As you begin recruiting and interviewing employees, you'll obviously be drawn to certain candidates because of their experience, educational background and personality. While it's easy to make a decision based on what you see in front of you, it's wise to consider what may be hidden from view, too.
Small businesses, unfortunately, are particularly vulnerable to embezzlement and other kinds of employee theft because they lack the checks and balances of big corporations. One report by the Association of Certified Fraud Examiners found that the median loss for small firms with fewer than one hundred employees was $190,000. The most common schemes? Employees fraudulently writing company checks, skimming revenues and processing phony invoices.
You can increase your chances of avoiding problems— and spotting dishonesty— by beefing up your hiring practices. Here's how to do it.
• Use a formal job application. Take a page from corporate America's book and supply job candidates with an application that requests full name, address, education, employment record (with years) and references. An application that includes all of this information can give you a clearer picture of someone's background than, say, a resume that he or she provides. Also, it's wise to state on the application that supplying false information can lead to dismissal. Documentation can help protect you in the event of an employee lawsuit.
• Ask tough questions. Carefully review the application, and during the in-person interview, ask probing questions, especially about gaps in employment. A candidate may certainly have any number of innocent explanations (such as attending school, reevaluating his or her career or caring for a child or other family member), but gaps between jobs can indicate an inability to hold down a position, a sudden dismissal or, at worst, a prison stay. Arrange for others at your company (or a trusted advisor, if you're a solo entrepreneur) to meet the person as well; getting a second or third opinion to confirm your impressions will help you make more solid hiring decisions.
• Call former employers and check references. Often, former bosses don't want to provide too much negative information, for fear that they could be sued for defamation. At the least, you should be able to verify the person's employment history and salary history. The best question to ask a former employer is simply, "Is this person eligible for rehire?" If the answer is no, that's a definite red flag.
• Perform a background check. Preemployment checks can screen out applicants who may be unfit (or dangerous) for your workplace because of a criminal record. Some states may require that employers in certain industries— say, child care or health care— conduct background checks. A background check also can confirm the accuracy of information that the candidate provided on the application. While a background check isn't necessary for all employees, it's smart to conduct one on a job candidate who will have access to sensitive data or your company's finances. The Fair Credit Reporting Act, which sets standards for employment screening, requires that you get consent from a potential employee before conducting a background check. Check the FTC's website to make sure you are in compliance. Also, you don't want to run afoul of state or federal laws concerning the kinds of information an employer uses to make employment decisions. If you do perform a background check, ask a business owner or your attorney for a referral to a reputable firm.
• Invite a potential hire for a paid tryout. You can learn a lot about potential employees, including how well they fit into your small business environment, by inviting them to work on a test project or spending a trial run in your office. A tryout may be a particularly good way to test an applicant's technical skills— say, a proficiency with a type of software— and may reveal far more than a reference or background check.
Source :- The Wall Street Journal, By Colleen Debaise
Monday, March 1, 2010
Tuesday, February 23, 2010
Customer Vs. Bank: Who is Liable for Fraud Losses?
Comerica/EMI Case Raises Key Questions About Responsibility, Security
At first, this court case was a curiosity: Experi-Metal Inc. (EMI), a Michigan-based metal supply company, sued Comerica Bank, claiming that the bank exposed its customers to phishing attacks.
Now this story shapes up as a significant test case for the banking industry, raising several key questions that must be answered about fraud and responsibility.
"It will establish who is liable in the U.S. - the bank or the customer - for fraud losses that result from phishing," says Tom Wills, Senior Analyst, Security, Fraud & Compliance, Javelin Strategy & Research.
The Basics
The lawsuit, filed by EMI in a Michigan circuit court, alleges that Dallas-based Comerica opened its customers to phishing attacks by sending emails asking customers to click on a link to update the bank's security software. In January 2009, an EMI employee opened and clicked on links within a phishing email that purported to be from Comerica. The email duped the employee into believing the bank needed to update its banking software. Subsequently, more than $550,000 was stolen from the company's bank accounts and sent overseas.
EMI says even though the bank had two-factor authentication using digital certificates for its online banking portal, the phishing scam was able to circumvent these measures. The bank says its online security methods were reasonable "because they were in general used by other similarly situated customers of other banks." Now that this case is in the courts, observers say, several important questions will be debated re: trust, responsibility and security.
Among them:
#1: How Much Trust is Lost?
Clearly, Comerica has lost EMI's trust, but how much further can this costly loss of confidence spread among banking customers - even at other institutions? "Cases like this, when they hit the courts and the press, work at a macro level to erode the trust of all banks by all customers, even affecting those institutions with good anti-phishing programs in place," says Javelin's Wills. "It will make it that much harder for all banks to migrate their customer base to the highly cost-effective (from an operational standpoint) online channel."
Anytime a company incurs a data breach that compromises personal information, the organization risks having its customers walk away for good. "That's why it's so important that, before an incident occurs, a company take proactive steps to implement a reasonable security program," says Alysa Hutnik, a lawyer at Kelley Drye & Warren, a Washington DC-based law firm that specializes in post-incident response. "Even after a breach, if a company handles the issue responsibly, those efforts can earn back trust bit by bit. But here, where a customer is out of pocket hundreds of thousands of dollars as a result of a breach and was compelled to file a lawsuit to redress the issue, yes, the trust is likely lost."
Because trust is so fundamental to banking institutions, they have to draw a distinct line, says Avivah Litan, an analyst at Gartner. "Either banks explicitly and visibly warn their customers that banking with them is not safe and that [customers] are held liable for hacking into their accounts through online banking," she says. "Or they assume liability."
#2: Is a Bank Liable For Phishing?
Should a bank be held liable for a customer's employee falling for a phishing email that supposedly represents the bank? The EMI/Comerica case highlights several hotly debated issues.
On the plaintiff's side, the employee's vulnerability to the phishing attack raises the core question of 'What is sufficient training?,' says attorney Hutnik. Most employees have been warned about phishing attempts, but even the most robust training does not protect against occasional human error. Does this training need to occur more frequently, or is it a matter of customizing the training to the evolving and specific types of phishing attempts? If a company is going to be responsible under the law for employees' vulnerability to phishing attempts, Hutnik says, that's a pretty good incentive to increase training.
Can a bank be held liable? Some security experts say emphatically 'No.' "The bank clearly could have made better decisions on how to update security information," says Branden Williams, Director of VeriSign's PCI Practice. "But judging by the timelines, they may have been ahead of their time with offering multi-factor authentication for online business banking."
Williams quotes an old saying: "I'll open the door for you, but only you can walk through it." Comerica did open the door with its security updates, he says, but a simple training issue would have prevented the employee from walking through that door. "Companies that become complacent with security become easy targets."
#3: What is 'Reasonable Security?'
In this case, was the bank's two-factor security token technology an unreasonable safeguard based on the information available at the time it was implemented by the company? Discovery and expert testimony on this point will be critical, says Hutnik. So too, will the surrounding facts on what information the bank provided to its customers about giving personal information online, or in response to an email alert, leading up to and after it transitioned away from the digital certificate security process.
Hutnik sees a third key issue, which is often a gap in many companies: What measures were in place to detect unauthorized, unusual activity involving this customer account, and did the bank act quickly enough in response to such detection? "All companies could benefit from evaluating and assessing how they compare the issues raised in this case against their own information security programs," she says.
David Navetta, a lawyer at the Information Law Group, a Colorado-based law firm, says one of the issues that will be key in this case is whether the bank has a legal duty to prevent these types of phishing attacks. And if so, whether the security measures it took were "reasonable" under the law. To the extent a bank has a general duty to protect client accounts, does that duty extend to preventing (or reducing the risk of) its customers from being duped by social engineering attacks such as phishing? "That will be the threshold legal question, and I don't know what the answer will ultimately be," he says.
Another point that Navetta says will be considered is "Reasonableness." Under the law for purposes of negligence, a defendant can avoid liability even if a plaintiff suffered harm, as long as the defendant did not breach its duty of care. "In this context, if the bank's security measures where 'reasonable' under the law, it would not be liable," Navetta says. "I think the fact that the bank used two-factor authentication will help its cause in this respect," he says. On the other hand, he adds, "Many security professionals I have spoken to/read have indicated that a phishing attack was a known weakness, or at least a theoretical weakness, of two-factor authentication."
Regulators Were 'Asleep at the Wheel'
While EMI and Comerica argue over liability, Gartner's Litan says the nation's legislators and banking regulators bear the bulk of the blame for such breaches. "It's their job to set the rules for soundness and safety of the U.S. banking system, and to enforce that the banks execute those rules," she says. "They are negligent here - in not passing legislation that protects business accounts (as Reg E protects consumer accounts) and in not enforcing security measures at the banks, as set forth by the FFIEC strong authentication guidance," Litan says.
