Index of Tables Table Number Page General Information 1 For which units in your banking organization are you reporting the information?... 79 2 Your total banking assets and deposits for the units included in this report... 79 3 Distribution of open transaction accounts by account source... 79 4 Total open transaction account portfolio per bank, consumer and business combined... 80 5 New transaction accounts opened per bank in 2016... 80 6 Distribution of new transaction accounts by account opening channel... 80 7 Expenses per bank (internal and external) for prevention, detection, investigation, and prosecution of deposit account fraud... 81 8 Average number of full-time equivalent (FTE) bank staff responsible for prevention, detection, and investigation of deposit account fraud... 81 9 Average number of full-time analysts and management staff responsible for listed prevention systems... 82 10 Areas for which bank s fraud prevention/investigations group is directly responsible... 82 11 Please indicate which of the following fraud management functions are outsourced... 83 12 If not outsourced, which bank departments handle customer claims for the following types of fraud?... 85 13 Does your bank have a policy regarding the customer s liability on unauthorized/fraudulent transactions?... 85 14 If Yes, are customers notified of this policy?... 86 15 If Yes, what modes of communication does your institution use to notify customers of this policy?... 86 16 How often do you communicate this policy to customers?... 86 17 Expected change in transaction volume over the next 12 months for the following channels... 87 18 With respect to deposit account fraud, rate the perceived level of threat against the listed channels/instruments in the next 12 months... 88 19 With respect to deposit account fraud, rate the perceived level of threat of the listed risk to the industry and its customers in the next 12 months... 89 New Account Application Review 20 New account application review for consumer accounts... 90 21 New account application review for business accounts... 91 22 Additional approaches for business account opening... 93 Customer Authentication 23 Selected approaches to authenticate consumer account customers for access to different channels... 94 24 Selected approaches to authenticate business account customers for access to different channels... 97 25 Do you require or encourage your customers to change the access authentication password periodically (e.g., every 90 days)? Exclude situations where the password was reset because the customer has forgotten it.... 100 26 What tools are you offering DDA customers that could help prevent online fraud/account takeover?... 101 27 What level of automation does your institution use to verify the identity of customers using the following digital products?... 103 28 What methodologies does your institution use to monitor, track or analyze digital suspicious transactions?... 103 72 American Bankers Association
29 Which tools does your bank currently use to monitor and detect account takeovers or cross-channel fraud?... 104 30 Do you use the following to maintain your Customer Address File?... 104 Branch/Bank Control 31 Approaches your bank currently uses at banking centers to prevent deposit account fraud losses... 105 32 Education and training to prevent deposit account fraud losses... 105 33 Other fraud prevention approaches... 106 Check Fraud Prevention 34 Approaches banks currently use to prevent check fraud losses deposit review... 107 35 Approaches banks use to prevent check fraud losses on-us/in-clearing... 108 36 Approaches banks use to prevent check fraud losses branch/bank control... 109 37 Approaches banks use to prevent check fraud losses withdrawal controls... 110 38 Approaches banks use to prevent check fraud losses exception holds... 110 39 Approaches banks use to prevent check fraud losses other fraud prevention approaches... 111 40 Do you require positive pay service for corporate accounts that have experienced fraud?... 111 Regulation CC 41 Report the most representative of your published funds availability policy for deposits to established consumer or business transactions accounts that do not qualify as exceptions under Regulation CC.... 111 42 How often do you impose a safeguard exception on your consumer or business accounts to hold funds beyond the two business days?... 112 43 Many banks generally provide funds earlier than the law requires (e.g., the day after deposit). In these instances, banks may impose case-by-case holds that is, holds beyond the bank s usual policy, but no later than two days. If you provide funds earlier than required by Regulation CC, for instance, on the day after deposit, how often do you impose case-by-case holds?... 