copier – including his own tax returns. Karl crossed over into The Twilight Zoneof Cyber‐Crime.




54

6/2/2015

28




55

1. Karl’s first mistake was in believing that he was on top of the cyber‐crime epidemic. Who knew that there was a hard drive in the copier?

2. Karl should consult a data security firm to perform a test for Gramm‐Leach‐Bliley Act (GLB) compliance.

Provide each client with your written privacy policy for protecting Non‐Public Personal Information;

Use strong case sensitive passwords containing letters, numbers and special characters, which are changed every three months;

Implement and maintain a “Clean Desk” policy, where all files containing any client Non‐Public Personal Information are locked up every night;

Encryption of every email and/or document transmission that contains any client Non‐Public Personal Information; and

Secure all portable devices, including smart phones, tablets and laptops, in a locked environment when not in use.




56

1. Karl’s first mistake was in believing that he was on top of the cyber‐crime epidemic. Who knew that there was a hard drive in the copier?

2. Karl should consult a data security firm to perform a test for Gramm‐Leach‐Bliley Act (GLB) compliance.

Provide each client with your written privacy policy for protecting Non‐Public Personal Information;

Use strong case sensitive passwords containing letters, numbers and special characters, which are changed every three months;

Implement and maintain a “Clean Desk” policy, where all files containing any client Non‐Public Personal Information are locked up every night;

Encryption of every email and/or document transmission that contains any client Non‐Public Personal Information; and

Secure all portable devices, including smart phones, tablets and laptops, in a locked environment when not in use.

6/2/2015

29




57




58

The place is here, the time is now, and the journey into the shadows that we're about to watch could be your journey.

William is a solid title agent with a vibrant practice that has provided well for his family. His days are filled with title searches, closing packages, client meetings, and trust account reconciliations.

William is very careful. He never opens any of those emails from the Nigerian Prince and considers himself cognizant of electronic security.

6/2/2015

30




59

Today, William sits down at his computer to wire a payoff and his computer locks up. This particular computer inconvenience appears to be one more in a series of routine occurrences. William thinks nothing of it, and he turns off the computer and tries again.

It takes roughly five minutes to reboot the computer, but that is a cyber‐eternity. When access is restored, William cannot initiate the wire because there are not sufficient funds in his trust account. A cyber‐criminal has emptied William’s trust account. Welcome to The Twilight Zone of Cyber‐Crime.




60

6/2/2015

31




61

William’s attention immediately turns to the bank. It is bank error. Of course, that has to be it!

One quick call to the bank and they confirm that hiscomputer, in his office, at his IP address, with hispassword had initiated multiple successive wire transfers to a bank account out of state.

The total amount is well into six figures.

He demands that they get it back immediately.

The bank calls back and confirms that the money had already left that other account to a foreign country.




62

William takes the proper steps and notifies the TDOI and his insurance carrier.

The TDOI has a simple rule: when the money is in your hands, it is your responsibility. While they are sympathetic to William’s plight, they issue the same directive: “Replenish the account.”

William’s E & O carrier is also sympathetic, but cyber‐crime is not covered under his policy. They deny coverage.

The Bar issues an injunction.

6/2/2015

32




63

William takes the proper steps and notifies the TDOI and his insurance carrier.

The TDOI has a simple rule: when the money is in your hands, it is your responsibility. While they are sympathetic to William’s plight, they issue the same directive: “Replenish the account.”

William’s E & O carrier is also sympathetic, but cyber‐crime is not covered under his policy. They deny coverage.

The Bar issues an injunction.




64

6/2/2015

33




65

1. William could decline the bank’s request to use online banking2. William could implement is a separate computer dedicated

exclusively to electronic banking. This computer would have no other function.

3. William should implement encryption technology. 4. William should take advantage of a program such as iTracs®,

which is a daily electronic trust account reconciliation program offered by National Investors.

