Understanding and preventing payment fraud.

Until the last 10 years, the primary exposure of governments to payment fraud was the dishonesty of their own employees. Sophisticated check fraud required special skills and an investment in expensive printing equipment. And since sole responsibility for fraudulent check stock and signatures rested with the banks, losses from external sources were not considered important enough to warrant serious attention.

Times have changed. With the advent and proliferation of inexpensive personal computers, desktop publishing software, laser printers, and blank check stock, almost anyone can alter or counterfeit checks. Indeed, payment fraud has blossomed into a $10 billion dollar industry. At the same time, changes in the Uniform Commercial Code have distributed the liability for payment fraud among banks and their customers. As a result, public entities are more vulnerable to payment fraud than ever before. This article provides tips on how governments can mitigate the risks and lower the costs of payment fraud.

ON THE HOOK 

Historically speaking, financial institutions have been responsible for losses resulting from payment fraud. However, the legal liability for check fraud losses has now shifted to depositors. This section describes the changes that precipitated this increased liability and highlights specific issues that governments should be aware of.

Changes in the regulatory environment. Following the deregulation of the banking industry in the 1980s, banks began to aggressively manage the amount of time they could control a customer's funds. By delaying remittance only a few days, a bank could earn substantial additional revenue. In 1992, however, the Federal Reserve Board modified the rules to allow customers more rapid access to their deposits. Banks were required to make deposits available to depositors even before the check clearing process had been completed. The new regulation actually facilitated check fraud by giving criminals more time to complete fraudulent transactions.

Changes in the Uniform Commercial Code. The Uniform Commercial Code, which governs financial transactions in all 50 states, was modified in the mid 1990s, shifting some liability from the banking industry to depositors under the concepts of "ordinary care" and "comparative negligence." Consider UCC Section 3-103:

   Ordinary care in the case of a person engaged in business means
   observance of reasonable commercial standards, prevailing in the
   area in which the person is located, with respect to the business
   in which the person is engaged. In the case of a bank that takes
   an instrument for processing for collection or payment by automated
   means, reasonable commercial standards do not require the bank to
   examine the instrument if the failure to examine does not violate
   the bank's prescribed procedures and the bank's procedures do not
   vary unreason ably from general banking usage.

In other words, check issuers may be precluded from recovering check fraud losses from their banks if their business practices contributed to the fraud. Notice that the code does not require banks to examine every check. This is a significant departure from the past.

Bank Contracts. Section 4-102(a) of the UCC allows banks to contractually modify to some extent their liability for payment fraud. The contract may also attempt to define the "reasonable commercial standards" of the area. Within the last year, customers of one of the country's largest banks received a certified letter informing them that the bank's definition of ordinary care included the use of positive pay on all checking accounts. The subsequent failure to implement positive pay has resulted in government customers absorbing fraud losses.

Governments need to pay particularly close attention to contractual provisions on the use of facsimile signatures and on bank reconciliation. A Florida court, for example, recently sided with a bank in disallowing the recovery of $4 million worth of counterfeit checks that passed using an exact replica of the customer's facsimile signature. The basis for this decision was a contractual provision that permitted the payment of checks bearing facsimile signatures below a certain dollar amount. In this contract, facsimile signatures that appeared genuine would be honored. To reduce the risk of losses from fraudulent facsimile signatures, include in your banking agreement the provision that all checks above a specified dollar threshold must be verified and must bear a manual signature in addition to the facsimile signature.

Under Section 4-406 of the UCC, check issuers have a duty to reconcile bank statements within a reasonable time and to immediately report unauthorized checks. Many bank contracts define that time to be no more than 14 days. Governments that fail to read and understand their bank contracts do so at their own peril.

THE CHECK FRAUD EPIDEMIC

By all accounts, check fraud is a growing problem. The Nilson Report estimates that annual check fraud losses now exceed $20 billion, up from $12 billion in 1996 and $5 billion in 1993. The American Bankers Association reports that check fraud is growing at a rate of 25 percent per year. Clearly, governments need to understand how criminals perpetrate check fraud and what they can do to stop it.

Two of the most common forms of check fraud are counterfeiting and alteration. Check counterfeiting and ACH frauds are related to identity theft in that the counterfeiter must have acquired your routing number and account number. Once this information has been obtained, today's technology makes counterfeiting a snap. Check production software is now widely available for less than $100. If the high quality stock that is packaged with the software is not enough, a quick Internet search reveals a number of businesses selling blank check stock. A simple phone call or Internet purchase will complete the acquisition. Coupled with an inexpensive laser printer, production of counterfeit checks can begin in minutes.

