PREVENTION OF BANKING RELATED CRIME 

 “When Internet banking was introduced, it brought many benefits. For one, customers avoided queues in the banking halls, and could do their transactions from the safety of their homes or anywhere in the world, 24 hours a day.

 But the latest scam shows that the technology has its pitfalls. Crooks are always lying in wait to rip off the unwary. Bank clients will do well to heed the advice from the SA Banking Risk Information Centre on what they must or must not do in order not to fall into the trap of the online banking racket.

Internet Banking scams. Common Internet / email scams : Phishing, Pharming, Website Spoofing, Keylogging

 Phishing 

 Criminals send e-mails purporting to be from the user’s bank.  The e-mail requests the user to click onto a hyperlink within the e-mail in order to update the user’s personal details. Once clicked, the hyperlink will divert the user to a fraudulent or “spoof� website. The information requested is used in identity theft, or to gain access to user’s bank account.

 Pharming

 Pharming occurs when your computer is infected with a virus that attacks the Domain Name Server (DNS) system on the machine. Viruses are transmitted by – Opening an infected email attachment – Accessing / downloading from an untrusted website. When you enter the website address of your bank, the virus re-directs the user to a fraudulent website, purporting to be that of the bank. Confidential user information is compromised and the criminals use this information to defraud the user.

 Website Spoofing

 Website set up to make victim believe they are accessing legitimate bank website. Very similar / identical in design. The domain name or web address is also similar to that of bank website and will often use words related to the target bank’s name or products. phishers may reprogram bookmarks or favourites to redirect victim to a spoof website.

 Key logging

There are two types of key loggers – Software – hardware.  Their purpose is to log all the keystrokes entered on a particular computer.  The keystrokes are then retrieved by the attacker and used for their own purposes. – E.g. to obtain bank account & PIN numbers.

Software key loggers. A software key logger, once installed on your computer, makes a copy of all your keystrokes.  Details of the keystrokes are saved to a file on your computer's hard drive where they can be retrieved by the attacker. In some cases the key logger will send the file to the attacker's anonymous email address. How are they installed?  hacking into your computer. installing the software on the physical machine. encouraging you to run an email attachment that, when executed, will install the key logger software

Hardware key loggers.  Hardware key loggers are units that are usually installed within your keyboard or its cable. They also log your keystrokes and store them within the hardware unit. The attacker will retrieve the unit to access the keystrokes stored in it. How are they installed? The attacker needs physical access to your computer so that they can replace your keyboard and cable with one containing the keystroke logger. Hardware key loggers can look similar to common computer equipment. Be especially cautious when you see new peripherals or cables attached to your keyboard. 

 Internet Banking:- Prevention methods Anti-virus software. Install a reliable anti-virus package that is able to scan all messages, including those from reliable sources, before your open the attachment. Update your virus software at least once a week or more often if you can. Most anti-virus software packages provide "live updates" from the supplier's website every time you connect to the Internet. Review your anti-virus supplier's website to become familiar with new viruses and their behaviour patterns. Operating system. Ensure that your operating system, browser and mail are running on the latest versions. Ensure latest service packs and hot fixes are installed. Ensure you have a reliable company or desktop firewall E-mail setup. Ensure that your email is configured not to allow system generated emails to be sent without your confirmation. This will prevent viruses sending unauthorised e-mails.  Subscribe to an Internet service provider (ISP) that provides a service that scans your emails before they are delivered.

 Handling e-mail. Treat all email with caution. Any email received from someone you don't know, especially if there is an attachment should be treated with suspicion. Generally, plain text emails with no attachments are not at risk of being infected. • If in doubt, don't click on the attachment. – verify with the sender that it was addressed to you & content.

 Physical access. Ensure that no one has unauthorised access to your PC to avoid installation of unauthorised software / hardware. Protect PIN and Password. Restrict internet browsing to known, secure websites. Use password protection as a means of protecting access to your PC. Ensure that you have control over the shared folders on your PC as a shared folder could make your PC vulnerable to unauthorised installation of suspicious software. Avoid using public computers, for example, at Internet cafes, to access financial services such as Internet banking. Rather register for cell phone banking Accessing internet banking. Access bank websites via the bank’s main web page E.g. www.absa.co.za www.fnb.co.za www.nedbank.co.za www.standardbank.co.za. Beware of unusually long website addresses. Familiarise yourself with your bank’s website address. Ensure that you are on the secure Internet banking website by checking that the URL begins with "https" rather than "http". Always ensure the secrecy of your internet bank / Profile number, PIN and Password. Do not use passwords that are easy to crack – Your names, spouse or children, or their dates of birth, anniversaries etc – 1234 or abcde. Use passwords that include a mix of numbers and upper and lower case E.g. p3t3R (Peter) (easy to remember but much more difficult to crack). Make sure that you logoff and close your browser after banking online. Check statements regularly for unauthorised activity.

Keeping your details safe. Treat any email that requests confirmation of personal details with caution – Product offerings – Confirmation of existing account details. Do not use the URL (website address) contained in the body of e-mails or click on the shortcuts provided where the sender is unknown or email unsolicited.

Additional Security Features Use additional security measures offered by your bank such as – random verification number (RVN) generator. Random verification. sms – Sms notification. Enter pin by using on-screen keypad not keyboard. Website spoofing:- Security certificate. When conducting internet banking familiarise yourself with the small padlock in the lower right-hand corner of your browser. Ensure that this is always visible before you log on. Double click on the lock and the security certificate will appear. The security certificate is an assurance by an independent third party, for example, VeriSign, of ownership of a site. The certificate shows you that the address you used to access the site is owned by the bank. It also enables the bank to secure transactions over the internet.

 Due to the technical nature of the scams mentioned and the preventative measures required, we strongly recommend you consult with your internet service provider or an IT service provider for more specific advice.

Cheque fraud

Most Common cheque scams: Intercepted cheques – cheques are intercepted in the mail and chemically “washed� or physically altered to change beneficiary & amount. Employee fraud – employees gain access to employers chequebook and issue fraudulent cheques forging signatures. Manufactured cheques – Duplicate cheque manufactured Cheque fraud:-  Avoid posting cheques. If privately printed company cheques are utilised – ensure latest security features are utilised. Use pens designed for writing out cheques available through stationary shops. Keep cheques secure. Businesses: Segregate duties: – keep a register with an independent person of cheques issued / in stock – Management spot checks.

 Other hints Leave no space in front of the name of the payee and the amount in figures. Unused spaces must be cancelled by drawing lines through them.  Payee details should appear in full, eg- South African Revenue Services, instead of SARS.  Write the amount in figures as closely as possible to the 'R' (Rand) sign. Do not sign blank cheques. Keep returned cheques in a safe place, preferably under lock and key.  punch returned cheques through the magnetic strip to prevent them from being re-used.  Reconcile bank statements regularly.  Report lost, stolen or missing cheques immediately.  Avoid cash cheques where possible mark cheques "not transferable".

Other Scams CASH DEPOSIT SCAM 1. Fraudster places an order for goods / responds to an advert 2. Stolen cheque deposited into the client's account as payment 3. Fraudster advises cash has been deposited & faxes confirmation 4. Faxed deposit slip altered to reflect "cash" 5. Printed teller receipt may also be altered / manufactured 6. In isolated cases original deposit slips are altered and produced as evidence 7. There are cases where cheques have been altered to appear they are bank / bank guaranteed cheques 8. The cheque is returned after delivery of goods resulting in the client having supplied goods and not received payment. ELECTRONIC PAYMENT SCAM  Identical to cash deposit scam, except that a fraudulent electronic payment receipt is used instead of a deposit slip. ELECTRONIC REFUND SCAM  As with cash deposit and electronic payment scams stolen cheques are deposited and “proof� of cash / electronic payment provided. Payment is made in excess of order – E.g. R10 000 instead of R1 000. An electronic refund is requested to a nominated account. – E.g. R9 000 • The seller may oblige, transferring clear funds to the fraudster's account.  Two to three days later, the fraudulent cheque is returned, leaving the dealer out of pocket.  Fraudster may also cancel order and request refund. PRECAUTIONS  Do not accept a faxed bank deposit slips / electronic proof of payment as proof of payment.  Do not rely on the 'available balance' as reflected on an ATM or on Internet Banking as it may include 'uncleared effects', i.e. cheques received for deposit but not yet cleared by the drawee bank. – Many banks allow clients in good standing to draw against uncleared cheques (may be up to a certain limit) – Cheques within this limit reflect as available funds online. Verify "cash" deposits with the branch where the deposit was made. It is recommended that you speak to a senior member of staff and specifically ask if it was cash or a cheque. Obtain the name of the person you spoke to.  Wait for funds to be cleared before releasing goods.  A special clearance can be requested on a cheque to speed up the payment process. There is, however, a fee attached to this service.  Bank Guaranteed / Bank Cheques: There are certain circumstances when even bank-issued cheques will not be honoured. Request confirmation or a special clearance.

 Identity theft WHEN BAD THINGS HAPPEN TO YOUR GOOD NAME  Fraudsters obtain identity, residential, work etc details e.g. through Phishing or stolen documents (theft of handbags / housebreakings). Loans are taken out using manufactured documentation E.g. car loans, Credit cards, Banking accounts, Bonds. Usually the first you know about it is when a facility you apply for is declined due to a blacklisting / judgement. Prevention  Reduce the amount of information that can be stolen by keeping minimal confidential information in your purse or wallet. Keep a watchful eye on your mail to prevent interception by an identity thief. Never give out excessive personal information via the telephone, email or internet. Destroy personal information before disposing of it.  Use different passwords for different accounts, and avoid writing these passwords down. Rather try to memorise them. Obtain a regular report of your credit profile to check for irregularities, such as judgments against your name that you are unaware of.  Conduct reconciliation's on all your accounts on a regular basis to detect unauthorised transactions.  Store all your documentation containing personal data in a safe place, as an unassuming document like a cancelled cheque is a useful source of information to a perpetrator wanting to commit identity theft.  Report any identity document theft to the South African Police Services (SAPS).  If you do not receive your account statements on time, make enquiries at the relevant company or financial institution to ensure that your statements are not being sent to another address.

419 Scams

 Started in 1980s. Originates in Nigeria. Named after the country's criminal code that deals with fraud. How they work 1. You'd get an unsolicited fax, email or letter concerning some business or government entity (often from Nigeria or some other third world / developing country) wanting to get money out of the country. 2. Stationary, website or email make use of logo’s and names of genuine organisations and public figures names such as banks and their CEO’s to give the impression of authenticity 3. The variations of explanations and descriptions of where the "money" came from can be very creative and endless 4. In exchange, you are promised a generous percentage of the fortune. 5. You would at some stage be asked to pay a fee upfront, to extend credit or grant cash-on-delivery privileges. 6. If you agree you'll soon find that your money has been moved to an offshore account and the scam artist has moved on to the next victim. 7. Some variations of this scam have been linked to more serious crimes, such as kidnapping and murder. 419 Scams – prevention  Do not respond to unsolicited requests to facilitate financial transactions. If in doubt – refer to your bank’s forensic dept.

Cash 

 Alternatives – electronic channels, such as internet or telephone banking. – debit or credit card – Approach your bank to arrange accounts for & pay employees electronically – Use Cash in Transit company to transport cash Precautions • Alternate routines – Time – Route – Branch – Vehicles • Be observant of vehicles following – Three consecutive left / right turns will highlight • Keep your eyes open for any suspicious characters in or around the entrance to branches.

ATM FRAUD 

 What are some of the techniques used to carry out ATM crime?  Card swapping – where a customer’s ATM card is swapped for another card without their knowledge whilst undertaking an ATM transaction. Card jamming – where an ATM machine card reader is deliberately tampered with so that a customer’s card will be held in the card reader and cannot be removed from the machine by the customer. The criminal removes the card once the customer has departed.  Vandalism – where an ATM machine is deliberately damaged and/or the card reader is jammed preventing the customer’s card from being inserted.  Mugging – where a client is physically attacked whilst in the process of conducting a transaction at an ATM machine.  Card Skimming – where a fraudster obtains the clients card, copies the magnetic strip and obtains the PIN by shoulder surfing. The client is usually unaware that his card and PIN have been compromised. Only use familiar and well-lit ATM’s. Scan the area for suspicious-looking characters. Have your card ready before you approach an ATM. Only approach if you are sure it is safe to do so. Remain aware of your surroundings whilst conducting your transaction. Do not allow anyone to assist you:-  Beware: criminals often pose as guards or bank staff. Never force your card into an ATM slot. Do not enter your PIN if you feel someone is around you. Don’t let anyone stand too close to you while accessing the ATM. Shield the keypad when entering the PIN. Take your time to complete the transaction. Make sure the card you get back from the ATM after your transaction is yours. Keep your bank’s lost card hotline on your cellphone. Check your balance regularly and report discrepancies IMMEDIATELY.

 If you are defrauded COMPROMISED?

Contact your bank immediately. Record time and exactly who you spoke to – preferably obtain a call reference number. Internet banking:- Change your PIN number online immediately. Do not use facility until bank has confirmed it is safe to do so.       CLAIMING FOR LOSSES. Banks consider claims on individual merits 1. Submit written claim to your bank. Substantiate reasons for holding the bank liable. Quantify your loss. If applicable specify what measures you had in place to prevent loss (generally banks will look more favourably where appropriate measures were taken) 2. Bank may require a police case number 3. Secure evidence such as cheques, documents.

