SVB ONLINE SEMINAR

It’s a Jungle Out There: How You Can Protect

Your Company from Business Account Fraud

July 28, 2010

2

Panelists

• Wesley Wilhelm - Senior Analyst, Aite Group, LLC

• Thomas Ravenelle - Assistant Special Agent in Charge, Federal

Bureau of Investigation

• Linda Coven - Head of Online Banking Solutions, Silicon Valley Bank

Online Banking Fraud: An Evolving Fraud

Environment

Wesley WilhelmSenior Analyst

Aite Group, LLC

4

Agenda

• It’s all about Authentication!

• Why should you care?

• Fraudsters & technology evolve.

• What do businesses & bankers say?

• The bank fraud environment.

• Fraud loss migrations in context.

5

Multi-Factor Authentication

Three basic ―factors‖

o Something the customer knows

• User ID, Password, PIN, security question answer

o Something the customer has

• Debit/Credit card, chip card, token, phone, etc..

o Something the customer is

• Biometric; voiceprint, fingerprint, iris/retina scan

o Multiple items of the same factor (e.g. 3 things the customer

knows) is not multi-factor.

6

Authentication Approaches

• User ID and Password

o Strong and Weak

• Security Questions

o Pre-defined, Customer selected

• Device Identification

o Active registration, Passive identification

• Knowledge Based Authentication

o Out of wallet, Bureau and non bureau based

• Tokens

o Hardware, Software, Disposable

• Out of Band Authentication

o Phone, email, website,

7

Why Is This An Issue?

• The average balance, per account, is in the range of $500,000.

• Half a million dollars, on average, in a single account immediately

makes the your account a high value target.

• Fiduciary responsibility by customer to reduce risk through

diversification of accounts.

• Protect corporate assets, fraudsters read the same press we do.

8

Tomorrow’s Challenges

• Fraud attacks are compromising multiple factors

o Log in credentials, one-time passwords,

o Device sessions in real time, and

• Convergence of telephony & computing

o Land lines to cell phones to smart phones

• Dual Band Single Use

• Dual Band Simultaneous Use

• The phone and the computer are one

9

Evolving Attack Methods

MITB – Man-in-the-Browser Attacks

o Stolen Online Banking log in credentials

• Activates on login & steals credentials & OTP

• Blocks session and re-logs in from another machine

o Remote Control

• Malware uses customer’s machine as a proxy to connect,

appears to be legitimate customer

o Session Hijacking

• Malware intercepts the session and activity then invisibly

changes payee and amounts

10

What do Businesses Say?

11

Concern About Security

12

What Bankers Say

13

Online Banking Fraud

14

The Fraud Environment

15

The Fraud Environment

16

The Fraud Environment

17

Shifting Losses

18

Shifting Channel Importance

19

Cross-channel, Online & RDC

FBI Cyber Investigations

Thomas RavenelleAssistant Special Agent In Charge

Federal Bureau of Investigation

21

FBI Cyber Program

• Cyber Division formed in 2002

• Cyber career path

o Cyber squads in all 56 field offices (4 in SF)

o National Cyber Investigative JTF

• Regional Cyber Action Teams

o Agents, forensic examiners, others

o Contractor support

22

Focusing on the Threat

• National Cyber Investigative Joint TF

o 17 LE and intelligence agencies

o Based in Northern Virginia

o Coordinates domestic cyber investigations

o Organized into Threat Focus Cells

• Informal dissemination within group

• Formal dissemination between agencies

23

The FBI Strategy

• Prioritize against the greatest threats

• Identify the most important actors

• Target them with sophisticated investigations

• Prosecute them wherever they are

24

FBI Cyber Priorities

• Counterterrorism Intrusions

• Counterintelligence Intrusions

• Criminal Intrusions

• Online Child Exploitation

• Intellectual Property

• Internet Fraud

25

FBI Criminal Investigations

• Various cyber-related offenses

o Unlawful access to computers

o Material support to terrorism

o Espionage/Economic Espionage

o Use of the Internet to trade child porn

o Intellectual Property Rights

o Fraud

26

Cyber Fraud Criminal Hierarchy

Coders

Bot Herders

Carders

Mules

Brokers

Vendors

Developers

Arrows

Kingpin

OC

27

Aggressive Investigations

• Techniques

o Undercover operations

o Wiretaps

o Confidential Human Sources

o Traditional investigative techniques

28

Getting the Word Out

• Dissemination ASAP of case information

o Even in active criminal investigations

• Informing those who can use the data

o Within government

• Intelligence Community

• Information Assurance – DHS, USCERT

o Private sector

• InfraGard

• ISACs

o General public

29

Getting the Word Out

30

Overseas Efforts

• FBI Agent assigned to Romanian National Police for last

four years

• Russia assisting with Cyber investigations and helping

FBI get more involved with Ukraine (Estonia and the

Hague soon)

