Unit 9: Electronic Fraud Professor Thomas Genovese

Learning Objectives 1.Understand e-commerce fraud risk. 2.Take measures to prevent e-commerce fraud. 3.Detect e-business fraud.

E-commerce Fraud Risk Pressures Dramatic growth, which has created tremendous cash flow needs. Merger or acquisition activity, which creates pressures to “improve the reported financial results.” Borrowing or issuing stock, additional pressures to “cook the books.” New products, which require intensive and expensive marketing and for which an existing market does not yet exist. Unproven or flawed business models, with tremendous cash flow pressures.

E-commerce Fraud Risk - Opportunities New and innovative technologies. Complex information systems that make installing controls difficult. Complex information systems that make installing controls difficult. The transfer of large amounts of information. Removal of personal contact. Lack of “brick-and-mortar” and other physical facilities. Inability to distinguish large and/or established companies from new and/or smaller companies.  Electronic transfer of funds.  Compromised privacy.

E-commerce Fraud Risk- Rationalization Decreases in the personal contact between customer and supplier. Transactions between anonymous or unknown buyers and sellers. False notion that traditional methods of accounting no longer apply.

E-commerce Fraud Risk Risks Inside an Organization:  Data theft  Social engineering  Sniffing  Wartrapping  Vandalism  Employee laptops

E-commerce Fraud Risk Risks Outside an Organization:  Computer viruses  Spyware  Phishing  Spoofing  Falsified identity  Database query (SQL) injections  Bust-out  and Web visits

E-commerce Fraud Prevention How to reduce pressures and eliminate rationalizations in e-business? Security Through Obscurity: Keeping security holes, encryption algorithms, and processes secret in an effort to confuse hackers.

E-commerce Fraud Prevention Reduce opportunities through appropriate internal controls. Elements: (1) The control environment (2) Risk assessment (3) Control activities or procedures (4) Information and communication (5) Monitoring

E-commerce Fraud Prevention Components of the control environment: Integrity and Ethical Values Board of Directors and Audit Committee Participation Management’s Philosophy and Operating Style Human Resources Policies and Practices

E-commerce Fraud Prevention Risk Assessment Identifies the risks of doing business with e-business partners. Focuses on the control environment of business partners. Identifies the risks involved in electronic exchange of information and money. Intrusion detection.

E-commerce Fraud Prevention Control Activities Adequate separation of duties Proper authorization of transactions and activities Adequate documents and records Physical control over assets and records Independent checks on performance

E-commerce Fraud Prevention Adequate Separation of Duties (who authorizes? – who executes?) Adequate Separation of Duties (who authorizes? – who executes?) Proper Authorizations ( Passwords, Firewalls, Digital signatures, Biometrics) Proper Authorizations ( Passwords, Firewalls, Digital signatures, Biometrics) Additional controls of Electronic Documents and Records (sales invoices, purchase orders, subsidiary records, sales journals, employee time cards, checks). Additional controls of Electronic Documents and Records (sales invoices, purchase orders, subsidiary records, sales journals, employee time cards, checks). Physical Control over Assets and Records (IT equipment, Programs, Data Files) Physical Control over Assets and Records (IT equipment, Programs, Data Files) Independent Checks on Performance (including partners) Independent Checks on Performance (including partners)

E-commerce Fraud Detection Data-driven Fraud Detection 1.Understand the business or operations of the organization. 2.Identify what frauds can occur in the operation. 3.Determine the symptoms that the most likely frauds would generate. 4.Use databases and information systems to search for those symptoms.

E-commerce Fraud Detection Data-driven Fraud Detection: 5.Analyze the results. 6.Investigate the symptoms to determine if they are being caused by actual fraud or by other factors.

That’s All Folks! Good luck in your academic, professional and personal endeavors! Good luck in your academic, professional and personal endeavors!