112 44 On average, how long does it take for a check to return to your institution?... 113 45 Do you accept Remotely Created Checks (RCCs)?... 113 46 Did you receive any check fraud claims in 2016 that had a draft (RCC) associated with them?... 113 47 If yes, specify percentage of your 2016 check fraud claims associated with RCC... 113 Electronic Check Processing and Remote Deposit Capture 48 Do you capture or plan to capture check images at the following locations?... 114 49 Does your bank offer remote deposit capture to customers?... 114 50 Rate the following fraud risks associated with electronic check processing... 115 51 Your banks fraud prevention solutions for electronic check processing... 116 52 Does your bank check for duplicate check presentment using check data (check image and non-image data) and/or ACH conversion data?... 116 53 What check data/check image sources does your bank use to detect duplicate presentment via RDC?... 117 54 How far back does your bank review check data (including check images and nonimage check data) to detect duplicate check presentment?... 117 55 What is the typical lag time your bank experienced for duplicate check presentment?... 117 56 Does your bank require customers to have been with the bank for a specific number of days prior to them being able to use remote deposit image capture?... 118 57 Please indicate which item(s) your bank restricts from being presented via RDC? Consumer (all types)... 118 American Bankers Association 73
58 Please indicate which item(s) your bank restricts from being presented via RDC? Business Desktop... 118 59 Please indicate which item(s) your bank restricts from being presented via RDC? Business Mobile... 119 60 Does your bank have daily transaction dollar limits on items presented via consumer and/or business RDC? Consumer (all types)... 119 61 Does your bank have daily transaction dollar limits on items presented via consumer and/or business RDC? Business Desktop... 120 62 Does your bank have daily transaction dollar limits on items presented via consumer and/or business RDC? Business Mobile... 120 63 Does your bank have item-level dollar limits on items presented via RDC? Consumer (all types)... 121 64 Does your bank have item-level dollar limits on items presented via RDC? Business Desktop... 121 65 Does your bank have item-level dollar limits on items presented via RDC? Business Mobile... 122 66 Does your bank have a limit on the number of items that can be presented via RDC? Consumer (all types)... 122 67 Does your bank have a limit on the number of items that can be presented via RDC? Business Desktop... 123 68 Does your bank have a limit on the number of items that can be presented via RDC? Business Mobile... 123 69 On an ongoing basis, do you screen customers NSF history to determine if they continue to have access to mobile RDC?... 123 70 Do you monitor returned RDC items?... 124 71 Do RDC transactions run through one or more of your existing deposit fraud tools? Report by channel... 124 72 Does your bank conduct negotiability reviews for checks deposited via RDC?... 124 73 What is your bank s threshold for negotiability review for checks deposited via the following channels... 124 Telephone Banking/Call Centers 74 Specify telephone banking/call center transactions your bank currently offers or plans to offer to consumer accounts... 125 75 Specify telephone banking/call center transactions your bank currently offers or plans to offer to business accounts... 127 76 In calendar year 2016, did your bank see an increase/decrease in social engineering/information gathering attempts via your telephone banking/call centers?... 129 77 Did your bank experience the listed types of fraud attempts in 2016 that were originated through the call center?... 129 78 If your bank experienced telephone spoofing in 2016, what measures has your bank taken to detect and prevent telephone spoofing?... 130 79 Do you anticipate increased fraud exposure (loss + loss avoided) in telephone banking/call centers in the next 12 months... 130 Online Banking 80 Specify online banking transactions your bank currently offers or plans to offer to consumers... 131 81 Specify online banking transactions your bank currently offers or plans to offer to businesses... 133 82 Do you offer the following to your deposit account customers to help prevent fraud?... 136 83 When a customer s computer is compromised by a virus/malware, does your bank do the following?... 137 74 American Bankers Association
Online Billpay 84 Does your bank use the listed measures to reduce online billpay fraud?... 138 85 Please specify what means of disbursement of bill payments are used?... 139 86 When billpay fraud is detected, how is the loss avoidance calculated?... 139 Mobile Banking Apps 87 Does your bank offer mobile banking apps to your DDA customers?... 140 88 Specify for which mobile operating systems your bank currently offers mobile banking apps... 140 89 Specify mobile banking apps transactions your bank currently offers or plans to offer to consumers... 141 90 Specify mobile banking apps transactions your bank currently offers or plans to offer to businesses... 144 91 Does your bank use the listed measures to reduce deposit account fraud using mobile apps?... 146 92 When fraud is detected before a loss is incurred, how is the loss avoidance calculated? 148 93 Do you deny claims if the customer does not have updated spyware, virus, firewall or other protection?... 148 94 Does your bank offer or plan to offer person-to-person payment services such as Zelle?... 148 95 If you plan to offer person-to-person payment service such as Zelle in 2017... 148 96 How do you plan to process the listed types of Zelle transactions?... 149 Mobile Alerts 97 Specify which types of mobile alerts your bank currently offers or plans to offer... 149 98 Which modes of delivery does your bank offer or plan to offer for alerts?... 150 99 For the alerts that your bank currently offers, are customers able to respond/reply directly to these alerts?... 151 100 Specify the methods/modalities of mobile communication your bank currently offers services to your customers... 151 Debit Cards 101 Specify debit card transactions your bank currently offers or plans to offer... 152 102 Specify control procedures your bank has taken to prevent debit card fraud losses... 154 EMV Fallback Transactions 103 What was your bank s experience with EMV fallback transactions at point of sale (POS)? Report monthly average EMV fallback rates for 2016... 159 104 What are your bank s strategies to deal with EMV fallback transactions?... 159 Virtual Wallet/Mobile Wallet 105 Has your institution implemented the following?... 160 106 Has your bank developed its own virtual wallet service?... 160 107 In comparison with the rest of your debit card portfolio, the Apple Pay/Samsung Pay/Android Pay/Google Wallet fraud experienced by your institution has been... 160 108 What type of fraud has your institution experienced with Apple Pay/Samsung Pay/Android Pay/Google Wallet?... 160 Prepaid Cards 109 Does your bank issue prepaid cards?... 161 110 What types of cards do you issue?... 161 American Bankers Association 75
111 Did your bank experience the listed types of fraud against prepaid cards issued by your bank in 2016?... 162 ATMs 112 Does your bank own and operate ATMs?... 163 113 Please indicate if your bank uses the following measures against ATM fraud... 163 114 If your bank deploys anti-skim technologies, please answer the following... 163 115 Have you experienced the following types of ATM skimming in 2016?... 164 116 What percentage of your ATM fleet was EMV-enabled as of year-end 2016?... 164 117 For your EMV-enabled ATMs, report the monthly average rate of EMV fallback transactions for 2016... 164 ACH Transactions 118 Does your bank currently offer ACH origination services to your customers?... 165 119 Did your financial institution experience ACH kiting in 2016?... 165 120 If Yes, did the kiting involve other, non-ach channels?... 165 121 Does your institution monitor International ACH Transactions (IAT)?... 165 122 Do your institution s ACH and check platforms communicate? For example, does a stop payment order placed on one platform apply to the other?... 166 123 As an ODFI, specify if your financial institution uses the following prevention measures to mitigate fraudulent ACH transactions for originated debits and/or credits... 166 124 As an RDFI, specify if your financial institution uses the following prevention measures to mitigate ACH fraudulent transactions for received debits and/or credits to business accounts... 168 125 Specify the level of fraud experienced at your institution in 2016, as compared to 2015, with regards to the listed types of ACH fraud. Report for both number of fraud cases and actual fraud losses to your bank.... 169 Wire Transactions 126 Does your bank use the listed measures to reduce wire fraud?... 171 127 Does your institution monitor outgoing wires for specific countries outside of OFAC sanctions?... 171 128 Does your institution monitor consumer accounts differently from business accounts?... 172 129 Has your institution experienced an increase in wire fraud and/or attempts in 2016 compared with the previous year?... 172 130 Do you anticipate increased exposure (loss + loss avoided) due to wire fraud in the next 12 months?... 