• FBI Cyber asked to join Europol to combat organized

Cyber criminal efforts

• FBI International Operations Division

31

Panama City

Caracas

Santo Domingo

Bridgetown

Bogota

Brasilia

Santiago

Buenos Aires

San Salvador

Astana

Athens

Tallinn

Bucharest

Budapest

Sofia

Prague

Warsaw

Moscow

Sarajevo

Sofia

Kyiv

Tbilisi

Berlin

London

Paris

Bern

Madrid

Rome

Brussels

Vienna

Copenhagen

Ottawa

Mexico City

Algiers

Cairo

Lagos

Nairobi

Pretoria

Freetown

Dakar

Rabat

Canberra

Tokyo

Seoul

Hong Kong

Bangkok

Manila

Singapore

Beijing

Jakarta

Phnom Penh

Kuala LumpurAbu Dhabi

Amman

Ankara

Doha

Tel Aviv

Riyadh

Islamabad

New Delhi

Kabul

Baghdad

Sanaa

FBI Legal Attaché Offices

32

Mitigation Strategy

• Intelligence Information Reports and Intelligence Bulletins to ICo Scope of the scheme and Malicious code used

• Public Service Announcemento Detailed technical mitigation and prevention recommendations

o Posted on the Internet Crime Complaint Center (IC3) website

o Distributed via InfraGard, FS-ISAC, ECTFs & Visa

• Personal contact with all U.S. victims by cyber agents

• All Legal Attaches notified regarding foreign victims

• Identification of subjects & dismantlement of criminal infrastructure

33

Current Methods

• Small - medium-sized businesses attackedo Plus local governments and schools

• Spear-phishing attackso Directed to financial officer or credential holder

o Causes computer to be infected by malware• Harvests credentials

• Fraudulent ACH transferso To money mules

o Wired overseas

34

Money Mules

• Small armyo Some larger than1,600 and counting

o Some likely witting and some unwitting

• Recruited through ―Work at Home‖ Adso Also via Monster and CareerBuilder

• Hired as ―Financial Managers‖ or ―Payment Processors‖

• Open bank accounts in true names

• Receive ACH transferso Cash out

o Wire the money to account in

• Russia, Ukraine, Moldova

• Usually Western Union or Moneygram

35

How to Avoid Being Victim

• Do you visit websites by clicking on links within an

email?

• Do you reply to emails from companies or persons you

are not familiar with?

• Have you received packages to hold or ship to someone

you met on the Internet?

• Have you been asked to cash checks and wire funds to

an employer you met online?

• Would you cash checks or money orders received

through an online transaction without first confirming

their legitimacy?

• Would you provide your personal/banking information as

a result of an email notification?

36

FBI’s Internet Crime Complaint Center can be

found at www.ic3.gov

www.lookstoogoodtobetrue.com

What Your Company Can Do

Linda CovenHead of Online Banking Solutions

Silicon Valley Bank

38

The Key to Safety

38

•There is no silver bullet

•Mix solutions to match the threato Usabilityo Resource constraintso Business requirements

•At a minimumo Use the best security you can affordo Educate your employeeso Monitor your accounto Notify your bank of fraud ASAP

39

Primary Reasons Companies Experience Losses

Failure to enforce internal controlso Failure to reconcile or return checks on a timely basis

o Internal Fraud (by employees)

o Loss, theft or counterfeit payroll checks

o Mismanagement of on-line users (suspend or delete as appropriate)

o Changes of vendor addresses to employee’s address (Match your AP vendor address file to your employee file)

Failure to use fraud prevention serviceso Account Reconciliation

o Positive Pay/Payee Validation

o Reverse Positive Pay

o ACH Debit Blocks

Source 2008 AFP Payments Fraud and Control Survey

40

Internal Controls

Strong internal controls are essential1. Reconcile regularly: Daily account review accounts daily; weekly or monthly

account reconcilement to spot anomalies

2. Require two to tango: Separate duties so that it takes at least two people to complete a transaction-one who initiates and another who approves

3. Structure your accounts: Separate your operating accounts, rather than sharing accounts and access-and only allow access based on defined function

4. Review daily activity online

5. Physical controls over pre-printed check stock/facsimile signatures

6. Close accounts which have had fraudulent activity

7. Keep authorizations up-to-date

8. Know your employees: Verify references and check criminal background

9. Check accounting records closely for several months

10. Know your vendors

11. Protect your access credentials

41

Protect Your Computer

• Keep your operating system and Web browser up-to-date.

