List of Tables. General Information. Deposit Account Fraud Prevention. ABA Deposit Account Fraud Survey Report 2015 Edition. Table

Transcription

1 Table Number General Information List of Tables Page 1 For which units in your banking organization are you reporting the information? Your total banking assets and deposits for the units included in this report Distribution of open transaction accounts by account source Open transaction account portfolio per bank, consumer and business combined New transaction accounts opened per bank in Expenses per bank (internal and external) for prevention, detection, investigation, and prosecution of deposit account fraud Areas for which bank's fraud prevention/investigations group is directly responsible Please indicate which of the following fraud management functions are outsourced If not outsourced, which bank departments handle customer claims for the following types of fraud? Does your bank have a policy regarding the customer s liability on unauthorized/ fraudulent transactions? If Yes, are customers notified of this policy? If Yes, what modes of communication does your institution use to notify customers of this policy? How often do you communicate this policy to customers? Average number of full-time equivalent (FTE) bank staff responsible for prevention, detection, and investigation of deposit account fraud Average number of FTE analysts and management staff responsible for listed prevention systems What tools does your bank use to monitor for and detect cross-channel fraud? When your bank charges off a case of cross-channel fraud, where does your bank book the loss? Which tools does your bank currently use to identify and detect account takeovers for consumer and business accounts Expected change in transaction volume over the next 12 months for the following channels Deposit account-fraud threats to the industry in the next 12 months If your bank experienced higher losses in 2014 when compared to 2013, what were the primary drivers? If your bank experienced no DDA fraud loss or lower losses in 2014 when compared to 2013, what were the primary drivers? Deposit Account Fraud Prevention 23 Approaches banks use to prevent deposit fraud losses new account application review Approaches banks use to prevent deposit fraud losses customer verification Approaches banks use to prevent deposit fraud losses branch/bank control Approaches banks use to prevent deposit fraud losses other fraud prevention approaches What kind of authentication methods does your institution use for the following digital banking products Do you require or encourage your customers to change the access authentication password periodically (e.g., every 90 days)? What level of automation does your institution use to verify the identity of customers using the following digital products? Does your institution have a specialized team that monitors suspicious digital transactions only? American Bankers Association 67

2 31 What methodologies does your institution use to monitor, track, or analyze digital suspicious transactions? Check Fraud Prevention 32 In terms of high vs. low impact, please rate the effectiveness of the measures that your bank uses to reduce check fraud Approaches banks use to prevent check fraud losses deposit review Approaches banks use to prevent check fraud losses on-us/in-clearing Approaches banks use to prevent check fraud losses branch/bank control Approaches banks use to prevent check fraud losses withdrawal controls Approaches banks use to prevent check fraud losses exception holds Approaches banks use to prevent check fraud losses other fraud prevention approaches If you offer positive-pay service, how do you encourage your corporate customers to use this service? What is the timing of your deposit fraud review? Regulation CC 41 Report the most representative of your published funds availability policy for deposits to established consumer or business transactions accounts that do not qualify as exceptions under Regulation CC How often do you impose a safeguard exception on your consumer or business accounts to hold funds beyond the 2 business days? Many banks generally provide funds earlier than the law requires (e.g., the day after deposit). In these instances, banks may impose case-by-case holds: that is, holds beyond the bank s usual policy, but no later than 2 days. If you provide funds earlier than required by Regulation CC, for instance, on the day after deposit, how often do you impose case-by-case holds? On average, how long does it take for a check to return to your institution? Assume that the original deposit of the check at your institution is day Do you accept Remotely Created Checks (RCCs)? How many check fraud claims have a draft (RCC) associated with them? Electronic Check Processing 47 Do you capture or plan to capture check images at the following locations? Does your bank offer remote deposit image capture to customers? Rate the following fraud risks associated with electronic check processing Your bank s primary fraud prevention solutions for electronic check processing Does your bank check for duplicate check presentment using check data (check image and non-image data) and/or ACH conversion data? What check data/check image sources does your bank use to detect duplicate presentment via RDC? How far back does your bank review check data (including check images and non-image check data) to detect duplicate check presentment? What is the typical lag time your bank experienced for duplicate check presentment? Does your bank require customers to have been with the bank for a specific number of days prior to them being able to use remote deposit image capture? Please indicate which item(s) your bank restricts from being presented via RDC Consumer (all types) Please indicate which item(s) your bank restricts from being presented via RDC Business Desktop Please indicate which item(s) your bank restricts from being presented via RDC Business Mobile American Bankers Association

