2019 AFP Payments Fraud & Control Survey Northern Ohio Association for Financial Professionals September 16th, 2019 Magnus Carlsson Manager, Treasury & Payments AFP © 2019 Association For Financial Professionals, Material is not to be used without consent

About the Survey The survey was sent to Corporate Practitioner AFP Members Data Collected in January 2019 Total 617 (682 in 2018) Responses Sponsored by J.P. Morgan © 2019 Association For Financial Professionals, Material is not to be used without consent

(Percent of Organizations) Percent of Organizations Subject to Attempted and/or Actual Payments Fraud in 2018 (Percent of Organizations) 2018 Sees Another Record High Payments Fraud Level – When Will It Stop? Payments Fraud is Now at a Record High at 82%, Well Above Previous Levels Puzzle Piece 1: New Record Level of Payments Fraud Source: 2004 - 2018 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

(Percent of Organizations) Percent of Organizations Subject to Attempted and/or Actual Payments Fraud in 2018 (Percent of Organizations) Trend Shifting! Overall Fraud is at Record Level! Fraud on Larger Organizations Increase While Fraud on Smaller Organizations Decrease The Gap Between Small and Large Organizations is Widening What’s Behind the Shift? A New Type of Fraud? 2018 2017 Puzzle Piece 2: Larger Organizations See Increased Fraud, Smaller Decreased Source: 2014 - 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

(Percent of Organizations) Actual Direct Financial Loss from Attempted and/or Actual Payments Fraud in 2018 (Percent of Organizations) Overall 43% of Respondents have Actual Losses From Payments Fraud Most of the Losses are Under $25K Source: 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Change in Prevalence of Payments Fraud (Percentage Distribution of Organizations Subject to Attempted or Actual Fraud ) Prevalence of Fraud is Again Increasing! The Levels Stay Elevated Fewer See Less Fraud Source: 2015 - 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

2014 - 2018 Fraud Survey Webinar Poll Question: From a fraud perspective, which payment type worries you the most? Checks Cards ACH Wires Cash 2014 56% 23% 8% 9% 3% 2015 36% 23% 10% 28% 3% 2016 24% 14% 8% 36% 2% 2017 22% 14% 9% 48% 3% 2018 31% 18% 15% 33% 3% 2019 32% 13% 17% 38% 0% © 2019 Association For Financial Professionals, Material is not to be used without consent

Prevalence of Fraud By Payment Method (Percentage Distribution of Organizations Subject to Attempted or Actual Fraud) Payment Methods 2009-2018 Checks Payment Method Most Subjected to Fraud Continues Decline Wires Still at Elevated Level BEC Most Likely the Cause Cards Continues to Decline No Current High Profile Breaches ACH Debits Increased To Record Level Continue Upward Trend ACH Credits Dramatic Increase compared to previous Trend What is Behind it? Puzzle Piece 3: ACH Sees the Only Increase in Fraud Source: 2010-2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Time Taken to Discover Occurrence of Fraud (Percentage Distribution of Organizations that Experienced Attempted/Actual Fraud) All SM Large All Almost 70% of Fraud Discovered in Two Weeks – Unchanged Larger Organizations a Little Slower But, There is a Delay: Discovery within a week down to 42% from 47% The Extra Days are Important – Time for Frausters to get away… SM Large All SM Large © 2019 Association For Financial Professionals, Material is not to be used without consent

Sources of Attempted / Actual Payments Fraud in 2018 (Percentage Distribution of Organizations Subject to Attempted or Actual Fraud) Fraud is Continuously Changing BEC Keeps Increasing Despite Education Despite “easiness” of Prevention The “Sophisticated” Fraud Also Growing Hand-in-Hand with BEC Notable: Organized Crime is a Declining Trend! I made one typo change in title to be consistent Puzzle Piece 4: Sophisticated Fraud, Account Takeovers Increase! Source: 2014 - 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Organizations Subject to Attempted and/or Actual Business Email Compromise (BEC) Fraud (Percentage Distribution of Organizations Subject to Attempted or Actual Fraud) All Small Large BEC Scams Grow! First Time Over 50% Report Actual BEC Losses Trend Shift: Larger Organizations See Big Increase in Attempts and Actual Losses Smaller Organizations Almost Unchanged A T E M P D F R U A T E M P D F R U A T E M P D F R U A C T U L O S A C T U L O S A C T U L O S Puzzle Piece 5: Larger Organizations Bigger Target – Trend Shift Source: 2016 - 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Payment Methods Impacted by Business Email Compromise (BEC) (Percentage Distribution of Organizations that Suffered from Fraud) Trend Break! ACH Credit Sees Huge Increase as Target for BEC Scams ACH Debits also Increase Wires Continues to Decline Still the Most Impacted Payment Method Checks Decline to its Lowest Level Big Difference Between Large and Small Organizations Puzzle Piece 6: ACH Sees Big Increase as Target for BEC Source: 2016 - 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