• Use anti-virus software and keep it up-to-date.

• Beware of Wi-Fi hotspots

• Do not install software without knowing what it is

• Downloading a new application is simple and convenient, but be

cautious about what you install

• Log off when you are through using SVBeConnect

• Do not click inside pop-up windows unless they are from a trusted

Web site

• Watch for people looking over your shoulder

41

42

Prevent Online Fraud

• Use strong passwords: Include letters, numbers and characters;

change frequently

• Protect confidential information, passwords/PINs

• Review/train online users

• Use dual control services when possible

• Make use of alerts: To flag large and unusual transactions and

activities

• Trust your eyes: Look for visual clues (e.g. last logon time)

• Take advantage of available fraud prevention tools

• Stay current and informed: Read bulletins and emails

• Logout: Do not simply close the browser, make sure you

actually use the log-out feature

42

43

FS-ISAC* Recommendations

• Reconcile accounts daily

• Mandate dual control

• Install a dedicated computer for accessing online banking and initiating payments

• Educate employees and customers on risks, including social engineering and computer security best practices

• Build internal relationships and cross-department event/incident information sharing (e.g. Fraud, Information Security, Compliance, Treasury Management)

• Incorporate external information into your incident response process

• Implement Positive Pay

• Assess and implement stronger information security technologies and best practices

• Implement fraud detection and predictive analytics systems

• Partner with law enforcement

• Perform risk assessments of IT software and hardware supply chain

• Understand, prepare and react quickly

• Work on developing long term infrastructure solutions

• For retailers, monitor card reversal transactions in order to detect fraudulent activity

• For retailers, establish clear procedures for handing card reversal transactions

* Financial Services - Information Sharing and Analysis Center

43

44

What Does SVBeConnect Offer?

We focus most fraud prevention activities behind the scenes, utilizing

multiple tools to monitor and profile behavior and activity so as not to

impact the client experience

• Controls

o Flexible controls for management of account/transaction access including multiple

levels of approvals by payment type, amount and account

o Dual administration of user entitlements

o Intra-day reporting of transactions

o Alerts of events, balances and transactions

o Positive pay

• Online security options

o Virtual slider (a software based token)

o Trusteer’s Rapport

o Call to Verify (Out of Band in session authentication)

o Choice of a virtual keypad or text pad to enter strong passwords

44

45

Fraud Resource Center

45

http://www.svb.com/fraud/

46

Trusteer’s Rapport

Rapport differs from Anti-Virus and Firewalls

o Locks down access to financial and private data instead of looking for

malware signatures

o Communicates with your online banking Web site to provide feedback on

security level and report unauthorized access attempts

o Enables you to take immediate action against changes in threat

o Blocks Zeus, Torpig, Silent banker and other Man in the Browser attacks

o Blocks malware attacks including key-loggers, screen scrappers and

pharming

o Enables phishing site detection and confirmation

46

47

Call to Verify Triggered

47

48

Call to Verify Code

48

4949

Questions?

5050

Wesley Wilhelm

Wesley Wilhelm is a senior analyst at Aite Group, LLC, covering fraud management, payments, and retail banking technology and operations with an emphasis on the ATM, branch and call center channels.

Mr. Wilhelm brings to Aite Group over 25 years of experience in banking and consulting to the banking industry. At banks, he has held management positions in risk and fraud management, credit card issuing, debit card issuing and ATM driving, merchant acquiring, and branch and call center operations.

Mr. Wilhelm is a recognized Fraud Management thought leader for his pioneering research on the Fraud Management Lifecycle Theory. He has been widely quoted by the press, in publications such as Banking Technology, Collections and Credit Risk, and USA Today, and has been a speaker at numerous industry/client events and conferences including Association of Certified Fraud Examiners (ACFE), Economic Crime Institute, ABA Bankcard Conference, and Inside ID. Mr. Wilhelm has published numerous articles on fraud management in publications such as Journal of Economic Crime Management, Credit Card Management, Card Technology, and the White-Collar Crime Fighter.

Most recently, Mr. Wilhelm was an operations executive at Merchant e-Solutions, where he led the launch of a merchant fraud and chargeback management service offering. Prior to that, he was vice president of retail risk management at JPMorgan Chase (formerly Washington Mutual) where, among other achievements, he managed to drastically reduce fraud losses within the Washington Mutual debit card portfolio. Previously, Mr. Wilhelm was a director of business consulting with FICO (formerly HNC Software Inc.) where he was involved in the development of eFalcon and the creation of Falcon ID. Before that, he held management roles at various banks, including Seafirst Bankcard Services (now part of Bank of America), Santa Barbara Savings and Loan, City Commerce Bank, and The Chartered Bank of London (now part of Union Bank).