5. At the heart of iTracs® is a function called “Positive Pay.” William should have “Positive Pay” regardless.

6. William should have all ACH transactions blocked on his accounts.

7. William should implement separation of duties in his trust account, essentially “separating the key from the lock.”




66

1. William could decline the bank’s request to use online banking2. William could implement is a separate computer dedicated

exclusively to electronic banking. This computer would have no other function.

3. William should implement encryption technology. 4. William should take advantage of a program such as iTracs®,

which is a daily electronic trust account reconciliation program offered by National Investors.

5. At the heart of iTracs® is a function called “Positive Pay.” William should have “Positive Pay” regardless.

6. William should have all ACH transactions blocked on his accounts.

7. William should implement separation of duties in his trust account, essentially “separating the key from the lock.”

6/2/2015

34




67




68

6/2/2015

35




69

Portrait of a man at work, the only work he's ever done, the only work he knows . . .

Sam has been handling real estate settlements for his entire adult life. He has seen colleagues get burned time and time again with cyber fraud.

Sam has painstakingly guarded his client’s personal information and money with the latest technological controls and the old school physical controls.




70

Sam has:

Dedicated Computer for Banking Transactions with Encrypted Password Protection

Latest & Greatest Settlement Software Daily Electronic Reconciliation of the Trust Account Performs Pre‐Hire Background Checks and Annual

Background Checks on all of his Employees Separation of All Trust Account Duties A State of the Art Firewall, that Patrols his Network Virus Scanning Software that is Updated Twice a Day Encryption for All Emails – Incoming and Outgoing Encryption for All Documents Retained Every Hard Drive Ever Used in the Office

6/2/2015

36




71

Sam has:

Dedicated Computer for Banking Transactions with Encrypted Password Protection

Latest & Greatest Settlement Software Daily Electronic Reconciliation of the Trust Account Performs Pre‐Hire Background Checks and Annual

Background Checks on all of his Employees Separation of All Trust Account Duties A State of the Art Firewall, that Patrols his Network Virus Scanning Software that is Updated Twice a Day Encryption for All Emails – Incoming and Outgoing Encryption for All Documents Retained Every Hard Drive Ever Used in the Office




72

Sam also has . . .

that one thing that everybody has to have in the office.

PEOPLEPeople that do not follow the rules, no matter how conscientious that they may be.

6/2/2015

37




73

Someone On Sam’s Staff does not follow protocol.

A New Virus Gets in Sam’s Network, that is so new the virus protection software has not been updated yet.

Virus attacks his “Latest & Greatest” Settlement Software

Virus creates bogus files with bogus checks, which are uploaded to Sam’s Bank through Positive Pay.

Checks Are Approved

Checks Clear The Bank




74

6/2/2015

38




75

1.




76

1.

6/2/2015

39




77

1. Cyber Liability Insurance Coverage• Covers you for loss of Non‐Public Personal Information

2. Cyber Crime Insurance Coverage• Covers you for loss of Funds By Electronic Means

3. Cyber Social Engineering Insurance Coverage• Covers you for loss of where you intended to send the

funds to a place that was induced by cyber fraud

4. Fidelity Coverage• Covers you for loss due to theft by employee

5. Surety Coverage / Escrow Security Bond




78

Most Cyber‐Crime experts will tell you that it is not a matter of “IF” but a matter of “WHEN” you have a data breach and are victim to cyber‐crime. No matter how diligent you may be, you could find yourself in the position of any of our unsuspecting victims

These stories are supposed to exist only in black and white science fiction and relegated to late night television.

Unfortunately for our victims, these chronicles were played out in living color as their normal mundane day–to‐day existence was twisted into a wicked daytime nightmare with an unexpected twist of cyber‐crime that left them stranded in The Twilight Zone.

6/2/2015

40




79




80

6/2/2015

41




81

ChopTwilightZoneofFraud - TEXAS - PRESENTATION VERSION

Documents

Transcript of ChopTwilightZoneofFraud - TEXAS - PRESENTATION VERSION