3 59 Does your bank have daily transaction dollar limits on items presented via RDC? Consumer (all types) Does your bank have daily transaction dollar limits on items presented via RDC? Business Desktop Does your bank have daily transaction dollar limits on items presented via RDC? Business Mobile Does your bank have item-level dollar limits on items presented via RDC? Consumer (all types) Does your bank have item-level dollar limits on items presented via RDC? Business Desktop Does your bank have item-level dollar limits on items presented via RDC? Business Mobile Do you have a limit on the number of items that can be presented via RDC per day? Consumer (all types) Do you have a limit on the number of items that can be presented via RDC per day? Business Desktop Do you have a limit on the number of items that can be presented via RDC per day? Business Mobile On an ongoing basis, do you screen customers NSF history to determine if they continue to have access to mobile RDC? Do you monitor returned RDC items? Do RDC transactions run through one or more of your existing deposit fraud tools? Does your bank conduct negotiability reviews for checks deposited via RDC? Telephone Banking/Call Center 72 Specify telephone banking/call center transactions your bank currently offers or plans to offer to consumer accounts Specify telephone banking/call center transactions your bank currently offers or plans to offer to business accounts In calendar year 2014, did your bank see an increase/decrease in social engineering/ information gathering attempts via your telephone banking/call centers? Did your bank experience the listed types of fraud attempts in 2014 that were originated through the call center? Do you anticipate increased fraud exposure (loss + loss avoided) in telephone banking/call centers in 2015? Online Banking 77 Specify online banking transactions your bank currently offers or plans to offer to consumers Specify online banking transactions your bank currently offers or plans to offer to businesses Do you plan to implement enhanced back-office security features like the following for your online banking customers? What tools are you offering DDA customers that could help prevent online fraud/account takeover? Do you offer the following services, discounted or free, to your DDA customers to help prevent fraud? When a customer's computer is compromised by a virus/malware, does your bank do the following? Online Billpay 83 In terms of high vs. low impact, please rate the effectiveness of the measures that your bank uses to reduce online billpay fraud Please specify what online billpay control procedures your bank has taken Please specify what means of disbursement of bill payments are used? When billpay fraud is detected, how is the loss avoidance calculated? American Bankers Association 69

4 Mobile Banking Apps 87 Does your bank offer mobile banking apps to your DDA customers? Specify for which mobile operating systems your bank currently offers mobile banking apps In terms of high vs. low impact, please rate the effectiveness of the measures that your bank uses to reduce mobile banking apps fraud Specify mobile banking transactions your bank offers or plans to offer Please specify what mobile banking apps control procedures your bank has taken When fraud is detected before a loss is incurred, how is the loss avoidance calculated? Do you deny claims if the customer does not have updated spyware, virus, firewall or other protection? Mobile Alerts 94 Specify which types of mobile alerts your bank currently offers or plans to offer Which modes of delivery does your bank offer or plan to offer for alerts? For the alerts that your bank currently offers, are customers able to respond/reply directly to these alerts? Specify the methods/modalities of mobile communication your bank currently offers services to your customers Debit Cards 98 Specify debit card transactions your bank currently offers or plans to offer In terms of high vs. low impact, please rate the effectiveness of the measures that your bank uses to reduce debit card fraud Specify ATM/POS control procedures your bank has taken to prevent fraud losses Has your bank issued any EMV compliant debit cards? How do/will you perform EMV reissue? What form of EMV will you issue? What cardholder verification method (CVM) will you use for EMV debit cards? Has your institution implemented Apple Pay? In comparison with the rest of your debit card portfolio, has the Apple Pay fraud experienced by your institution been lower, higher, or the same? What type of fraud has your institution experienced with Apple Pay? What tools has your institution implemented to authenticate yellow path customers? Prepaid Cards 109 Does your bank offer prepaid cards? What types of prepaid cards do you offer? Did your bank experience attempts at prepaid card fraud in 2014? Did your bank experience losses due to prepaid card fraud in 2014? In terms of high vs. low impact, please rate the effectiveness of the measures that your institution uses to reduce prepaid card fraud ACH Transactions 114 Does your bank currently offer or plan to offer ACH origination services to your customers? In terms of high vs. low impact, please rate the effectiveness of the measures that your institution uses to reduce ACH fraud as an ODFI In terms of high vs. low impact, please rate the effectiveness of the measures that your institution uses to reduce ACH fraud as a RDFI Please specify if your bank uses the following ACH fraud prevention measures Did your financial institution experience ACH kiting in 2014? American Bankers Association