Litan also has strong words for bank examiners. "Frankly, they are also asleep at the wheel," she says. "And the banks are taking advantage of the current legislative and regulatory environment by not proactively securing business accounts."
No matter the outcome, this case will set a precedent, predicts Rohyt Belani, CEO of the Intrepidus Group, a New York City-based security firm. Banks and other e-commerce providers need to take some of the responsibility to help their customers mitigate the risk associated with phishing attacks - especially those that exploit the institution's brands. "Just posting information about phishing on the login page doesn't cut it," Belani says. "I believe banks need to work on enhancing their authentication mechanisms, changing the way they communicate with their clients (not embedding active links, etc.), and educating the customers using techniques that are proven to reduce susceptibility.
"Banks should view it as a wake-up call and work on mitigating phishing attacks."
Source: Bankinfo Security; By Linda McGlasson, Managing Editor
At first, this court case was a curiosity: Experi-Metal Inc. (EMI), a Michigan-based metal supply company, sued Comerica Bank, claiming that the bank exposed its customers to phishing attacks.
Now this story shapes up as a significant test case for the banking industry, raising several key questions that must be answered about fraud and responsibility.
"It will establish who is liable in the U.S. - the bank or the customer - for fraud losses that result from phishing," says Tom Wills, Senior Analyst, Security, Fraud & Compliance, Javelin Strategy & Research.
The Basics
The lawsuit, filed by EMI in a Michigan circuit court, alleges that Dallas-based Comerica opened its customers to phishing attacks by sending emails asking customers to click on a link to update the bank's security software. In January 2009, an EMI employee opened and clicked on links within a phishing email that purported to be from Comerica. The email duped the employee into believing the bank needed to update its banking software. Subsequently, more than $550,000 was stolen from the company's bank accounts and sent overseas.
EMI says even though the bank had two-factor authentication using digital certificates for its online banking portal, the phishing scam was able to circumvent these measures. The bank says its online security methods were reasonable "because they were in general used by other similarly situated customers of other banks." Now that this case is in the courts, observers say, several important questions will be debated re: trust, responsibility and security.
Among them:
#1: How Much Trust is Lost?
Clearly, Comerica has lost EMI's trust, but how much further can this costly loss of confidence spread among banking customers - even at other institutions? "Cases like this, when they hit the courts and the press, work at a macro level to erode the trust of all banks by all customers, even affecting those institutions with good anti-phishing programs in place," says Javelin's Wills. "It will make it that much harder for all banks to migrate their customer base to the highly cost-effective (from an operational standpoint) online channel."
Anytime a company incurs a data breach that compromises personal information, the organization risks having its customers walk away for good. "That's why it's so important that, before an incident occurs, a company take proactive steps to implement a reasonable security program," says Alysa Hutnik, a lawyer at Kelley Drye & Warren, a Washington DC-based law firm that specializes in post-incident response. "Even after a breach, if a company handles the issue responsibly, those efforts can earn back trust bit by bit. But here, where a customer is out of pocket hundreds of thousands of dollars as a result of a breach and was compelled to file a lawsuit to redress the issue, yes, the trust is likely lost."
Because trust is so fundamental to banking institutions, they have to draw a distinct line, says Avivah Litan, an analyst at Gartner. "Either banks explicitly and visibly warn their customers that banking with them is not safe and that [customers] are held liable for hacking into their accounts through online banking," she says. "Or they assume liability."
#2: Is a Bank Liable For Phishing?
Should a bank be held liable for a customer's employee falling for a phishing email that supposedly represents the bank? The EMI/Comerica case highlights several hotly debated issues.
On the plaintiff's side, the employee's vulnerability to the phishing attack raises the core question of 'What is sufficient training?,' says attorney Hutnik. Most employees have been warned about phishing attempts, but even the most robust training does not protect against occasional human error. Does this training need to occur more frequently, or is it a matter of customizing the training to the evolving and specific types of phishing attempts? If a company is going to be responsible under the law for employees' vulnerability to phishing attempts, Hutnik says, that's a pretty good incentive to increase training.
Can a bank be held liable? Some security experts say emphatically 'No.' "The bank clearly could have made better decisions on how to update security information," says Branden Williams, Director of VeriSign's PCI Practice. "But judging by the timelines, they may have been ahead of their time with offering multi-factor authentication for online business banking."
Williams quotes an old saying: "I'll open the door for you, but only you can walk through it." Comerica did open the door with its security updates, he says, but a simple training issue would have prevented the employee from walking through that door. "Companies that become complacent with security become easy targets."
#3: What is 'Reasonable Security?'
In this case, was the bank's two-factor security token technology an unreasonable safeguard based on the information available at the time it was implemented by the company? Discovery and expert testimony on this point will be critical, says Hutnik. So too, will the surrounding facts on what information the bank provided to its customers about giving personal information online, or in response to an email alert, leading up to and after it transitioned away from the digital certificate security process.
Hutnik sees a third key issue, which is often a gap in many companies: What measures were in place to detect unauthorized, unusual activity involving this customer account, and did the bank act quickly enough in response to such detection? "All companies could benefit from evaluating and assessing how they compare the issues raised in this case against their own information security programs," she says.
David Navetta, a lawyer at the Information Law Group, a Colorado-based law firm, says one of the issues that will be key in this case is whether the bank has a legal duty to prevent these types of phishing attacks. And if so, whether the security measures it took were "reasonable" under the law. To the extent a bank has a general duty to protect client accounts, does that duty extend to preventing (or reducing the risk of) its customers from being duped by social engineering attacks such as phishing? "That will be the threshold legal question, and I don't know what the answer will ultimately be," he says.
Another point that Navetta says will be considered is "Reasonableness." Under the law for purposes of negligence, a defendant can avoid liability even if a plaintiff suffered harm, as long as the defendant did not breach its duty of care. "In this context, if the bank's security measures where 'reasonable' under the law, it would not be liable," Navetta says. "I think the fact that the bank used two-factor authentication will help its cause in this respect," he says. On the other hand, he adds, "Many security professionals I have spoken to/read have indicated that a phishing attack was a known weakness, or at least a theoretical weakness, of two-factor authentication."
Regulators Were 'Asleep at the Wheel'
While EMI and Comerica argue over liability, Gartner's Litan says the nation's legislators and banking regulators bear the bulk of the blame for such breaches. "It's their job to set the rules for soundness and safety of the U.S. banking system, and to enforce that the banks execute those rules," she says. "They are negligent here - in not passing legislation that protects business accounts (as Reg E protects consumer accounts) and in not enforcing security measures at the banks, as set forth by the FFIEC strong authentication guidance," Litan says.
Litan also has strong words for bank examiners. "Frankly, they are also asleep at the wheel," she says. "And the banks are taking advantage of the current legislative and regulatory environment by not proactively securing business accounts."
No matter the outcome, this case will set a precedent, predicts Rohyt Belani, CEO of the Intrepidus Group, a New York City-based security firm. Banks and other e-commerce providers need to take some of the responsibility to help their customers mitigate the risk associated with phishing attacks - especially those that exploit the institution's brands. "Just posting information about phishing on the login page doesn't cut it," Belani says. "I believe banks need to work on enhancing their authentication mechanisms, changing the way they communicate with their clients (not embedding active links, etc.), and educating the customers using techniques that are proven to reduce susceptibility.
"Banks should view it as a wake-up call and work on mitigating phishing attacks."
Source: Bankinfo Security; By Linda McGlasson, Managing Editor
Monday, February 22, 2010
‘Whistle-blower policy the best way to check frauds’
FINANCIAL EXPRESS:
As corporate India debates ways and means to strengthen the corporate governance framework for the listed companies, post the Satyam scandal, an international expert says a whistle blower policy is the best way to prevent corporate frauds from blowing up. The rider: it should be implemented in spirit, and not just in form.
“Whistle blower policy is the best way to check corporate frauds,” says Marc Duchevet, global head for governance risk & internal control, Mazars. Mazars is one of the world’s largest audit firms with a turnover of more than $1.2 billion and 12,500 professionals in over 55 countries. Duchavet also made the point that in any organisation, where fraud develops with management collusion, there will be at least one good, solid whistle blower. "In addition, there will be several others who will be able to smell the rat that is feeding on the business and who would be in a position to raise a red flag”.
On a tour to India recently, he was charitable enough to accept that it is the fear of possible abuse which may have held back corporate India from implementing the policy with zeal. “Often there is discomfort among the management over the confidentiality and requisite protection offered to such a whistle blower under the policy. Fear of abuse of such a framework by people out to settle scores or working on a personal vendetta keeps management from implementing the policy,” he said.
Whistle blower policies have become a matter of concern in the corporate sector. An area of concern, the Mazar expert said, is that once the implementation of the policy starts, there is no choice but to address "all the incidents that come to your attention".
According to him, experience shows that corporate India does indeed recognise the value of good governance. There are, of course, a large number of corporations that believe that there is a direct relationship between business governance and business valuation.
To the extent this consideration is applied by drivers of corporate governance in the right spirit, this is an positive sign. But where emphasis is on mere paper disclosure, it is a concern. International companies are focusing on key areas like risk management, values and ethics and internal control. These three go together.
The truly best or effective monitoring does not come from the number of bodies exercising oversight. Rather, it comes from those who are willing to accept full accountability and are duly empowered to take necessary punitive action.
Though the government moved fast to protect investor interests after the Satyam promoters’ frauds came into light in 2008, India’s image as a favourite investment destination was hurt. This led experts to question the effectiveness of the section 49 of Sebi’s listing guidelines in protecting investor interest.
Significantly, it is still not mandatory for listed companies here to implement the whistle blower policy. However, some companies like ONGC and GAIL India have adopted it on a voluntary basis. But, the government is seriously considering making it mandatory for the PSUs.
Source: The Financial Express
As corporate India debates ways and means to strengthen the corporate governance framework for the listed companies, post the Satyam scandal, an international expert says a whistle blower policy is the best way to prevent corporate frauds from blowing up. The rider: it should be implemented in spirit, and not just in form.
“Whistle blower policy is the best way to check corporate frauds,” says Marc Duchevet, global head for governance risk & internal control, Mazars. Mazars is one of the world’s largest audit firms with a turnover of more than $1.2 billion and 12,500 professionals in over 55 countries. Duchavet also made the point that in any organisation, where fraud develops with management collusion, there will be at least one good, solid whistle blower. "In addition, there will be several others who will be able to smell the rat that is feeding on the business and who would be in a position to raise a red flag”.
On a tour to India recently, he was charitable enough to accept that it is the fear of possible abuse which may have held back corporate India from implementing the policy with zeal. “Often there is discomfort among the management over the confidentiality and requisite protection offered to such a whistle blower under the policy. Fear of abuse of such a framework by people out to settle scores or working on a personal vendetta keeps management from implementing the policy,” he said.
Whistle blower policies have become a matter of concern in the corporate sector. An area of concern, the Mazar expert said, is that once the implementation of the policy starts, there is no choice but to address "all the incidents that come to your attention".
According to him, experience shows that corporate India does indeed recognise the value of good governance. There are, of course, a large number of corporations that believe that there is a direct relationship between business governance and business valuation.
To the extent this consideration is applied by drivers of corporate governance in the right spirit, this is an positive sign. But where emphasis is on mere paper disclosure, it is a concern. International companies are focusing on key areas like risk management, values and ethics and internal control. These three go together.
The truly best or effective monitoring does not come from the number of bodies exercising oversight. Rather, it comes from those who are willing to accept full accountability and are duly empowered to take necessary punitive action.
Though the government moved fast to protect investor interests after the Satyam promoters’ frauds came into light in 2008, India’s image as a favourite investment destination was hurt. This led experts to question the effectiveness of the section 49 of Sebi’s listing guidelines in protecting investor interest.
Significantly, it is still not mandatory for listed companies here to implement the whistle blower policy. However, some companies like ONGC and GAIL India have adopted it on a voluntary basis. But, the government is seriously considering making it mandatory for the PSUs.
Source: The Financial Express
Thursday, February 18, 2010
Wednesday, February 17, 2010
Wipro rushes to plug gap after $4-m fraud
MUMBAI BANGALORE:
A Wipro employee embezzled crores of rupees over the past three years, sending India’s third-largest software exporter scrambling to tighten internal controls in the finance division where the fraud took place.
The employee had been working with the company for the past three years in the â controllership™ division within the finance department. This cell is responsible for keeping the companys financial books and also has powers to authorise payments whenever needed. The employee is believed to have embezzled about $4 million by stealing a password and transferring money from Wipros account at a bank.
Suresh C Senapaty, Wipros CFO, confirmed the incident. This has been a case of embezzlement, which we discovered in December, and its very unfortunate that this person succumbed to this,†Mr Senapaty said. “The company has carried out an investigation and is undertaking actions with respect to stricter adherence to processes.
Wipro has since disbanded the controllership unit. The fraud is believed to have cost the company about $4 million. Wipro officials have succeeded in recovering about half the money, but will still face a loss of about $2 million.
Mr Senapaty said the incident did not involve more than one Wipro staffer. Our investigations have revealed that only this employee was involved, and nobody else in the team had any clue, Mr Senapaty said.
Apart from setting up an internal investigation team, Wipro has also taken help from external auditors and investigation experts who will vet its processes and certify the soundness of its controls. The company is already engaged with an external agency for conducting assessment of the existing audit and other processes in order to verify any potential loopholes.
The amount involved is not large, but the incident has upset people at the helm of Indias the IT major. Wipro has always taken pride in the sound work ethics of its employees and in the strictness of its controls. “We have to be more alert in monitoring, and we need to tighten the processes for ensuring an early warning system and make it tougher, Mr Senapaty said.
Among other measures being considered by Wipro, employees working in sensitive functions within the finance department may be rotated more frequently. Currently, employees in such functions spend around three years before a transfer. Going forward, Wipro also plans to make it mandatory for employees working in the finance division and elsewhere, to sign an undertaking about sharing of passwords and any unauthorised transactions.
Wipro officials discovered the fraud after receiving an alert about overdraft transaction, even when the companys accounts had sufficient balance according to the official records. The employee, whose name cannot be made public, siphoned off the companys money to his personal savings accounts in multiple transactions worth anywhere between Rs 1 lakh to Rs 1.2 crore, and used the money to acquire jewellery, apart from making other investments, including buying land.
The employee stole password from a colleague and used it to transfer money to his and his family members personal accounts, an official told ET on condition of anonymity. While the company continues to believe that it was a fraudulent act committed by the employee, the issue raises questions about information security policies.
An interim report on the incident was presented to the management, board members and other authorities concerned, including disclosure and audit committees. We have recovered more than half of the amount, and its not substantial enough. However, we have kept all the stakeholders posted in an interim report submitted recently, Mr Senapaty added.
Mr Senapaty, according to several people who spoke with ET on condition of anonymity, had to face some tough questions from the management, and he had to act swiftly in terms of restructuring the entire division.
Source: The Economic Times, By MV Ramsurya & Pankaj Mishra
A Wipro employee embezzled crores of rupees over the past three years, sending India’s third-largest software exporter scrambling to tighten internal controls in the finance division where the fraud took place.
The employee had been working with the company for the past three years in the â controllership™ division within the finance department. This cell is responsible for keeping the companys financial books and also has powers to authorise payments whenever needed. The employee is believed to have embezzled about $4 million by stealing a password and transferring money from Wipros account at a bank.
Suresh C Senapaty, Wipros CFO, confirmed the incident. This has been a case of embezzlement, which we discovered in December, and its very unfortunate that this person succumbed to this,†Mr Senapaty said. “The company has carried out an investigation and is undertaking actions with respect to stricter adherence to processes.
Wipro has since disbanded the controllership unit. The fraud is believed to have cost the company about $4 million. Wipro officials have succeeded in recovering about half the money, but will still face a loss of about $2 million.
Mr Senapaty said the incident did not involve more than one Wipro staffer. Our investigations have revealed that only this employee was involved, and nobody else in the team had any clue, Mr Senapaty said.
Apart from setting up an internal investigation team, Wipro has also taken help from external auditors and investigation experts who will vet its processes and certify the soundness of its controls. The company is already engaged with an external agency for conducting assessment of the existing audit and other processes in order to verify any potential loopholes.
The amount involved is not large, but the incident has upset people at the helm of Indias the IT major. Wipro has always taken pride in the sound work ethics of its employees and in the strictness of its controls. “We have to be more alert in monitoring, and we need to tighten the processes for ensuring an early warning system and make it tougher, Mr Senapaty said.
Among other measures being considered by Wipro, employees working in sensitive functions within the finance department may be rotated more frequently. Currently, employees in such functions spend around three years before a transfer. Going forward, Wipro also plans to make it mandatory for employees working in the finance division and elsewhere, to sign an undertaking about sharing of passwords and any unauthorised transactions.
Wipro officials discovered the fraud after receiving an alert about overdraft transaction, even when the companys accounts had sufficient balance according to the official records. The employee, whose name cannot be made public, siphoned off the companys money to his personal savings accounts in multiple transactions worth anywhere between Rs 1 lakh to Rs 1.2 crore, and used the money to acquire jewellery, apart from making other investments, including buying land.
The employee stole password from a colleague and used it to transfer money to his and his family members personal accounts, an official told ET on condition of anonymity. While the company continues to believe that it was a fraudulent act committed by the employee, the issue raises questions about information security policies.
