1

Tools,TipsandTechniquestoMitigateFraud

September2017

2

Agenda• EmailThreats• EstablishControls• FraudInvoiceSchemes• ReducingRisk

3

EmailThreats

4

WhatitallMeans

PHISHING

SPOOFING

SMISHING

MASQUERADING

Infectedfiles/maliciouslinkssentthroughemail

Infectedfiles/maliciouslinkssentthroughSMSmessage

Emailmessageswithaforgedsenderaddress

Attackthatusesafakeidentity,suchasanetworkidentity,togainunauthorizedaccesstopersonalcomputerinformationthroughlegitimateaccessidentification

successfulfraudulenttransaction

5

§ Lookslikealegitimatecorrespondencefromthecompany

§ Wordingdoesnothavethelevelofrefinementexpectedfromanauthenticcompanymessage

§ Hasanattentiongetter– highdollaramountofacellbillinthisexample

§ Embeddedlinksactivatemalwaredownloadonyourdevice

§ Someindividualsclickonthelinksandmaynotevenrecognizetheydon'thavearelationshipwiththecompany

ClassicPhishing

6

From: Chris@othercompany.comSent: Wednesday,June1,201510:30amTo: Joe@mycompany.comSubject: Invoicepayment#R64274

Joe,Paymentwassent.Letmeknowifyouneedtheconfirmationnumber.---------------------------------------------------------From: Joe@mycompany.comSent: Wednesday,June1,201510:20amTo: Chris@othercompany.comSubject: Invoicepayment#R64278

DearChris,Pleasepayattentiontothismail,aboutpaymentthereisnowchangeinourbankaccountdetails.WereceivedanalertfromourBANKaboutpresentsecuritychallengeswhichtheyarefacedwith,notingthattherewereseveral unauthorizedaccessandwithdrawalstoourcompanyaccount.SopresentlyourbankconfirmedthatweshouldSTOPallincomingpaymentstotheaccountuntilthebankcompletetheirsecurityupdate.Pleasesendthepaymenttooursubsidiaryaccount.

BeneficiaryBank:ABCDHongKongBeneficiaryName:EMCA(HK)LimitedBeneficiaryAddress:10/GF,SuperluckInd.CentrePhase3,37ShaTsuiRd,TsuenWanAccountNo:073-029562-658BankCode:003SWIFTCode:ABCDHKHHHKHBranchAddress:17Queen'sRoadWest,HK.HongKongThankyou.---------------------------------------------------------From: Chris@othercompany.comSent: Wednesday,June1,201510:10amTo: Joe@mycompany.comSubject: Invoicepayment#R64274

Joe,Iresearchedtheinvoicesandyouarecorrect.FoundthesecondinvoiceR64274.Iwillgoaheadandprocessthepaymentfor$283,011.67tothesameaccount.

Thanks.---------------------------------------------------------From: Joe@mycompany.comSent: Wednesday,June1,20159:45amTo: Chris@othercompany.comSubject: Invoicepayment#R64278

HiChris,Thepaymentmentionedbelowwaswellreceived.Thankyou.However,IfoundoutyouskippedoneinvoiceR64274whichisreferringtotheshippingticket#115320(seeattached).MayIaskyouif#115320and#115317wereduplicated,becauseyoupaidR64278referringto#115317.ThesetwoseparateticketsforROR-185 300lbsatthesamePOnumber,butIreceivedseparately.

Pleaseadvise.Joe---------------------------------------------------------

Isanyonemonitoringyouremailsorthatoftherecipient?

1. Messagebetween2companiesonthepaymentofaninvoice.- Paymentreceived.Questioningpaymentonsecondinvoice.

2. Researchrevealspaymentonsecondinvoiceislegitimatelyowed.

3. EmailInsertion- Readingtheinteractionbetweencompanies- Seesthatapaymentisgoingtobesent- Alertssendersomethingiswrongwithprimarybankaccount.- Fundsneedtobesenttoanalternateaccountwhilebankisresearchingissue.- Salutationdifferentthanprioremails- Languagenotcrisp- UsesCapsandalertphrases

4. Confirmationthatpaymentwassenttothecriminal’saccount.

E-MailMonitoring/Insertion

1

2

3

4

7

SomePhishingschemesinvolvemimickinginternalemails.§ Basedoneasytoobtaininformation

(Socialmediasites,Professionalassociations,companywebsite)theperpetratoroffraudknowskeyplayersandtheirrolesinyourcompany.