5 119 If Yes, did the kiting involve other, non-ach channels? If Yes, which other channels did it involve? Does your institution monitor International ACH Transactions (IAT)? Do your institution s ACH and check platforms communicate? For example, does a stop payment order placed on one platform apply to the other? As an ODFI, specify if your financial institution uses the following prevention measures to mitigate fraudulent ACH transactions for originated debits and/or credits As a RDFI, specify if your financial institution uses the following prevention measures to mitigate fraudulent ACH transactions for received debits and/or credits to business accounts Specify the level of fraud experienced at your institution in 2014, as compared to 2013, with regards to the listed types of ACH fraud Wire Transactions 126 In terms of high vs. low impact, please rate the effectiveness of the measures that your institution uses to reduce wire fraud Does your institution monitor outgoing wires for specific countries outside of OFAC sanctions? Does your institution monitor consumer accounts differently from business accounts? Has your institution experienced an increase in wire fraud and/or attempts in 2014 compared with the previous year? Do you anticipate increased exposure (loss + loss avoided) due to wire fraud in 2015? Do you conduct fraud detection review of branch-initiated wires? Do you allow wire requests origination by the following channels How do you validate these requests? Fraud Losses/Loss Avoidance 134 Did your institution experience any fraud attempts or incur a financial loss during calendar year 2014 caused by the following types of fraud? Consumer Accounts Did your institution experience any fraud attempts or incur a financial loss during calendar year 2014 caused by the following types of fraud? Business Accounts Please report your bank s 2014 total losses from deposit accounts (before any post charge-off recoveries), including fraud and non-fraud losses due to policy violations, employee issues, etc Please report your bank s 2014 total fraud losses from deposit accounts (before any post charge-off recoveries) Report the proportion of your bank's 2014 total fraud losses from deposit accounts by funds withdrawal channel: based on number of cases Report the proportion of your bank's 2014 total fraud losses from deposit accounts by funds withdrawal channel: based on dollar amount Check Fraud Losses 140 Check-related losses per bank total Check-related losses per bank by category New account fraud losses per bank Anticipated check fraud losses in the next 12 months actual check fraud losses from checks deposited at your bank by account age actual check fraud losses from checks deposited at your bank using the listed channels actual check fraud losses by account source actual recoveries from check-related fraud loss Check fraud loss avoidance that, in your opinion, was attributable to your prevention systems and procedures American Bankers Association 71

6 Debit Card Fraud Losses actual gross fraud losses per bank from POS signature debit card transactions Anticipated POS signature debit card losses in the next 12 months actual gross fraud losses per bank from PIN debit card transactions Anticipated PIN debit card losses in the next 12 months Percentage of PIN Debit losses attributed to POS vs. ATM transactions In 2014, did your bank have confirmed incident of skimmers attached to your bank's proprietary ATMs? Consumer debit card fraud loss avoidance that, in your opinion, was attributable to your prevention systems and procedures Small Business Debit Card Losses actual gross fraud losses per bank from small business debit card transactions Anticipated small business debit card losses in the next 12 months 176 Online Banking Losses 158 Please report the following items for your online banking transactions that include billpay, wire, and ACH Report the proportion of your bank's 2014 actual online banking fraud losses by account source Did your financial institution have customers that experienced Business (Commercial) Account Takeover by cyber-thieves in 2014 (i.e., the unauthorized use of valid online banking credentials, typically obtained via online malware such as Trojans that infect a customer s workstations, laptops or computer networks)? If Yes, please provide the following or estimates if available for the full year Did your financial institution have customers that experienced Consumer Account Takeover by cyber-thieves in 2014 (i.e., the unauthorized use of valid online banking credentials, typically obtained via online malware such as Trojans that infect a customer s workstations, laptops or computer networks)? If Yes, please provide the following or estimates if available for the full year Source of your 2014 ATO losses by channel (report separately for business/commercial vs. consumer ATOs) Online banking fraud loss avoidance that, in your opinion, was attributable to your prevention systems and procedures Wire Fraud Losses (for wire transactions that are not initiated via online banking) 166 In calendar year 2014, what was your bank's experience with wire origination/outgoing fraud (not initiated online)? In calendar year 2012, what was your bank's experience with wire receiving/incoming fraud (not initiated online)? Compared to 2013, please report changes in the source of attempted wire fraud in 2014 (not initiated online) (percentage of banks) Compared to 2013, please report changes in the source of attempted wire fraud in 2014 (not initiated online) (mean and median) Wire fraud loss avoidance that, in your opinion, was attributable to your prevention systems and procedures (for wire transactions that are not initiated via online banking) American Bankers Association