Index of Tables. General Information. New Account Application Review. Customer Authentication

Transcription

1 Index of Tables Table Number Page General Information 1 For which units in your banking organization are you reporting the information? Your total banking assets and deposits for the units included in this report Distribution of open transaction accounts by account source Total open transaction account portfolio per bank, consumer and business combined New transaction accounts opened per bank in Distribution of new transaction accounts by account opening channel Expenses per bank (internal and external) for prevention, detection, investigation, and prosecution of deposit account fraud Average number of full-time equivalent (FTE) bank staff responsible for prevention, detection, and investigation of deposit account fraud Average number of full-time analysts and management staff responsible for listed prevention systems Areas for which bank s fraud prevention/investigations group is directly responsible Please indicate which of the following fraud management functions are outsourced If not outsourced, which bank departments handle customer claims for the following types of fraud? Does your bank have a policy regarding the customer s liability on unauthorized/fraudulent transactions? If Yes, are customers notified of this policy? If Yes, what modes of communication does your institution use to notify customers of this policy? How often do you communicate this policy to customers? Expected change in transaction volume over the next 12 months for the following channels With respect to deposit account fraud, rate the perceived level of threat against the listed channels/instruments in the next 12 months With respect to deposit account fraud, rate the perceived level of threat of the listed risk to the industry and its customers in the next 12 months New Account Application Review 20 New account application review for consumer accounts New account application review for business accounts Additional approaches for business account opening Customer Authentication 23 Selected approaches to authenticate consumer account customers for access to different channels Selected approaches to authenticate business account customers for access to different channels Do you require or encourage your customers to change the access authentication password periodically (e.g., every 90 days)? Exclude situations where the password was reset because the customer has forgotten it What tools are you offering DDA customers that could help prevent online fraud/account takeover? What level of automation does your institution use to verify the identity of customers using the following digital products? What methodologies does your institution use to monitor, track or analyze digital suspicious transactions? American Bankers Association

2 29 Which tools does your bank currently use to monitor and detect account takeovers or cross-channel fraud? Do you use the following to maintain your Customer Address File? Branch/Bank Control 31 Approaches your bank currently uses at banking centers to prevent deposit account fraud losses Education and training to prevent deposit account fraud losses Other fraud prevention approaches Check Fraud Prevention 34 Approaches banks currently use to prevent check fraud losses deposit review Approaches banks use to prevent check fraud losses on-us/in-clearing Approaches banks use to prevent check fraud losses branch/bank control Approaches banks use to prevent check fraud losses withdrawal controls Approaches banks use to prevent check fraud losses exception holds Approaches banks use to prevent check fraud losses other fraud prevention approaches Do you require positive pay service for corporate accounts that have experienced fraud? Regulation CC 41 Report the most representative of your published funds availability policy for deposits to established consumer or business transactions accounts that do not qualify as exceptions under Regulation CC How often do you impose a safeguard exception on your consumer or business accounts to hold funds beyond the two business days? Many banks generally provide funds earlier than the law requires (e.g., the day after deposit). In these instances, banks may impose case-by-case holds that is, holds beyond the bank s usual policy, but no later than two days. If you provide funds earlier than required by Regulation CC, for instance, on the day after deposit, how often do you impose case-by-case holds? On average, how long does it take for a check to return to your institution? Do you accept Remotely Created Checks (RCCs)? Did you receive any check fraud claims in 2016 that had a draft (RCC) associated with them? If yes, specify percentage of your 2016 check fraud claims associated with RCC Electronic Check Processing and Remote Deposit Capture 48 Do you capture or plan to capture check images at the following locations? Does your bank offer remote deposit capture to customers? Rate the following fraud risks associated with electronic check processing Your banks fraud prevention solutions for electronic check processing Does your bank check for duplicate check presentment using check data (check image and non-image data) and/or ACH conversion data? What check data/check image sources does your bank use to detect duplicate presentment via RDC? How far back does your bank review check data (including check images and nonimage check data) to detect duplicate check presentment? What is the typical lag time your bank experienced for duplicate check presentment? Does your bank require customers to have been with the bank for a specific number of days prior to them being able to use remote deposit image capture? Please indicate which item(s) your bank restricts from being presented via RDC? Consumer (all types) American Bankers Association 73