He has taught university-level courses in Economic Crime Management at Utica College and led a seminar on Advanced Fraud Analysis at North Carolina State University.

A Certified Financial Crime Investigator, Mr. Wilhelm holds an M.S Degree in Economic Crime Management from Utica College, and a B.A in Economics and Political Science from the University of California. He is also an Olympic-style target archer.

Senior Analyst

Aite Group, LLC

wwilhelm@aitegroup.com

509.448.3961

5151

Thomas Ravenelle

Assistant Special Agent in Charge (ASAC) Thomas P. Ravenelle entered the FBI as a Special

Agent in 1987. After completing New Agent training, he was assigned to the St. Louis Division,

where he served on a violent crimes squad responsible for bank robbery, extortion, and

kidnapping investigations.

In 1991, he was transferred to the San Francisco Division and assigned to investigate white collar

crime cases, including financial crimes and fraud matters. ASAC Ravenelle was reassigned to

investigate international and domestic terrorism matters in 1993.

In 1995, he successfully completed the Hazardous Devices Course at Redstone Arsenal,

Alabama and he was certified as a Special Agent Bomb Technician. ASAC Ravenelle was

promoted to Supervisory Special Agent in 1998 and he supervised several squads tasked with

investigating domestic terrorism, international terrorism, and criminal enterprise matters.

In 2006, ASAC Ravenelle was promoted to Team Leader in the Inspection Division at FBI

Headquarters. In this capacity, ASAC Ravenelle participated in more than 20 inspections of field

offices, FBIHQ divisions, and Legal Attache offices.

In 2008, ASAC Ravenelle was promoted to his current position and assigned as Program

Manager for the Cyber and Civil Rights programs for the San Francisco Division.

ASAC Ravenelle has served on both the St. Louis and San Francisco FBI SWAT teams, and he is

currently the San Francisco FBI SWAT Commander

Asst. Special Agent

FBI, SF Division

1919 Bascom Ave.,

Suite 400

Campbell, CA 95008

5252

Linda Coven

Linda Coven, Head of Online Banking Solutions Channel Management, is responsible for

developing and maintaining SVBeConnect, Silicon Valley Bank’s primary online banking platform.

SVBeConnect, is a system customized for SVB’s unique client base — technology and life

science companies, private equity firms, and the premium wine industry.

Linda has more than 25 years experience in all aspects of cash management and has held key

product management and sales management positions with leading financial institutions and

treasury management innovators, including Wells Fargo Bank, and BankBoston (Fleet). Before

joining SVB, Ms. Coven was a founding member of Clareon and Xign, two technology start-ups

that developed network-based electronic payment models.

Linda currently serves on the American Bankers Association’s Payments Systems Committee,

which acts as the ABA’s primary liaison with the Federal Reserve banks and Federal Reserve

board’s regarding payments system issues, corporate and retail banking operations, and relevant

Federal Reserve products and services. She has been a frequent speaker at industry forums and

was named the ―Voice of Financial EDI‖ by NACHA in 1999. She has published articles on

electronic commerce and electronic payments. Ms. Coven received her BS from Western

Michigan University and is a graduate of the University of Southern California School of

Management Executive MBA program. She is active in the California Humane Society and an avid

supporter of the Leukemia and Lymphoma Society’s ―Light the Night‖ program.

Head of Online

Banking Solutions

Silicon Valley Bank

lcoven@svb.com

408.654.7308

5353

Disclosures

This material, including without limitation the statistical information herein, is provided for informational purposes only. The material is based in part upon information from third-party sources that we believe to be reliable, but which has not been independently verified by us and, as such, we do not represent that the information is accurate or complete. The information should not be viewed as tax, investment, legal or other advice nor is it to be relied on in making an investment or other decision. You should obtain relevant and specific professional advice before making any investment decision. Nothing relating to the material should be construed as a solicitation or offer, or recommendation, to acquire or dispose of any investment or to engage in any other transaction.

The views expressed by third party presenters are their own and do not necessarily reflect those of SVB Financial Group, or its affiliates.

Silicon Valley Bank is a member of the FDIC and the Federal Reserve and it is the California bank subsidiary of SVB Financial Group, which is also a member of the Federal Reserve. Products and services offered by Silicon Valley Bank are not covered by SIPC or FDIC insured, are not deposits or other obligations of Silicon Valley Bank, and may lose value.

Neither SVB Financial Group nor its affiliates provide tax or legal advice; clients should consult their own accountants and attorneys for such advice. Aite Group and the Federal Bureau of Investigation are independent third parties and are not affiliated with SVB Financial Group or its affiliates.