(Percentage Distribution of Organizations that Suffered from Fraud) Estimated Total Dollar Amount of Actual Financial Loss Resulting From Business Email Compromise (BEC) (Percentage Distribution of Organizations that Suffered from Fraud) No Losses Drop to 46% from 54% Increase in Losses up to $50K Big Increase in Large Losses over $2mm $100-$250k Elevated - Unchanged Source: 2016 - 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

(Percentage Distribution of Organizations that Suffered from Fraud) Estimated Total Dollar Amount of Actual Financial Loss Resulting From Business Email Compromise (BEC) (Percentage Distribution of Organizations that Suffered from Fraud) - Per company size Smaller Organizations See More Losses in the Lower Brackets Larger Organizations Have More Losses in the Higher Brackets - Not Surprising! Source: 2016 - 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

(Percentage Distribution of Organizations that Experienced BEC Fraud) Internal Control Methods Implemented to Prevent Business Email Compromise (BEC) (Percentage Distribution of Organizations that Experienced BEC Fraud) Large Organizations Have More Internal Controls In Place Big Differences in Verification of Information Changes (Account Numbers, Etc.) Also, in Color Coded External Emails Low Concern for Phishing? Source: 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Times Organization Experienced Attempted or Actual Check Fraud in 2018 (Percentage Distribution of Organizations that Suffered at Least One Attempt of Check Fraud) Generally, Respondents Indicate Either Few Attempts, or Many Differences Between Small and Large Org: Smaller Org. Sees More 1-5 Attempts and Fewer 20 or more Attempts Larger Org. Sees Fewer 1-5 Attempts and More 20 or more Attempts = Larger Org. Are Not Protecting Themselves Enough! Source: 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Fraud Control Procedures Used to Guard Against Check Fraud in 2018 (Percentage Distribution of Organizations that Suffered at Least One Attempt of Check Fraud) Looks Pretty Good! However, Daily Reconciliations Down Why? Increased Segregation of Accounts and Payee Positive Pay A Realization that Protective Measures are Worth it? Source: 2016 - 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Fraud Control Procedures Used to Prevent ACH Fraud (Percentage Distribution of Organizations that Suffered at Least One Attempt of ACH Fraud) Few Changes However, Daily Reconciliations are Down Debit Blocks Up to the Highest on Record Separate Accounts Down Source: 2014- 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

(Percentage Distribution of Organizations) Preparedness for Additional Risks as Faster Payments such as Same-Day ACH Becoming Operational (Percentage Distribution of Organizations) More Organizations Overall do not plan for additional Mitigation (Red) Big Differences Between Small and Large Organizations Increased Uncertainty (Green) Fewer Organizations Say they have Already implemented But More say they are in the Process All Small Large Source: 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Corporate/Commercial Cards Most Prone to Fraud (Percent of Organizations) T&E Cards and Purchasing Cards are Most Prone to Fraud Airline Travel Cards seem pretty Safe Source: 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Reasons for Loss Suffered with Use of Corporate/Commercial Cards (Percent of Organizations that Experienced Card Fraud) Overall 33% of Respondents Experienced Actual Losses from Cards 35% of Large Organizations Had Card Losses 26% of Small Organizations Had Card Losses Fraudulent Credit Card Charges by a Third-Party Tops Source: 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Concerns Regarding Fraud in the Retail Industry (Percent of Organizations in the Retail Industry) Greatest Concern are Chargebacks and Card-Not-Present Fraud Biggest Concern for Large Retailers Stolen Cards and Gift Cards a Bigger Problem for Smaller Organizations than for Large Synthetic Identity Fraud is Fairly New but Already Quite a Concern Source: 2019 AFP Payments Fraud and Control Survey, Association for Financial Professionals © 2019 Association For Financial Professionals, Material is not to be used without consent

Puzzle Pieces – Paints the 2018 Payments Fraud Picture New Record Level of Payments Fraud What Does All This Mean? Larger Organizations have become a bigger target for Payments Fraud, in Particular BEC ACH Fraud is Increasing and the New Trend is the Use of ACH as a Vehicle for the BEC Scams Together with other Sources this Could Indicate HR Departments are Begin Targeted An Increase in Account Takeovers Indicates a Growing Trend of Internal Systems Being Compromised This Could Indicate a Heightened Risk of Successful Phishing Attacks Aimed At Larger Organizations Phishing May Be More of a Problem than you Think. Be Aware! Puzzle Piece 2: Larger Organizations See Increased Fraud Puzzle Piece 3: ACH Sees the Only Increase in Fraud Puzzle Piece 4: BEC and Sophisticated Fraud, Account Takeovers Increase! Puzzle Piece 5: Larger Organizations Bigger Target for BEC – Trend Shift Puzzle Piece 6: ACH Sees Big Increase as Target for BEC © 2019 Association For Financial Professionals, Material is not to be used without consent

Contact Information Magnus Carlsson Manager Treasury & Payments Association for Financial Professionals (AFP) Mcarlsson@afponline.org © 2019 Association For Financial Professionals, Material is not to be used without consent