Cyber Risks

Covering Fraudulent Impersonation

Specialist insurer Beazley is the latest underwriter to attempt to combat so-called ‘social engineering’ cyber scams.
By: | July 22, 2015 • 4 min read
Protection concept: Key and Cyber Fraud on computer background

Impersonating a supervisor in order to fraudulently convince a subordinate to transfer funds is one of a bevy of emerging cyber risks. Getting cover for a loss stemming from the practice is still a dicey business.

Many cyber policies might not cover such a loss, and underwriters disagree on whether more traditional crime/fidelity coverages do either. But attempts are underway to bridge the gap.

Advertisement




Beazley’s new fraudulent instruction endorsement, for example, gives existing commercial crime policyholders up to $250,000 cover against the transfer of funds as a result of instructions from a person purporting to be a vendor, client or authorized employee.

“Fraudulent instruction scams are so sophisticated that basically any business that transfers funds is vulnerable,” said Bill Jennings, who heads the Financial Fidelity/Commercial Crime Unit for Beazley in New York.

“Existing cyber and crime policies — which cover theft of data and theft of funds respectively — may not cover losses from these masqueraders, who may use authority or endearment to perpetrate a fraud,” he explained.

“Quite frankly, many companies need more than $250,000 of this coverage.” — Kevin Guillet, FINPRO Fraud Advisory Practice Leader, Marsh

This increasingly prevalent type of scam relies on an employee failing to notice a very small error in an email address, as well as their natural eagerness to please and be responsive to a superior or a client.

Victims are often tricked that the instruction is either urgent or confidential, and the instruction usually contains personal information gathered from social media or hacking in order to make it seem believable. Once the transferred funds leave the United States, they are rarely recoverable.

While the perpetrators often use cyber hacking to identify and trick their targets, cyber policies are typically focused on the theft of data rather than money.

That’s why, according to Bob Parisi, cyber product leader at Marsh, it is crime/fidelity underwriters who are “bridging the gap more aggressively” when it comes to covering fraudulent impersonations.

“The cyber markets tend to take a ‘hands-off’ position on crime-related losses as they view cyber coverage as more akin to ‘virtual’ property casualty coverage,” he said.

Bob Parisi Cyber Product Leader Marsh

Bob Parisi
Cyber Product Leader
Marsh

“However, there is some potential overlap between cyber and crime/fidelity, especially in the financial institution space where insureds can enhance their crime/fidelity coverage with damage by hacker or virus endorsements that provide an element of cyber coverage.”

Kevin Guillet, Marsh’s FINPRO Fraud Advisory Practice Leader, praised Beazley for including impersonation of clients, vendors and employees under its coverage.

“Not every form covers all those constituents,” he noted, adding that while he believes certain standard industry forms do already cover against ‘employee’-to-employee instruction, this is often disputed by underwriters.

In an attempt to help protect its clients, Marsh has developed proprietary language introducing ‘computer and telephonic misuse coverage’ — which includes coverage for fraudulent impersonation — into its crime policy standard wordings in London and Europe, and continues to push for acceptance of this wording by U.S. underwriters.

“While subject to underwriting and additional premium charge, another attractive feature of Beazley’s endorsement is that can provide coverage up to $250,000 without requiring ‘out-of-band authentification’ [challenging the instruction through a means other than that by which the instruction was received, such as email verification of a phone instruction],” Guillet added.

“When underwriters build in a warranty whereby there is no coverage unless all procedures are correctly followed, we question the value of that coverage because these scams typically succeed by convincing people to ignore established protocols.”

According to an Internet Crime Complaint Center (IC3) June 2014 “Scam Report,” the average amount lost in frauds of this nature is $55,000. However, IC3 claimed there has been one report of $800,000 lost, and experts said they have seen losses run into the tens of millions. The total cost to corporate America is unknown.

Advertisement




“Quite frankly, many companies need more than $250,000 of this coverage,” said Guillet. However, he conceded, “there is real exposure here, so you can understand why Beazley and other underwriters are approaching cautiously,” noting that while there are some underwriters who offer higher limits, some don’t want to cover fraudulent impersonation risk at all.