An interim report on the incident was presented to the management, board members and other authorities concerned, including disclosure and audit committees. We have recovered more than half of the amount, and its not substantial enough. However, we have kept all the stakeholders posted in an interim report submitted recently, Mr Senapaty added.
Mr Senapaty, according to several people who spoke with ET on condition of anonymity, had to face some tough questions from the management, and he had to act swiftly in terms of restructuring the entire division.
Source: The Economic Times, By MV Ramsurya & Pankaj Mishra
Saturday, January 30, 2010
UK fraud cases reach 22-year high
Serious fraud cases totalling £1.3bn ($2.1bn) reached the courts last year – the highest for 22 years – including mortgage fraud, which doubled, according to figures released on Monday.
The latest KPMG Fraud Barometer, which has been compiled each year since 1987, showed that last year 31 cases of mortgage fraud totalling £77m reached court compared with 25 cases worth £36m in 2008 as falls in the housing market have exposed scams such as buy-to-let properties being acquired by criminal gangs.
KPMG predicts that increasing amounts of mortgage fraud will come to light in the wake of the end of the property boom and as lenders increasingly scrutinise their mortgage books and reclassify their mortgage asset portfolios.
The study also showed that fraud cases have risen significantly in the past decade, where 1,750 cases of serious fraud totalling £7bn reached the courts compared to 700 cases totalling less than £5bn in the 1990s.
There has been a steep change in the number of fraud cases during the past five years where annual fraud figures have been running at around £1bn a year.
KPMG said that there was a jump in the number of cases coming to court last year that involved frauds by company managers – some £335m of cases were heard by the courts compared to £129m in 2008. However, organised criminal gangs continue to be the biggest perpetrators of fraud and are responsible for £719m of scams.
The government and public sector were the biggest losers , with £476m stolen in tax and benefit frauds ,although banks and other financial companies, which lost around £396m, were also major targets for fraudsters.
Hitesh Patel, partner at KPMG Forensic, said: “Britain appears to have a rising fraud problem, as is evident by looking at the steady increase through the last 10 years. The credit crunch will undoubtedly make the situation worse, and we are yet to see the full impact of it. The forecast therefore is: getting worse. The comfort, if there is any, is that more fraud cases are successfully being brought to court.”
He said that companies had become better at detecting fraud and there is a greater emphasis on corporate governance although fraudsters were becoming more sophisticated.
He said that globally there had been an increase in “superfraud cases” such as Bernie Madoff’s Ponzi scheme in the US, although the UK had yet to see a similar case. He added that advances in technology were helping criminal gangs execute larger fraud schemes.
“Over the last 10 years, the boom in technology has acted as a catalyst for a boom in fraud,” he said. “Computerisation and globalisation have made fraud easier, quicker to carry out and easier to conceal. Organised criminals in particular have taken advantage of this. Identity theft is a continual problem, alongside more ‘traditional’ frauds including insider trading and price-fixing cartels. The authorities in turn have sought to professionalise the fight against fraud in response.”
KPMG singled out a number of unusual cases including one fraudster who printed his own banknotes. Here a Scottish IT professional printed around £185,000 in fake notes and involved two of his sons in the scheme. When caught, he reportedly claimed that he was undertaking a business venture to create a banknote that could not be copied. But he was found guilty and jailed for over five years.
It also pointed to another case which could act as a warning ahead of London staging the 2012 Olympics, which centred around an alleged £5m racket involving selling non-existent Beijing Olympics tickets online.
The past year also saw continued fraud within accounting and book-keeping departments – 33 cases worth a collective £44m came to court in 2009. Many of the fraudsters had worked for their victims for years and were trusted by their employers. Several cases involved people with prior convictions, such as an accountant at a Birmingham-based property management company who took more than £350,000 from his employers by transferring money from clients into accounts in his own name. He already had a history of committing theft and deception under a different name.
Mr Patel said: “It is essential for companies to rigorously screen potential employees and carry out proper background checks. Knowing who you employ and the extent of any risk they pose to the organisation is a key line of fraud defence.”
Source:- The Financial Times, www.ft.com, By By Jane Croft, Law Courts Correspondent
Thursday, January 28, 2010
Banking on bailouts
Banks and financial institutions are hard to regulate as most operate globally and are attracted to countries with the least regulation. Governments must, therefore, cooperate for effective regulation
JUST as war is too important a matter to be left to the generals, banking sector reforms and regulations are too important to be left to bank executives, bank-executivesturned-policymakers or those who pretend to understand the intricacies of modern-day finance. As Paul Volcker, the former Federal Reserve chairman, once said, the only useful recent banking innovation was the invention of the autmatic telling machine (ATM).All else is gambling with other people’s money — stating with a bit of exaggeration, of course. Investment bankers and hedge fund managers played the most damaging role in bringing the world economy to the colossal financial meltdown from which the economies of Europe and the US have yet to recover. They should not have a say in how the financial sector should be regulated.
At the hearings of the Financial Crisis Enquiry Commission in the US, last week, the executives of the top American banks appeared clueless, or pretended to be, of what caused the financial meltdown. If pretending dumb is the price they have to pay to save themselves from financial liability, they were all most willing to do so.
One executive compared the financial crisis of last year to a natural disaster that nobody could have predicted. Another said that financial crises happen every five to seven years — so get used to them. Consult these gentlemen about how banks should be regulated and there will certainly be another man-made financial disaster in the next five years.
The primary aim of the banking and financial reform should be to prevent the next financial disaster from happening. Policymakers need to check the weak spots in the system and install checks and balances to strengthen them, and avoid any systemic failure. The regulators should ensure that no bank or financial institution should be allowed to be too big to fail. The ones that are too big already should be subjected to scrutiny so that taxpayers do not have to spend hundreds of billions of dollars to bail them out.
The most often expressed fear among opponents of banking regulation is that too much regulation will stifle growth. The issue is: whose growth? If it means, restraining the growth or even shrinking the size of the financial sector, that’s a desirable outcome. In the past half a century, in most rich countries, the financial sector has become too large for the real economy. According to a report in the Economist , relative to the size of the economy banks in the UK are 10 times bigger now than they were 40 years ago. In general, banking sectors in most rich countries are too big, and should be cut in size.
Sadly, the message that the financial sector appears to have taken from governmental bailouts in Europe and America is that banks do not have to fear about failures; governments will always bail them out no matter what is happening in the rest of the economy. Such an attitude makes the banking and financial industry even more callous and irresponsible, and the next disaster more likely than before.
In addition,to bring economies from recession, governments in rich countries have been pumping cheap money into their economies through the banking sector. In return, whenever they get a chance, banks just pass on the cheap credit they receive as higher bonuses to their employees, in organising retreats and buying private jets.
THE behavior of bank executives seems so excessive that it sometimes appears that while everyone else has suffered from the financial meltdown, bank executives have benefited from it. To avoid the next financial disaster, governments have to install policies that send the financial sector the message that bailouts will not be free in future.
In the US and in Europe governments are trying to figure out how to create automatic checks and balances in the system to ensure that the next financial crisis is avoided. So far attempts have been more serious in Europe than in the US. However, it appears that the democratic debacle in the recent senate elections in Massachusetts and unfavourable ratings of Obama in several recent public opinion polls have sent a message to the US president that he needs to take the business of banking regulations and reforms more seriously. Last week, Obama announced what he called ‘the Volcker rule’ to ban proprietary trading by commercial banks. Indeed, proprietary trading should be banned for all investment banks and financial institutions, who pose the threat of creating a systemic risk.
Last month, a number of legislators also proposed that the Glass-Steagall Act that limited the scope of banks’ operations should be reinstated. The Act was passed in 1932 in response to the banking crisis that triggered the Great Depression, and repealed in 1999 by a Republican Congress and signed by President Clinton.
The Obama administration has also proposed a tax on financial institutions called the ‘financial crisis responsibility fee.’ The tax is expected to raise $117 billion to cover the projected bailout losses. A long-term solution would be for governments to charge an insurance tax on banks — a fee for insurance against future bailouts. Most importantly, banks have to increase their capital so that the chances of failures are minimised.
In last week’s hearings of the Financial Crisis Enquiry Commission, bankers and legislators debated the issue of how big is too big for commercial banks. Bankers, of course, argued that the government should not impose any limit to the size of financial companies so long as there is a regulatory framework that ensures that the taxpayers do not bear the burden of a banking failure. However, even the smallest of the bank failure does not happen in isolation. It creates contagion effects that spread to other banks and then to the rest of the economy and the entire society. Thus to avoid failures, banks that appear too big should be banned from indulging in activities that would result in risks that can lead to systemic failures.
In today’s global economy banks and financial institutions are hard to regulate as most operate in many countries. They are most likely attracted to countries with least regulation. Thus governments have to cooperate for any effective regulation of the banking industry.
Source:- The Economic Times, Neeraj Kaushal
Subscribe to:
Posts (Atom)