3 58 Please indicate which item(s) your bank restricts from being presented via RDC? Business Desktop Please indicate which item(s) your bank restricts from being presented via RDC? Business Mobile Does your bank have daily transaction dollar limits on items presented via consumer and/or business RDC? Consumer (all types) Does your bank have daily transaction dollar limits on items presented via consumer and/or business RDC? Business Desktop Does your bank have daily transaction dollar limits on items presented via consumer and/or business RDC? Business Mobile Does your bank have item-level dollar limits on items presented via RDC? Consumer (all types) Does your bank have item-level dollar limits on items presented via RDC? Business Desktop Does your bank have item-level dollar limits on items presented via RDC? Business Mobile Does your bank have a limit on the number of items that can be presented via RDC? Consumer (all types) Does your bank have a limit on the number of items that can be presented via RDC? Business Desktop Does your bank have a limit on the number of items that can be presented via RDC? Business Mobile On an ongoing basis, do you screen customers NSF history to determine if they continue to have access to mobile RDC? Do you monitor returned RDC items? Do RDC transactions run through one or more of your existing deposit fraud tools? Report by channel Does your bank conduct negotiability reviews for checks deposited via RDC? What is your bank s threshold for negotiability review for checks deposited via the following channels Telephone Banking/Call Centers 74 Specify telephone banking/call center transactions your bank currently offers or plans to offer to consumer accounts Specify telephone banking/call center transactions your bank currently offers or plans to offer to business accounts In calendar year 2016, did your bank see an increase/decrease in social engineering/information gathering attempts via your telephone banking/call centers? Did your bank experience the listed types of fraud attempts in 2016 that were originated through the call center? If your bank experienced telephone spoofing in 2016, what measures has your bank taken to detect and prevent telephone spoofing? Do you anticipate increased fraud exposure (loss + loss avoided) in telephone banking/call centers in the next 12 months Online Banking 80 Specify online banking transactions your bank currently offers or plans to offer to consumers Specify online banking transactions your bank currently offers or plans to offer to businesses Do you offer the following to your deposit account customers to help prevent fraud? When a customer s computer is compromised by a virus/malware, does your bank do the following? American Bankers Association

4 Online Billpay 84 Does your bank use the listed measures to reduce online billpay fraud? Please specify what means of disbursement of bill payments are used? When billpay fraud is detected, how is the loss avoidance calculated? Mobile Banking Apps 87 Does your bank offer mobile banking apps to your DDA customers? Specify for which mobile operating systems your bank currently offers mobile banking apps Specify mobile banking apps transactions your bank currently offers or plans to offer to consumers Specify mobile banking apps transactions your bank currently offers or plans to offer to businesses Does your bank use the listed measures to reduce deposit account fraud using mobile apps? When fraud is detected before a loss is incurred, how is the loss avoidance calculated? Do you deny claims if the customer does not have updated spyware, virus, firewall or other protection? Does your bank offer or plan to offer person-to-person payment services such as Zelle? If you plan to offer person-to-person payment service such as Zelle in How do you plan to process the listed types of Zelle transactions? Mobile Alerts 97 Specify which types of mobile alerts your bank currently offers or plans to offer Which modes of delivery does your bank offer or plan to offer for alerts? For the alerts that your bank currently offers, are customers able to respond/reply directly to these alerts? Specify the methods/modalities of mobile communication your bank currently offers services to your customers Debit Cards 101 Specify debit card transactions your bank currently offers or plans to offer Specify control procedures your bank has taken to prevent debit card fraud losses EMV Fallback Transactions 103 What was your bank s experience with EMV fallback transactions at point of sale (POS)? Report monthly average EMV fallback rates for What are your bank s strategies to deal with EMV fallback transactions? Virtual Wallet/Mobile Wallet 105 Has your institution implemented the following? Has your bank developed its own virtual wallet service? In comparison with the rest of your debit card portfolio, the Apple Pay/Samsung Pay/Android Pay/Google Wallet fraud experienced by your institution has been What type of fraud has your institution experienced with Apple Pay/Samsung Pay/Android Pay/Google Wallet? Prepaid Cards 109 Does your bank issue prepaid cards? What types of cards do you issue? American Bankers Association 75