Beazley’s Jennings recommended that, in addition to buying insurance, companies implement staff training as well as “strong internal controls requiring call-back verification and periodic white-hat testing to confirm that controls are being followed.”

Antony Ireland is a London-based financial journalist. He can be reached at [email protected]
Share this article:

Technology Risks

Cyberrisk: ‘Healthy Dose of Paranoia’ Needed

With the escalation of cyber attacks affecting the health care industry, companies in the workers' comp field must become more vigilant in their efforts to safeguard data.
By: | July 20, 2015 • 5 min read
Stethoscope and glasses on black laptop

The workers’ comp system has been generally spared from data hackers. But with the multitude of people and companies transmitting and sharing files daily, it is incumbent upon companies to take protective actions, advises a managed care services provider.

Advertisement




Data breaches at some of the country’s largest health plans as well as among retailers has prompted Genex Services, LLC to offer suggestions to protect the industry. In addition to recommended steps to take, a new white paper also includes basic regulatory issues and terminology to help industry stakeholders better understand data concerns and the need to collaborate with partners and vendors.

“Our industry certainly could be, and perhaps already is, at risk,” notes the paper. “Lack of strong data security could expose an organization to millions of dollars in litigation, damage control and repair costs.”

The document, Enemy at the Gate: Data Security Risks in Workers’ Comp, outlines the potential risks and offers advice.

“A healthy dose of paranoia is a necessity for today,” the paper states. “It is clearly in the best interest of our industry, and of workers, to err on the side of caution.”

The Risks

“The ability to show strong data security controls is critical for employers and carriers,” the paper advises. “Companies want assurance that their data will be stored and backed up securely and in a physically safe location, that there are controls for who can access data, who can share information and the manner in which data is shared, e.g. secure email server.”

A number of “key domain risks” face the industry such as unauthorized access to personal health information. Such information “could be used for identity theft or even blackmail,” the paper says. “Unfortunately, there are many ways for such data to be accessed. Data is always in motion in comp claims as there are various vendors, case managers, bill review specialists, and independent medical examiners, all transmitting and sharing files and forms every day.”

“A healthy dose of paranoia is a necessity for today. It is clearly in the best interest of our industry, and of workers, to err on the side of caution.”

Carefully vetting vendors and properly managing passwords are among the methods to ensure security controls are effective. Passwords, the paper advises, should be “easy to remember, but not overly simplistic and be changed more than twice a year to reduce potential risks.” Password parameters should be developed for “all applications and networks.”

Sending claim information over the Internet is risky. The emphasis on mobile workplaces “exacerbates risk from the Internet.”

Advertisement




The authors advise companies to remind employees to “remain vigilant” when adjusters, providers, and injured workers are sending emails that include addresses, dates of birth, and Social Security numbers through non-secure servers. “These senders need to be informed and educated of the dangers associated with nonsecure platforms,” the document states.

Securing Data

Administrative, technical, and physical controls should be implemented. Administrative controls, for example, include conducting background checks and using confidentiality agreements, as well as security awareness training. Anti-virus, network segmentation and web and email filtering are among the technical controls that should be put into place.

Physical controls relate to limiting access to buildings and data access. Key fobs or card entry building access systems are recommended. A “security triangle” should be created to ensure all controls are highly secured and monitored.

Steps to Take

Organizations can take a variety of measures to ensure the security of sensitive data. Continually reviewing and improving technical controls and providing clear guidance and instruction to employees transmitting data are among them. Antivirus programs should be installed on all systems and virus definitions should be updated frequently, such as every three hours.

The paper offers a variety of additional tips, including:

Encrypt data on the C drive, data-in transit, and databases on servers to protect data, in case a laptop is lost or stolen.

Implement a system to determine which department or individual can access data and limit the number of people with full access to everything.

Guard against email phishing to avoid scams. “Be aware of anything involving shipping or delivery of product, and warn employees to be especially wary of unsolicited emails purporting to be from government agencies and popular internet commerce sites, such as the IRS or PayPal, especially during tax season, and high volume online shopping periods,” the document recommends.

Instruct vendors to tell their own employees of the importance of security to ensure all links in the data security chain are strong.

