It’s hard to imagine that, on any given day, over $3 trillion dollars moves via electronic transfer.  Financial institutions make these B2B transactions happen seamlessly on a global scale, and we often take for granted the very simple instructions required (and accepted) between businesses that make single transactions of millions of dollars possible.  Since organizations perform these transactions almost exclusively online, the Internet of things has an inherit opportunity for malicious redirection when company employees become complacent with routine wire instructions.

Responsible organizations follow robust, documented and accepted practices in an environment that embraces process.  The culture of any high reliability organization allows employee intervention and systematic controls to prevent fraud opportunities.  It may feel as if these processes are tedious and repetitive, however, at the end of the day, human actions allow fraud to exist.

Since 2016, it’s estimated that over $26 billion in fraud losses has come from wire funds transfers as the result of business email compromise alone.  With the recent COVID-19 pandemic event, fraudsters have a new ability to exploit corporations, especially in highly impacted areas.  It is important for organizations to maintain a culture of process and have contingency plans in place to allow transfers to continue seamlessly.

On the Lowers & Associates LinkedIn, we’ll be highlighting a series of security insights that are applicable to ANY industry (the second bullet below should look familiar).  Specific to wire transfer fraud, here are a few additional actions employers can take to remove risk and eliminate potential for loss:

• Strengthen screening and re-screening employment practices.
• Integrate and document responsibilities of all parties authorized in dual controls into processes involving preparation of wire transfer instructions and authorizing and approving such transfers.
• Ensure there is independent and frequent review of investment transactions by a knowledgeable party.
• Conduct semi-annual audits of the wire transfer function. Ensure auditors review password requirements and controls during each examination.
• Conduct annual penetration tests and annual security audits of web-based wire transfer applications that are hosted by the company or by a third-party application service provider.

BONUS: These are a few additional steps that businesses should think about adopting:

• Email social engineering education.
• Passwords should be at least 14 characters, must be complex (at least 1 of each): 1 Uppercase, 1 Lowercase, 1 Number, 1 Symbol and changed every 90 days.
• Two-factor identification.
• Appropriate insurance coverage for the business.
• Monitor banking accounts regularly.

High Reliability Organizations (HROs) achieve such a status through persistent and detailed efforts to improve outcomes, even seeking “perfect reliability.” But, how do you get there from where you are?

Chassin and Loeb, writing about healthcare, have summarized the requirements into three broad domains: leadership, process, and culture. The approach these authors describe is intended to help hospitals and other healthcare organizations adopt HRO principles and performance, but it applies equally well to other types of organizations. All complex organizations seeking to improve outcome quality and reliability will have to scrutinize the same domains and begin to install changes. … Continue reading

Doctors, nurses, and other healthcare professionals go into the caregiving role for many reasons, but most reasons center on helping people. Unfortunately, by putting themselves in this role they also face the risks of violence.

Research published by Dr. James Phillips in the New England Journal of Medicine in April 2016 found “health care violence is an underreported, ubiquitous, and persistent problem that has been tolerated and largely ignored.”  In his research, Dr. Phillips found:

• almost 75% of all workplace assaults between 2011 and 2013 happened in healthcare settings;
• 1% of emergency department nurses reported physical assault during the last year; and
• psychiatric aides experience workplace violence 69 times the national rate for all workplaces.

… Continue reading

One of the more pervasive human risks in modern organizations is fraud through “social engineering.” Social engineering fraudsters gain access to your most valuable assets by using deceitful tactics to turn trusted employees or partners into unwitting and unwilling accomplices. This occurs at a typical loss rate of $25k to $100k per incident. This stealthy crime can be very hard to detect because the accomplice is unaware of being complicit, giving the perpetrator time to escape.

… Continue reading