A college student, dressed conservatively and boasting a 3.5 grade point average, walks into a U.S. bank branch to cash a check. Just another day — only this "customer" happens to be a member of an overseas Asian gang, and his checks are counterfeit.
Behold the new face of bank fraud and other financial crimes.
"These are often wealthy kids who are just bored, looking for thrills," said Edward Yee, an investigator with the Orange County, Calif., District Attorney's Office.
Authorities say that while most typically Asian, the front men could be white or Hispanic instead. What they have in common is a link to organized crime, which is playing a bigger role in crimes at financial institutions. The organized crime gang in this example would hail from China or the Philippines, Yee said. Authorities say other gangs, from Russia, Romania and Nigeria, among other countries, as well as the United States itself, are proliferating.
Yee, speaking recently at a California Bankers Association-sponsored security management and information technology conference, said overseas Asian gangs are often led locally by older men who also operate legitimate U.S. businesses. They entice young college students to use their own money to open bank accounts. The young men are then flown to other cities to cash counterfeit payroll checks to lessen suspicion and better escape detection, and are flown back to their home base in California on the same day.
In terms of robberies, first-quarter numbers nationally were down 6.6%, to 1,498, but were up in specific regions, such as the greater Houston area. There were 154 robberies in Houston from October 2007 to September 2008, but there have already been 124 robberies from October 2008 to last Friday. (New crime data from the Federal Bureau of Investigation is expected this week.)
Robbers are getting more aggressive, even in note-based robberies without weapons, said Kevin Katz, special agent in the FBI's Houston office. They are also increasingly targeting in-store branches in grocery stores, because those are typically open much later than stand-alone branches, are easier to escape from, and robbers can more easily blend in with distracted shoppers.
To get more tipsters, said FBI Special Agent Stephen Emmett in Atlanta, more field offices are partnering with area banks to launch public Web sites about recent robberies.
FBI agents are also scheduling periodic meetings with area bank security officers to share information, said Bradley Bryant, chief of the violent crimes and major offenders unit in the national FBI.
Online fraud is getting more creative, too, now that banks have tightened security measures around log-ins to their Web sites, said Sean Brady, a senior product marketing manager at EMC Inc.'s RSA Security.
Fraudsters are now using "crimeware" and other malware that people unwittingly download when on certain Web sites (gambling and porn sites are most popular). The malware captures the victim's online banking information as it is typed in, and the fraudster uses that data to set himself up as a "payee" on the bank's site. The fraudster then gets unsuspecting "mules," who believe they have been hired as a telecommuter by a money transfer company, to expedite money transfers to that "payee" once they are e-mailed the victim's information.
To mitigate this, banks are now developing additional security measures for each online banking transaction, or providing one-time passwords for corporate customers, Brady said.
Carmen Oveissi Field, a managing director of Daylight Forensic and Advisory LLC, said that data breach incidents may be on the rise, as more companies downsizing in the recession are outsourcing information technology functions to vendors. Some vendors might not have as high internal security standards as others, giving hackers better opportunities to steal customer information.
The recession is also behind increased internal bank fraud, Field said. Some IT professionals who fear being laid off set up "holes" in the bank's network that would enable them to hack into the network, to either sell proprietary information to new employers if fired or to blackmail the bank to keep them employed.
"They leave a backdoor for themselves so they can get into anything — and information is money," Field said.
Ellen Zimiles, Daylight's chief executive, said that banks should also be on the lookout for employee embezzlement, by more closely monitoring account transactions below the limits that trigger formal scrutiny, such as a $20,000 threshold for transactions within a pension fund account.
Zimiles said that banks should stay mindful of employees who constantly call the bank to check on things while on vacation, for they may be embezzlers who are worried that someone will catch their fraudulent activities while they are away. As a best practice, banks are urged to require employees to take two-week vacations each year, so that long-standing frauds or drawer shortages will hopefully come to light, she said.
More and more banks are developing their own computer forensic labs to identify both external threats and employee fraud, said Jeff Maw, a computer crimes and forensic investigator. Maw works in the Wells Fargo & Co. forensic lab in Charlotte, N.C., that the company inherited when it bought Wachovia Corp. last year.
Wells' lab now has forensic software to access remotely any employee desktop computer or laptop to determine if there is internal fraud, said Maw, who also spoke at the California Bankers conference. Wells' internal investigators do this remotely for two reasons: so the employee won't know that he is being investigated, and so the investigators won't tamper evidence for criminal prosecution or for an employee misconduct hearing for noncriminal activities.
"It's important that we can obtain evidence that's admissible, by showing that the computer hasn't been modified," Maw said.