Insufficient Standards

The paper is the latest to address concerns of potential data breaches in workers’ comp. Cyber security is among the targets for Sedgwick this year.

In a recent blog post, Sedgwick’s senior vice president and information security officer Robert Jackson suggested the health care industry has set the bar on data security too low. “You may think you have taken the steps needed to protect your company’s data,” Jackson wrote. “How does your data security currently stack up?”

Advertisement




Jackson poses a series of questions on tools to protect data and points out that many “standards” are insufficient. For example, antivirus software is not the best protection against malware, he says. “Traditional antivirus software can only protect against things it has previously seen; new malware is specifically designed to constantly change itself to bypass traditional antivirus software.” He points to application whitelisting software as the best replacement for antivirus software on workstations and servers.

Penetration testing is not the best way to double-check Internet facing software so it cannot be hacked. Instead, he says tools such as binary code testers analyze logic and software vulnerabilities for all programming in an organization’s code, not just the code operating when regular testing occurs.

Nancy Grover is the president of NMG Consulting and the Editor of Workers' Compensation Report, a publication of our parent company, LRP Publications. She can be reached at [email protected]
Share this article:

Sponsored: Lexington Insurance

Pathogens, Allergens and Globalization – Oh My!

Allergens and global supply chain increases risk to food manufacturers. But new analytical approaches help quantify potential contamination exposure.
By: | June 1, 2015 • 6 min read
Lex_BrandedContent

In 2014, a particular brand of cumin was used by dozens of food manufacturers to produce everything from spice mixes, hummus and bread crumbs to seasoned beef, poultry and pork products.

Yet, unbeknownst to these manufacturers, a potentially deadly contaminant was lurking…

Peanuts.

What followed was the largest allergy-related recall since the U.S. Food Allergen Labeling and Consumer Protection Act became law in 2006. Retailers pulled 600,000 pounds of meat off the market, as well as hundreds of other products. As of May 2015, reports of peanut contaminated cumin were still being posted by FDA.

Food manufacturing executives have long known that a product contamination event is a looming risk to their business. While pathogens remain a threat, the dramatic increase in food allergen recalls coupled with distant, global supply chains creates an even more unpredictable and perilous exposure.

Recently peanut, an allergen in cumin, has joined the increasing list of unlikely contaminants, taking its place among a growing list that includes melamine, mineral oil, Sudan red and others.

Lex_BrandedContent“I have seen bacterial contaminations that are more damaging to a company’s finances than if a fire burnt down the entire plant.”

— Nicky Alexandru, global head of Crisis Management at AIG

“An event such as the cumin contamination has a domino effect in the supply chain,” said Nicky Alexandru, global head of Crisis Management at AIG, which was the first company to provide contaminated product coverage almost 30 years ago. “With an ingredient like the cumin being used in hundreds of products, the third party damages add up quickly and may bankrupt the supplier. This leaves manufacturers with no ability to recoup their losses.”

“The result is that a single contaminated ingredient may cause damage on a global scale,” added Robert Nevin, vice president at Lexington Insurance Company, an AIG company.

Quality and food safety professionals are able to drive product safety in their own manufacturing operations utilizing processes like kill steps and foreign material detection. But such measures are ineffective against an unexpected contaminant. “Food and beverage manufacturers are constantly challenged to anticipate and foresee unlikely sources of potential contamination leading to product recall,” said Alexandru. “They understandably have more control over their own manufacturing environment but can’t always predict a distant supply chain failure.”

And while companies of various sizes are impacted by a contamination, small to medium size manufacturers are at particular risk. With less of a capital cushion, many of these companies could be forced out of business.

Historically, manufacturing executives were hindered in their risk mitigation efforts by a perceived inability to quantify the exposure. After all, one can’t manage what one can’t measure. But AIG has developed a new approach to calculate the monetary exposure for the individual analysis of the three major elements of a product contamination event: product recall and replacement, restoring a safe manufacturing environment and loss of market. With this more precise cost calculation in hand, risk managers and brokers can pursue more successful risk mitigation and management strategies.