§ Domainnamesareregisteredthatsoundlikeyourcompany;butinvolveintentionalmisspellings.

§ InitialmessageisfakebutappearstobecomingfromSeniorexecutiveswithinthecompany

§ Focusonconfidentialityandurgency

Ifyoureceiveanemailsuchasthis:§ Contactthesenderbyanalternatemethod

tovalidatetheinstruction§ Followyourauthenticationprocedures§ Employdualcontrolspriortomaking

paymentchangesorprocessingpayments§ Validatethatcorrespondenceislegitimate

Spoofing/Masquerading

From:Treasurer@mycompany.comSent:Tuesday,July8,201411:17amTo:chris.smith@mycompany.comSubject:FW:WireTransfer

Thisisthethirdone.Wearepullingtheconfirmationnowandwillsendtoyou.

From:Treasurer@mycompany.comSent:Wednesday,June11,201411:30amTo:chris.smith@mycompany.comSubject:FW:WireTransfer

FYI,thisneedstogetprocessedtoday.Icheckedwith(insertnamehere)togetyourhelpprocessingitalong.Iwillassumewetakecareofanyvendorformsafterthefact.Icansendanemaildirectlyto(insertnamehere)orletyoudrivefromhere.Letmeknow.

From:Treasurer@mycompany.comSent:Wednesday,June11,20149:59amTo:chris.smith@mycompany.comSubject:FW:WireTransfer

Processawireof$73,508.32totheattachedaccountinformation.Codeittoadminexpense.Letmeknowwhenthishasbeencompleted.

Thanks.

------------------------Forwardedmessage---------------------------------

From:CEO@rnycompany.comSent:Wednesday,June11,20146:45amTo:Treasurer@mycompany.comSubject:WireTransfer

Insertname(Treasurer),

Perourconversation,Ihaveattachedthewiringinstructionsforthewire.Letmeknowwhendone.

Thanks.Insertname,(CEO)

Lookatthespellingofthewordsandnamescarefully

CEO@mycompany.com

CEO@rnycompany.com

8

RansomwareEmergingfraudtrend

Ransomwareisatypeofmalwarethatrestrictsaccesstotheinfectedcomputersystem• Demandsransomtoremovetherestrictions• Someformssystematicallyencryptfilesonthesystem's

harddrive• Difficultorimpossibletodecryptwithoutpayingthe

ransomforthedecryptionkey,somemaysimplylockthesystemanddisplaymessagestocoaxtheuserintopaying

• Mostransomwareentersthesystemthroughattachmentstoanemailmessage

Forconsideration• Uptodateanti-virussoftware• Emailgatewaysecurityproducts• Employeeeducation

RansomwareBrandNames

FakeBsodTescrypt Krypterade

99

EstablishControls

Establishothercommunicationchannels,suchastelephonecalls,toverifysignificanttransactions.Arrangethissecond-factorauthenticationearlyintherelationshipandoutsidetheemailenvironmenttoavoidinterceptionbyahacker

Bewareofsuddenchangesinbusinesspractices. Forexample,ifsuddenlyaskedtocontactarepresentativeattheirpersonalemailaddresswhenallpreviousofficialcorrespondencehasbeenonacompanyemail,verifyviaotherchannelsthatyouarestillincommunicationwithyourlegitimatebusinessassociate

Donotusethe"reply"option torespondtoanemailwithtransactionactivityorapprovalsforpayments.Instead,usethe"forward"optionandeithertypeinthecorrectemailaddressorselectitfromtheemailaddressbooktomakesurerealemailaddressisused

10

FraudulentInvoiceSchemes

11

FraudulentInvoices

AnothertrendimpactingcompaniesistheFraudulentInvoice:

§ ItisavariationonthePhishingemails.§ Fraudstermailsaninvoicetothecompany;often

addressedtotheAPdepartment§ Invoicehasdescriptionof“Investment”§ Invoiceusuallyincludesremittanceinformation

includingtheaccounttowhichfundsaretobepaid

IfyoureceiveanInvoicesuchasthis:

§ Verifythecompanyisanapprovedexistingandcurrenttradingpartner

§ Verifyitisforanactualpurchaseorworkperformedbythecompany

§ Confirmtheaccountontheinvoiceiswhatyouhaveonfileforthecompany

§ Caution– donotaddanewvendor,withanewaccount,andpayaninvoiceallinthesamestep

12

ReduceRiskExposure

13

§ Ifyou’regivingemployeesaccesstoyouraccounts,limitaccesstosensitivefunctionalitysuchaspaymenttransactions.

§ Setupyouraccountsothatanypaymentsscheduledbyoneemployeemustbeapprovedbyaseparateuser.

§ Setupapprovallimitsaroundtransactions.Thiscanbedonebytransactionamount,typeoftransaction.

§ Setupe-mailormobilenotificationstomultiplemembersofyourmanagementteamifanypaymentsareinitiatedoveracertainamount.

§ Requestnotificationsofanysignificantchangesinyourbalancessothatanyproblemscanbeaddressedimmediately.

EstablishSegregationOfDuties

Offline§ Havemorethanonepersonreviewbankreconciliations.§ Requiremorethanonesignatureforchecksoverasetamount.§ Makesurethereisdualcontroloverthephysicalcheckstock.

1414

ManagingFraudRisk

Fraudstersareincreasinglytargetingcompaniesthatconductonlinebusiness,employingsophisticatedtoolsdesignedtocompromiseyoursystemandsurrendercontrolofyourcomputer.

Bankexpertsandindustryleaderssharetrends,toolsandtacticsforallbusinesssegmentsthroughvideovignettes,casestudies,podcasts,andfeaturedwhitepapers.

Learnmore:managingfraudriskwebsite

AMONGONLINEBANKINGSERVICESPEERSFraudpreventionandmonitoring

SecurityadministrationandcomplianceSource:GreenwichAssociatesOnlineServicesBenchmarking,2014

#1

Considersolutionstohelpreduceyourexposuretofraud.▪ Notifications▪ CheckandACHPositivePay▪ PrepaidandCorporatecards

FRAUDPROTECTIONANDIDENTIFYSAFETYCARDSOLUTIONS

Source:JavelinStrategy&Research,2014#1

Tounderstandactionsyoucantaketohelpyourcompanyreducetherisksassociatedwithfraud,reviewonlinesecuritytipsandbestpractices togetstartedtoday.

DOCUMENT anactionplannowDevelopasoundinternalprocessfortransactionsusingthehighestindustrystandards.Communicateandenforcetheplanacrosstheorganization.Createaseparateplantorespondtoaninformationcompromiseevent.Keepinmindthataninformationbreachmayimpacttreasuryactivities.

EDUCATE yourteamonbestpracticesEstablishothercommunicationchannelssuchastelephonecalls,toverifysignificanttransactions.Donotusethe"reply"optiontorespondtoanemailwithtransactionactivityorapprovalsforpayments.

TAKEACTION

15

§ Beproactive inconductingperiodicfraudandsecuritytraining§ Don'tassumeemployeesunderstandemailandinternetrisks§ Setrulesforpersonalinternetusage– tellthemwhy§ Articulateemployeepoliciesforthemonitoringoftheircomputeractivity§ Formaltraining:don'trelyonlyonyourcompany'semailorintranettoinformemployeesofemailand

internetpoliciesandprocedures§ Considerrestrictingtheabilitytoload/downloaddataonyourcompanycomputers§ Showemployeeshowtorecognizethreatsandconveytheconsequencesofthosethreats§ Beexplicitaboutwhattolookfortoidentifyamaliciousemail§ Explainthatuserswillkeeppasswordsinasecureplaceandnottosharethemwithcoworkers§ Providefrequentreportsofnewthreatsandstatisticsofhowmanyviruseshavebeencaughtwithinyour

organization§ Neverturnoffsecurityprotectiononyourcomputerandstaycurrentwithupdates§ Donotuseyourpersonalcomputerforcompanybusiness§ Donotconnecttotheinternetthroughsuspectwirelessnetworks(e.g.,Wi-Fifromacafé)§ Forwardsuspiciousemailstothecompany'sdesignatedemailsecurityteam(includetheemailaddress)§ Openonlyidentifiableattachmentsfromknownsources.Financialinstitutionsandgovernmentagencies

neveraskyoutoenterpersonaldata,suchaspasswords,SSN,accountnumbers,etc

ThereisaDirectCorrelationBetweenEmployeeFraudEducationandDecreasedNumberofSuccessfulFraudAttacks

FraudAwarenessTraining

16

Appendix

17

GlossaryofTerms

§ MaliciousSoftware; softwareusedorcreatedbyattackerstodisruptcomputeroperation,gathersensitiveinformation,orgainaccesstoprivatecomputersystems.

§ DistributedDenialofService– isanattackwheremultiplecompromisedsystems–whichareusuallyinfectedwithaTrojan – areusedtotargetasinglesystemcausingincomingtraffictofloodthevictim

§ AthreatrelatedtoManintheMiddlewhereawebbrowserisinfectedbyaproxyTrojanthatallowswebpagesandtransactionstobemodifiedcovertly,invisibletoboththeuserandtheapplication.

§ Theactofattemptingtoacquireinformationsuchasusernames,passwords,andcreditcarddetails(andsometimes,indirectly,money)bymasqueradingasatrustworthyentityinanelectroniccommunication. Phishingemailsmaycontainlinkstowebsitesthatareinfectedwithmalware.

§ Isaformofcriminalactivityusingsocialengineeringtechniques. SMSphishingusescellphonetextmessagestodeliverthebaittoinducepeopletodivulgetheirpersonalinformation.Thehook(themethodusedtoactuallycapturepeople'sinformation)inthetextmessagemaybeawebsiteURL,butithasbecomemorecommontoseeatelephonenumberthatconnectstoanautomatedvoiceresponsesystem.

Malware

DDOS

ManInTheBrowser(MITB)

Phishing

SMishing

18

§ MalwareTrojanthatusesfakepopupadstoforcetheinfectedvictimtobuymalicioussoftwaretorepairitoranytypeofdrive-bydownloadstoloadbadsoftware

§ Istheactionofrecordingorloggingthekeysstruckontheakeyboard(tocaptureuserIDs,passwords,etc.)

§ Issoftwarethataidsingatheringinformationaboutapersonororganizationwithouttheirknowledgeandthatmaysendsuchinformationtoanotherentitywithouttheconsumer'sconsent,orthatassertscontroloveracomputerwithouttheconsumer'sknowledge

GlossaryofTerms(Cont'd)

Trojan

KeystrokeLogging

Spyware

1919

Disclaimer

"Bank of America Merrill Lynch"isthemarketingnamefortheglobalbankingandglobalmarketsbusinessesofBank of AmericaCorporation.Lending,derivatives,andothercommercialbankingactivitiesareperformedgloballybybankingaffiliatesofBank of AmericaCorporation,includingBank of America, N.A.,memberFDIC.Securities,capitalmarkets,strategicadvisory,andotherinvestmentbankingactivitiesareperformedgloballybyinvestmentbankingaffiliatesofBank of AmericaCorporation("InvestmentBankingAffiliates"),including,intheUnitedStates,Merrill Lynch, Pierce, Fenner & SmithIncorporatedandMerrillLynchProfessionalClearingCorp.,bothofwhichareregisteredbroker-dealersandmembersofSIPC,and,inotherjurisdictions,locallyregisteredentities.MerrillLynch,Pierce,Fenner&SmithIncorporatedandMerrillLynchProfessionalClearingCorp.areregisteredasfuturescommissionmerchantswiththeCFTCandaremembersoftheNFA.Thisdocumentisintendedforinformationpurposesonlyanddoesnotconstituteabindingcommitmenttoenterintoanytypeoftransactionorbusinessrelationshipasaconsequenceofanyinformationcontainedherein.ThesematerialshavebeenpreparedbyoneormoresubsidiariesofBankofAmericaCorporationsolelyfortheclientorpotential clienttowhomsuchmaterialsaredirectlyaddressedanddelivered(the"Company")inconnectionwithanactualorpotentialbusinessrelationshipandmaynotbeusedorrelieduponforanypurposeotherthanasspecificallycontemplatedbyawrittenagreementwithus.Weassumenoobligationtoupdateorotherwiserevisethesematerials, whichspeakasofthedateofthispresentation(oranotherdate,ifsonoted)andaresubjecttochangewithoutnotice.Undernocircumstancesmayacopyofthispresentationbeshown,copied,transmittedorotherwisegiventoanypersonotherthanyourauthorizedrepresentatives.Productsandservicesthatmaybereferencedinthe accompanyingmaterialsmaybeprovidedthroughoneormoreaffiliatesofBankofAmerica,N.A.Wearerequiredtoobtain,verifyandrecordcertaininformationthatidentifiesourclients,whichinformationincludesthenameandaddressoftheclientandotherinformationthatwillallowustoidentifytheclientinaccordancewiththeUSAPatriotAct(TitleIIIofPub.L.107-56,asamended(signedintolawOctober26,2001))andsuchotherlaws,rulesandregulations.Wedonotprovidelegal,compliance,taxoraccountingadvice.Accordingly,anystatementscontainedhereinastotaxmatters wereneitherwrittennorintendedbyustobeusedandcannotbeusedbyanytaxpayerforthepurposeofavoidingtaxpenaltiesthatmaybeimposedonsuchtaxpayer.Formoreinformation,includingtermsandconditionsthatapplytotheservice(s),pleasecontactyourBankofAmericaMerrillLynchrepresentative.InvestmentBankingAffiliatesarenotbanks.Thesecuritiesandfinancialinstrumentssold,offeredorrecommendedbyInvestment BankingAffiliates,includingwithoutlimitationmoneymarketmutualfunds,arenotbankdeposits,arenotguaranteedby,andarenototherwiseobligationsof,any bank,thriftorothersubsidiaryofBankofAmericaCorporation(unlessexplicitlystatedotherwise),andarenotinsuredbytheFederalDepositInsuranceCorporation("FDIC")oranyothergovernmentalagency(unlessexplicitlystatedotherwise).Thisdocumentisintendedforinformationpurposesonlyanddoesnotconstituteinvestmentadviceorarecommendationoranofferorsolicitation,andisnotthebasisforanycontracttopurchaseorsellanysecurityorotherinstrument,orforInvestmentBankingAffiliatesorbankingaffiliates to enterintoorarrangeanytypeoftransactionasaconsequentofanyinformationcontainedherein.Withrespecttoinvestmentsinmoneymarketmutualfunds,youshouldcarefullyconsiderafund'sinvestmentobjectives,risks,charges,andexpensesbeforeinvesting.Althoughmoneymarketmutualfundsseektopreservethevalueofyourinvestmentat$1.00pershare,itispossibletolosemoneybyinvestinginmoneymarketmutualfunds.Thevalueofinvestmentsandtheincomederivedfromthemmaygodownaswellasupandyoumaynot getbackyouroriginalinvestment.Thelevelofyieldmaybesubjecttofluctuationandisnotguaranteed.Changesinratesofexchangebetweencurrenciesmaycausethevalueofinvestments todecreaseorincrease.Wehaveadoptedpoliciesandguidelinesdesignedtopreservetheindependenceofourresearchanalysts.Thesepoliciesprohibitemployeesfromofferingresearchcoverage,afavorableresearchratingoraspecificpricetargetorofferingtochangearesearchratingorpricetargetasconsiderationfororaninducementtoobtainbusinessorothercompensation.

Copyright2015BankofAmericaCorporation.BankofAmericaN.A.,MemberFDIC,EqualHousingLender.