5 111 Did your bank experience the listed types of fraud against prepaid cards issued by your bank in 2016? ATMs 112 Does your bank own and operate ATMs? Please indicate if your bank uses the following measures against ATM fraud If your bank deploys anti-skim technologies, please answer the following Have you experienced the following types of ATM skimming in 2016? What percentage of your ATM fleet was EMV-enabled as of year-end 2016? For your EMV-enabled ATMs, report the monthly average rate of EMV fallback transactions for ACH Transactions 118 Does your bank currently offer ACH origination services to your customers? Did your financial institution experience ACH kiting in 2016? If Yes, did the kiting involve other, non-ach channels? Does your institution monitor International ACH Transactions (IAT)? Do your institution s ACH and check platforms communicate? For example, does a stop payment order placed on one platform apply to the other? As an ODFI, specify if your financial institution uses the following prevention measures to mitigate fraudulent ACH transactions for originated debits and/or credits As an RDFI, specify if your financial institution uses the following prevention measures to mitigate ACH fraudulent transactions for received debits and/or credits to business accounts Specify the level of fraud experienced at your institution in 2016, as compared to 2015, with regards to the listed types of ACH fraud. Report for both number of fraud cases and actual fraud losses to your bank Wire Transactions 126 Does your bank use the listed measures to reduce wire fraud? Does your institution monitor outgoing wires for specific countries outside of OFAC sanctions? Does your institution monitor consumer accounts differently from business accounts? Has your institution experienced an increase in wire fraud and/or attempts in 2016 compared with the previous year? Do you anticipate increased exposure (loss + loss avoided) due to wire fraud in the next 12 months? Do you conduct fraud detection review of branch-initiated wires? Do you allow wire requests origination by the following channels? How do you validate these requests? Fraud Attempts/Fraud Loss/Loss Avoidance 134 Did your institution experience any fraud attempts or incur a financial loss during calendar year 2016 caused by the following types of fraud? Consumer Accounts Did your institution experience any fraud attempts or incur a financial loss during calendar year 2016 caused by the following types of fraud? Business Accounts Please report your bank s 2016 total losses and fraud losses from deposit accounts (before any post charge off recoveries), including fraud and non-fraud losses due to policy violations, employee issues, etc Report the proportion of your bank s 2016 total fraud losses from deposit accounts by funds withdrawal channel (based on number of cases) Report the proportion of your bank s 2016 total fraud losses from deposit accounts by funds withdrawal channel (based on dollar amount) American Bankers Association

6 139 When your bank charges off a case of cross-channel fraud, where does your bank book the loss? Check-Related Losses 140 Check-related losses per bank total Check-related losses per bank by category New account fraud losses per bank Anticipated check fraud losses in the next 12 months Report the proportion of your bank s 2016 actual check fraud losses from checks deposited at your bank by account age Report the proportion of your bank s 2016 actual check fraud losses from checks deposited at your bank using the listed channels Report the proportion of your bank s 2016 actual check fraud losses by account source actual recoveries from check-related fraud loss Check fraud loss avoidance that, in your opinion, was attributed to your prevention systems and procedures Debit Card Losses actual gross fraud losses per bank from POS signature debit card transactions Anticipated POS signature debit card losses in the next 12 months actual gross fraud losses per bank from PIN debit card transactions Anticipated PIN debit card losses in the next 12 months Percentage of PIN Debit losses attributed to POS verses ATM transactions In 2016, did your bank have confirmed incident of skimmers attached to your bank s proprietary ATMs? How many ATM skimming incidents did you record in 2016? What was the average loss per ATM skimming incident in 2016? Consumer debit card fraud loss avoidance that, in your opinion, was attributed to your prevention systems and procedures actual gross fraud losses per bank from small business debit card transactions Anticipated small business debit card losses in the next 12 months Online Banking Fraud Losses 160 Online banking services offered to consumers and non-consumers Online banking (billpay, wire, and ACH) customers per bank Please report the following items for your online banking transactions that include billpay, wire, and ACH Report the proportion of your bank's 2016 actual online banking fraud losses by account source Did your financial institution have customers that experienced Business (Commercial) Account Takeover by cyber-thieves in 2016 (i.e., the unauthorized use of valid online banking credentials, typically obtained via online malware such as Trojans that infect a customer s workstations, laptops or computer networks)? Did your financial institution have customers that experienced Consumer Account Takeover by cyber-thieves in 2016 (i.e., the unauthorized use of valid online banking credentials, typically obtained via online malware such as Trojans that infect a customer s workstations, laptops or computer networks)? If Yes, please provide the following or estimates if available for the full year Did your financial institution have business/commercial customers that experienced Business Compromises (BEC) in 2016? If Yes, please provide the following or estimates if available for the full year Online banking fraud loss and loss avoidance that, in your opinion, was attributed to your prevention systems and procedures American Bankers Association 77

7 Wire Fraud Losses 170 In calendar year 2016, what was your bank s experience with wire fraud not initiated online? Please report changes in the source of attempted wire fraud in 2016 compared to American Bankers Association