Product Recall and Replacement

Lex_BrandedContentWhether the contamination is a microorganism or an allergen, the immediate steps are always the same. The affected products are identified, recalled and destroyed. New product has to be manufactured and shipped to fill the void created by the recall.

The recall and replacement element can be estimated using company data or models, such as NOVI. Most companies can estimate the maximum amount of product available in the stream of commerce at any point in time. NOVI, a free online tool provided by AIG, estimates the recall exposures associated with a contamination event.


Restore a Safe Manufacturing Environment

Once the recall is underway, concurrent resources are focused on removing the contamination from the manufacturing process, and restarting production.

“Unfortunately, this phase often results in shell-shocked managers,” said Nevin. “Most contingency planning focuses on the costs associated with the recall but fail to adequately plan for cleanup and downtime.”

“The losses associated with this phase can be similar to a fire or other property loss that causes the operation to shut down. The consequential financial loss is the same whether the plant is shut down due to a fire or a pathogen contamination.” added Alexandru. “And then you have to factor in the clean-up costs.”

Lex_BrandedContentLocating the source of pathogen contamination can make disinfecting a plant after a contamination event more difficult. A single microorganism living in a pipe or in a crevice can create an ongoing contamination.

“I have seen microbial contaminations that are more damaging to a company’s finances than if a fire burnt down the entire plant,” observed Alexandru.

Handling an allergen contamination can be more straightforward because it may be restricted to a single batch. That is, unless there is ingredient used across multiple batches and products that contains an unknown allergen, like peanut residual in cumin.

Supply chain investigation and testing associated with identifying a cross-contaminated ingredient is complicated, costly and time consuming. Again, the supplier can be rendered bankrupt leaving them unable to provide financial reimbursement to client manufacturers.

Lex_BrandedContent“Until companies recognize the true magnitude of the financial risk and account for each of three components of a contamination, they can’t effectively protect their balance sheet. Businesses can end up buying too little or no coverage at all, and before they know it, their business is gone.”

— Robert Nevin, vice president at Lexington Insurance, an AIG company


Loss of Market

Lex_BrandedContent

While the manufacturer is focused on recall and cleanup, the world of commerce continues without them. Customers shift to new suppliers or brands, often resulting in permanent damage to the manufacturer’s market share.

For manufacturers providing private label products to large retailers or grocers, the loss of a single client can be catastrophic.

“Often the customer will deem continuing the relationship as too risky and will switch to another supplier, or redistribute the business to existing suppliers” said Alexandru. “The manufacturer simply cannot find a replacement client; after all, there are a limited number of national retailers.”

On the consumer front, buyers may decide to switch brands based on the negative publicity or simply shift allegiance to another product. Given the competitiveness of the food business, it’s very difficult and costly to get consumers to come back.

“It’s a sad fact that by the time a manufacturer completes a recall, cleans up the plant and gets the product back on the shelf, some people may be hesitant to buy it.” said Nevin.

A complicating factor not always planned for by small and mid-sized companies, is publicity.

The recent incident surrounding a serious ice cream contamination forced both regulatory agencies and the manufacturer to be aggressive in remedial actions. The details of this incident and other contamination events were swiftly and highly publicized. This can be as damaging as the contamination itself and may exacerbate any or all of the three elements discussed above.


Estimating the Financial Risk May Save Your Company

“In our experience, most companies retain product contamination losses within their own balance sheet.” Nevin said. “But in reality, they rarely do a thorough evaluation of the financial risk and sometimes the company simply cannot absorb the financial consequences of a contamination. Potential for loss is much greater when factoring in all three components of a contamination event.”

This brief video provides a concise overview of the three elements of the product contamination event and the NOVI tool and benefits:

Lex_BrandedContent

“Until companies recognize the true magnitude of the financial risk and account for each of three components of a contamination, they can’t effectively protect their balance sheet,” he said. “Businesses can end up buying too little or no coverage at all, and before they know it, their business is gone.”

SponsoredContent
BrandStudioLogo
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Lexington Insurance. The editorial staff of Risk & Insurance had no role in its preparation.




Lexington Insurance Company, an AIG Company, is the leading U.S.-based surplus lines insurer.
Share this article: