CCR Magazine

The speed and magnitude of corporate wires creates a stressful environment for fraud investigators, whose decisions can have implications costing hundreds of thousands of pounds. However, the additional controls typical of commercial accounts create opportunities for early detection of fraud staging activities.

Recognising the early signs of account compromise can alert investigators weeks in advance and create a healthier operating environment for fraud investigators.

Eli Katz, VP of Enterprise Fraud Strategies at Internet fraud detection company, 41st Parameter, investigates: "Among fraud-management jobs, managing corporate wires may be one of the most stressful. Not only do the transactions often involve hundreds of thousands or even millions of pounds, but corporations typically handle such a range of transaction types that it is hard to point out an 'atypical transaction'. In addition, the speed at which money can be transferred works against fraud investigators as the careful actions of the fraudsters are not likely to be 'red flagged' until it may be too late.

"Most corporate fraud managers intuitively seek to accelerate the turnaround of their transaction analysis. However, ever-increasing speed may not be the solution. Because corporate treasury services typically have more controls and verification processes than individual consumers, fraudsters must spend more time studying the victim's accounts and staging the fraud. These activities may include understanding the authorisations of phished employees, adding payees, collating numerous security logins, etc.

"Given the richness of fraud-staging activities, fraud management strategies which are carried out on the day of the actual wire transfer cause undue stress. In a departure from traditional approaches, 41st Parameter focuses on early detection of the fraud-staging activities, providing greater visibility over the wire banking channel, as well as all relating online activity. In cases of wire fraud and account takeovers, our focus is on tracking the devices of fraudsters through the various fraud staging processes and our core systems enable fraud investigators to monitor both channels.

"Focusing on the account compromise has another benefit: at any given time there are significantly more compromised accounts than attacked ones. Once a compromised account has been identified, the particulars of the attacker’s online access can be used to identify other accounts compromised by the same fraudster but not yet attacked – further increasing the likelihood of detection and ultimately prevention of fraud."