 Complaint Resolution Process

Quote: “The Ombudsman for Banking Services (OBS) resolves individual complaints about banking services and products. We aim to do this impartially, fairly and confidentially.�  Any bank customer who has a complaint against his or her bank may approach the OBS for assistance. The service is free and the only requirements that must be met are that: • The complaint must be within their jurisdiction. • The customer must have followed the bank's complaint handling procedures before approaching the scheme for assistance.  Complaints are resolved by investigating matters according to the rules of the scheme. If the matter has not been resolved by negotiation after investigation, a formal decision may be taken. The decision may be in the form of a determination that is binding on the bank or a recommendation that is not. Quote from the Ombud’s website:  “It is vital to the success of the scheme that the OBS is and is perceived to be independent of the banking industry over which it has jurisdiction. The structure of the scheme ensures that the OBS alone decides whether a bank has acted unfairly or unreasonably when investigating a complaint.�  Any bank customer may lodge a complaint against his or her bank with the OBS, provided the OBS has jurisdiction. Entities such as companies, corporations, partnerships and trusts may lodge a complaint if the person making the complaint is authorised to do so and the annual turnover of the business or group of businesses is R5 000 000-00 or less per year. Complaints OBS can handle • • Complaint relates to products or services provided by the bank;  involves a claim of R800 000-00 or less;  arose within the past 3 years;  the bank concerned is a member of the Banking Association. • a bank's commercial decision about lending or credit, interest rates or Complaints OBS can't handle. bank charges, unless there has been maladministration; a matter that would more appropriately be dealt with by a court of law or another dispute resolving process;  a matter which is or has been the subject of litigation, subject to certain exceptions Steps to resolve a complaint The Ombud’s rules prescribe set procedures for handling a complaint: 1. Contact your bank 2. Giving the bank a second chance 3. Full investigation 4. Settlement, recommendation or determination The first step: Contact your bank. Lodge a formal complaint, preferably in writing outlining the nature of the complaint and resolution desired. If the resolution includes financial re-imbursement the following would assist the bank in making a determination: – Breakdown of loss – Detail reason for holding bank liable. When you lodge a complaint with your bank, make sure the bank gives you a complaint reference number. You will need this number to complete the ombud’s application form.  How long should the bank take to investigate my complaint? The bank should give you a final decision regarding your complaint within a reasonable time as to whether it is prepared to settle the matter with you. Ombud suggests 4 weeks. If you have followed the bank's complaint handling process and are unhappy with the bank's decision or it has not responded within a reasonable time, you may then formally lodge your complaint with the Ombudsman. How do I lodge a complaint with the Ombudsman? You can only do this by completing the Ombud’s Application for Assistance form.  Available from your bank or the Ombud. Online complaint form also available Ombud contact details • • Postal Address The Ombudsman for Banking Services P.O. Box 5728 Johannesburg 2000 • Telephone 011-838-0035 0860-800-900 • Fax011-838-0043 • Website: www.obssa.co.za • Email: info@obssa.co.za The second step: Giving the bank a second chance. If your complaint falls within the Ombud’s mandate:  Ombud refers it to the official designated by your bank to handle complaints that come to the OBS. These bank officials are persons in authority within the bank who ensure that your complaint is taken seriously.  Ombud gives the bank at least 3 weeks to try to resolve the problem with you.  If the complaint is not resolved to your satisfaction, ombud will decide whether a full investigation should be conducted The third step: Full investigation. This proceeds when: – The bank informs ombud that it has not managed to resolve the matter OR – The bank does not meet the deadline set by the OBS. Once all the necessary information has been gathered, a decision can be made.  The decision takes the form of a final recommendation.  A negotiated settlement may be reached at any time before a final decision is made The fourth step: Settlement, assessment, recommendation or determination. It is still possible at this stage for a negotiated settlement to be achieved.  If this does not occur an assessment, a recommendation or a determination may be made by the Ombud. It is recommended you visit Ombud’s website for more information

On the various bank websites there are links to their security sites. Irrespective of the bank you are with, it is recommended you browse these sites as they contain a lot of useful tips. www.absa.co.za  www.fnb.co.za  www.nedbank.co.za  www.obssa.co.za www.standardbank.co.za www.sabric.co.za