Check alteration can take several forms. One of the more common methods is the use of solvents to remove portions of the payee or amount lines. After "washing" the check, a fraudulent amount or payee is inserted. Less sophisticated forgers simply attempt to add either additional payees or additional zeros to the amount of the check. Other risks include duplication via copying or unauthorized endorsement. The balance of this section discusses specific practices for preventing check fraud.

Positive Pay. One of the most effective means of preventing check fraud is positive pay, a service now offered by many banks. As we've seen already, at least one major bank considers the use of positive pay as ordinary care, making customers who fail to use the service liable for losses. So what is positive pay? Customers using positive pay send an electronic list of issued checks to the bank. Checks presented to the bank that do not match this list in terms of the account number, check number, or dollar amount are not honored. These "exception items" are returned to the customer, who then either approves or disapproves payment. While positive pay can substantially reduce the risk of check fraud, it will not detect payee alterations or prevent unauthorized endorsers.

Transactions Review. Another valuable service offered by many banks is to make transactions from the previous day available to the customer for review. This task should be performed as soon as possible each morning. Have the data sorted by check number and amount sequences to rapidly spot unusual check numbers or amounts. This service can be particularly useful in detecting ACH debit fraud.

Security Features. The purpose of checks is to facilitate the settlement of financial transactions. It is a well-established system that is based on a trust relationship among parties. One of the factors that facilitate the acceptability of checks is the expectation of the look and feel of the physical check. In many cases, employees of the bank's check processing facilities are the first to spot possibly fraudulent checks because they look different from the normal checks used for that account. Criminals can buy more time to avoid detection if they can closely match the targeted checks. Governments can make counterfeiting more difficult by incorporating the following low-cost security features in their checks:

* Solvent reactive papers will change color when a variety of chemicals used to alter checks are applied to them. Ensure that the color of the check is listed in the security features printed on the check.

* Special bonding agents in the check hold toner more securely to avoid scraping alterations. Laser check printers should be modified to have a higher than normal fusing temperature.

* Void pantographs will display the word "void" when copied. Testing should also be performed on scanners and color copiers.

* Microprinted borders contain printing too small to be reproduced by standard techniques.

* Watermarks cannot be copied by most copiers.

* Holograms and color shifting inks provide additional security.

Laser Printed Checks. Many governments have already followed businesses in adopting the laser printing of checks on blank check stock. While laser printing offers some compelling advantages, it also requires due diligence. Do not buy an off-the-shelf laser printer, for example, and make sure to use quality MICR (magnetic) laser toner. The printer should have fusing temperatures high enough to tightly bond the toner to the check. If you can flake off the toner with a knife or other instrument, the temperature is too low. You should be able to turn off the automatic reprint feature to avoid the printing of multiple check copies, and you should have keys that will allow document printing but not check printing. Finally, reconcile audit reports from the printer with printouts from the financial system of check production for that day, and investigate any variances in the number of checks or the dollar amounts issued.

Account Analysis. Because all bank accounts are not created equal when it comes to fraud exposure, governments should analyze the risk of each account. For example, upon releasing inmates, jails commonly hand these individuals a check for whatever sum is left in their inmate accounts. Obviously, such accounts carry greater risk than most others. After experiencing multiple frauds on its Jail Inmate Account, the Hillsborough County Sheriff's Office in Tampa, Florida, instituted positive pay and modified its policy to give inmates cash instead of checks, thereby reducing check disbursements by 90 percent.

Because of their volume, payroll accounts carry a moderate risk of check fraud. Governments should encourage the use of direct deposit to limit the number of individuals who have access to the all-critical routing number and account number (these numbers need not be printed on direct deposit advices). If direct deposit is not an option, consider issuing ATM payroll cards, which allow employees to access their pay without being issued a check.

While governments have used cash concentration accounts for many years, they should consider the use of disbursement accounts in which disbursements cannot exceed a certain dollar amount. Under this arrangement, checks not exceeding a certain amount could be processed from one account, while special transactions such as large-dollar checks or electronic transactions could each have their own accounts. While the use of disbursement accounts will not prevent fraud, it can help limit the risk of loss and business disruption.

THE RISE OF ACH FRAUD

The automated clearinghouse, or ACH, is a system for moving batches of transactions between institutions for future settlement. A common example of an ACH transaction is the automatic payment of a utility bill. In this transaction, the utility's bank requests an electronic payment from the customer's bank in the amount of the utility bill. ACH can now be used to purchase goods in lieu of a check or credit card. Sales may now be made over the Internet or telephone by providing the customer's checking account information.

Because ACH transactions are faster and cheaper than clearing a paper check, large retailers are now experimenting with check conversions. In this scenario, the retailer electronically scans the account information from a customer's check. The check is then returned to the customer and the scanned information is used to create the ACH transaction. The information required to create ACH transactions is the same routing code and account number printed on paper checks. Once a dishonest person acquires this information, the door is wide open for both fraudulent paper checks and ACH transactions.

ACH fraud occurs when a criminal intercepts account information and uses that information to buy goods and services. Fraudulent ACH activity may evolve as follows:

1. A company sends a check to buy goods or services from a vendor.

2. Someone at the vendor records the account number and routing code from the check.

3. The stolen account information is used to buy goods via ACH either directly from an Internet vendor or by establishing a relationship with one of the many Internet bill-paying companies.

4. The goods are shipped overnight and received before the fraud is detected.

5. The goods are sold for cash.

This example illustrates just one way an account can be compromised through the ACH system. Unfortunately, there are many other avenues. So while ACH fraud is less prevalent than check fraud, governments need to protect themselves against unauthorized ACH transactions. This is possible through ACH filters and blocks. Analogous to positive pay for checks, the level of expected ACH debit activity by an organization can be defined to the bank. Organizations can completely block ACH activity from an account or authorize ACH activity from preauthorized originators or in preauthorized amounts. Banks can also be instructed to clear only ACH transactions that you have originated.

PROTECTING SENSITIVE INFORMATION

In order to commit check or ACH fraud, criminals must first acquire routing codes and account numbers. Even in the information age, the low-tech and time honored method of dumpster diving turns up many intact financial documents such as bank statements, payment reports, and cancelled checks. Another high-reward technique is hacking into the databases where sensitive account information is stored.

Most governments do not realize the amount of bank account information they hold for others. Most of this information is used to create direct deposits for employee payroll. Utilities commonly maintain banking information for the purpose of facilitating recurring ACH transactions that automatically withdraw utility bills from customers' bank accounts. If electronic checks are used to pay vendors, accounts payable also may store banking information. Exposing this private information to unauthorized parties can result in liability, adverse publicity, or both. Strong internal controls are needed to restrict bank account information to a select few within the government. Internal databases must be secure from hackers or other outside parties who would be happy to exploit them through the Internet and other means.

CONCLUSION

One of the primary tenets of a commercial transaction is to know your customer. It was easy to cultivate trust with customers when transactions were primarily local and face-to-face. Now that more and more transactions are being conducted anonymously by telephone or over the Internet, organizations--including public organizations--must develop new methods of identifying and authenticating customers. In the meantime, governments must adopt the preventative measures discussed in this article to avoid becoming victims of large-scale payment fraud.

GFOA RECOMMENDED PRACTICE ON CHECK FRAUD PROTECTION

Background. Despite the increase in use of electronic payments, reports of check fraud also are increasing. Technological advances in computer hardware, software, scanners, Magnetic Ink Character Recognition (MICR) equipped printers, and photocopiers make it increasingly possible to produce fraudulent checks. The Uniform Commercial Code shifts liability for fraudulent items from banks to government and corporate account holders, if an entity has not taken reasonable steps to protect against losses.

Recommendation. The Government Finance Officers Association (GFOA) recommends that governments consider the following steps to protect themselves against check fraud.

* Make use of check stock with security features such as watermarks, "void" pantograph (which displays the word "void" when the check is photocopied), microprinting, laid lines and other backgrounds with multiple patterns or colors, special ink that can be read under ultraviolet light, and chemical coatings that react to attempts at alteration.

* Test check stock to validate security features.

* Secure check stock daily. Remove continuous forms from printer, lock printer, and secure check stock in a locked environment.

* Ensure that there is appropriate security over signature plates, cards, and software.

* Require two signatures on checks over a specified amount.

* Update signature cards routinely and/or when staff changes.

* Reconcile all bank statements and notify banks of discrepancies on a timely basis.

* Provide for physical security of returned checks and check copies or digital images.

* Ensure proper segregation of duties among staff initiating, authorizing, preparing, signing, and mailing payments and reconciling bank statements.

* Conduct periodic and surprise audits or reviews of procedures.

* Set dollar limits for individual checks, particularly on smaller accounts.

* Make use of "positive pay" services provided by banks, through which banks pay only those items that match a check issue file provided to the bank.

* Provide written instructions to local banks regarding the honoring or returning of checks.

* Make use of electronic check presentment (ECP) with the disbursement bank, if available.

* Consider outsourcing the payment process.

* Promote use of electronic funds transfer (EFT).

MICHAEL M. FLETCHER, MBA, CPA, is manager of the Business Improvement Unit for the Hillsborough County Sheriff's Office in Tampa, Florida. A former internal auditor who has direct experience with check fraud, he has presented on payment fraud at numerous conferences, including GFOA's 2003 annual conference in New York City. Mr. Fletcher has also presented at GFOA national training seminars on the topics of cost accounting and financial system selection.