172 131 Do you conduct fraud detection review of branch-initiated wires?... 172 132 Do you allow wire requests origination by the following channels?... 172 133 How do you validate these requests?... 173 2016 Fraud Attempts/Fraud Loss/Loss Avoidance 134 Did your institution experience any fraud attempts or incur a financial loss during calendar year 2016 caused by the following types of fraud? Consumer Accounts... 173 135 Did your institution experience any fraud attempts or incur a financial loss during calendar year 2016 caused by the following types of fraud? Business Accounts... 176 136 Please report your bank s 2016 total losses and fraud losses from deposit accounts (before any post charge off recoveries), including fraud and non-fraud losses due to policy violations, employee issues, etc.... 178 137 Report the proportion of your bank s 2016 total fraud losses from deposit accounts by funds withdrawal channel (based on number of cases)... 178 138 Report the proportion of your bank s 2016 total fraud losses from deposit accounts by funds withdrawal channel (based on dollar amount)... 179 76 American Bankers Association
139 When your bank charges off a case of cross-channel fraud, where does your bank book the loss?... 179 Check-Related Losses 140 Check-related losses per bank total... 179 141 Check-related losses per bank by category... 180 142 New account fraud losses per bank... 181 143 Anticipated check fraud losses in the next 12 months... 181 144 Report the proportion of your bank s 2016 actual check fraud losses from checks deposited at your bank by account age... 182 145 Report the proportion of your bank s 2016 actual check fraud losses from checks deposited at your bank using the listed channels... 182 146 Report the proportion of your bank s 2016 actual check fraud losses by account source 183 147 2016 actual recoveries from check-related fraud loss... 183 148 Check fraud loss avoidance that, in your opinion, was attributed to your prevention systems and procedures... 183 Debit Card Losses 149 2016 actual gross fraud losses per bank from POS signature debit card transactions... 184 150 Anticipated POS signature debit card losses in the next 12 months... 185 151 2016 actual gross fraud losses per bank from PIN debit card transactions... 186 152 Anticipated PIN debit card losses in the next 12 months... 186 153 Percentage of PIN Debit losses attributed to POS verses ATM transactions... 187 154 In 2016, did your bank have confirmed incident of skimmers attached to your bank s proprietary ATMs?... 187 155 How many ATM skimming incidents did you record in 2016?... 187 156 What was the average loss per ATM skimming incident in 2016?... 187 157 Consumer debit card fraud loss avoidance that, in your opinion, was attributed to your prevention systems and procedures... 187 158 2016 actual gross fraud losses per bank from small business debit card transactions... 188 159 Anticipated small business debit card losses in the next 12 months... 188 Online Banking Fraud Losses 160 Online banking services offered to consumers and non-consumers... 188 161 Online banking (billpay, wire, and ACH) customers per bank... 189 162 Please report the following items for your online banking transactions that include billpay, wire, and ACH... 190 163 Report the proportion of your bank's 2016 actual online banking fraud losses by account source... 191 164 Did your financial institution have customers that experienced Business (Commercial) Account Takeover by cyber-thieves in 2016 (i.e., the unauthorized use of valid online banking credentials, typically obtained via online malware such as Trojans that infect a customer s workstations, laptops or computer networks)?... 191 165 Did your financial institution have customers that experienced Consumer Account Takeover by cyber-thieves in 2016 (i.e., the unauthorized use of valid online banking credentials, typically obtained via online malware such as Trojans that infect a customer s workstations, laptops or computer networks)?... 191 166 If Yes, please provide the following or estimates if available for the full year 2016... 191 167 Did your financial institution have business/commercial customers that experienced Business Email Compromises (BEC) in 2016?... 192 168 If Yes, please provide the following or estimates if available for the full year 2016... 192 169 Online banking fraud loss and loss avoidance that, in your opinion, was attributed to your prevention systems and procedures... 192 American Bankers Association 77
Wire Fraud Losses 170 In calendar year 2016, what was your bank s experience with wire fraud not initiated online?... 193 171 Please report changes in the source of attempted wire fraud in 2016 compared to 2015 194 78 American Bankers Association