Combating External Fraud Scams
The risk of fraud cannot be eliminated completely, but the opportunities to commit fraud can be reduced through effective awareness and internal training initiatives by risk managers.
Multiple surveys have highlighted that companies may be losing as much as 7 percent of their annual turnover as a result of fraud. There have been multiple “false CEO/President scams” and other attempts to defraud multinational companies.
In France, over 160 companies were victims of fraud scams in 2013. Some examples of successful frauds scams are:
• Payment by one company of over $2M to a fraudulent international transport company.
• Another company was targeted to transfer money “to buy urgent raw materials for business needs” resulting in a loss of $14M!
By training managers to be aware of the scams, avoidance of the risk can be achieved. Having better awareness and training in place can also help a company decrease insurance premiums for financial risk insurance.
These are red flags of the risk:
• Frequent calls: One international company was called 33 times by the same supplier in four days.
• Demands for payment are always urgent.
• Demands are exceptions outside of normal business procedures.
Fraudsters have developed creative schemes in order to obtain unjust enrichment. The external fraud success is the professional and legitimate appearance of the demand.
The most typical external fraud scams involve four steps:
• The fraudster obtains information about Company Y via the Internet or a publicly advertised conference.
• The fraudster calls Company Y pretending to be a supplier. The fraudster, acting as Supplier Z demands payment, stating that they are upset, and that Company Y owes them past due money. Often, multiple managers are targeted at the same time within Company Y.
• The fraudster obtains the logo and letterhead of the Supplier Z. Using this, the fraudster writes a demand for payment and sends it to Company Y.
• The fraudster then pretends to work in Company Y’s finance department and targets an actual financial controller within Company Y by emailing the forged supplier Z letter. An urgent wire transfer is requested to wire funds to countries like Switzerland, the Far East (China, India, Hong Kong), or Israel. When the funds are wired, the fraud scam is successful.
Preventing the wire transfer is the key to risk prevention. Prevention focuses on the elimination of one of the following:
• Pressure – Where the pressure felt by individuals is greater, the risk of fraud occurring is increased.
• Opportunity – If opportunity is removed altogether, there will be no fraud.
• Rationalization – Rationalization can generally be linked to a lack of ethical leadership within the organization.
If strict controls are not in place, increasing awareness of the risk is essential. Risk managers should consider adapting and applying practices used by global corporations in promoting awareness. These good practices are successful.
Banks Face New Threat
Banks have been caught off guard by what experts say is the first major mobile banking security threat to hit the United States.
It is a modification of the mobile Trojan called Svpeng, which has been used to steal money from Russian mobile bank accounts, said Dmitry Bestuzhev, head of the global research and analysis team, Latin America, at Kaspersky Lab, the Woburn, Mass.-based antivirus software company that discovered the malware.
The malware, which emanates from Russia, has been termed “ransomware,” because the hackers demand payment in exchange for not destroying the victim’s reputation, claiming there is child pornography and other prohibited content on the cell phone.
“It takes a picture of the victim and then says it will send it with the child pornography findings to all of the victim’s contacts,” Bestuzhev said.
“Nobody wants to be a victim of such reputation damage.”
This new malware is deeply integrated and is almost impossible to remove from an infected device, he added.
Better software is needed to protect against malware, said Chris Keegan, a managing director at Beecher Carlson in New York.
For now, banks rely on warning their customers against social engineering attempts by fraudsters, and usually that means, “Don’t press the button or answer the email.” Banks must warn their customers not to download any applications not found on verified websites, he said.
Banks Ran Out of Time
Avivah Litan, a Gartner Inc. vice president and analyst in Potomac, Md., said the malware should serve as a wake-up call for many banks, as a fair number of them have not developed security measures for mobile banking that are as robust as those used in online banking.
Ensuring that customers use secured browsers doesn’t apply when they use mobile apps.
Giants like Chase Bank, U.S. Bank and others are developing tougher measures specific to mobile, but the industry as a whole needs to step it up, Litan said.
“They’ve just been slow to put measures in place specific to mobile because there hasn’t been any mobile malware,” she said. “Everybody knew it was coming, but they thought they had more time.”
Matt Krogstad, head of mobile banking at Bank of the West in San Francisco, said the bank’s fraud prevention department works with his department to combat mobile malware and other types of mobile banking fraud.
“It’s an ongoing process since the mobile security space is constantly evolving,” Krogstad said.
Bank of the West diligently educates customers about the latest threats, Krogstad said. In cases like Heartbleed, communications to customers were to reassure them that the bank had done its due diligence to ensure that their accounts were safe.
“With other malware like this randomware, it’s more about reinforcing certain behaviors, such as not downloading apps from unofficial app stores or not clicking on links from people you don’t know,” he said. “Don’t jailbreak your phone or put your banking passwords in your contacts.”
Keeping up with all types of cyber crime continues to challenge the industry. Indeed, computer crime and malicious codes rank as No. 5 as a top risk for banks, according to Aon’s “2014 U.S. Industry Report: Financial Institutions.”
However, there is a disconnect at most banks that hampers risk mitigation, said Michael O’Connell, managing director, financial institutions practice at Aon Risk Solutions.
The disconnect occurs because one group traditionally is responsible for purchasing insurance, while another group is responsible for assessing exposures, including technology that may pose an operational enterprise risk, said O’Connell.
“We strongly recommend linking the two groups together, to assess ‘what-if’ scenarios and develop mitigation strategies that include insurance,” he said.
Kevin Kalinich, Aon’s global practice leader for cyber/network risk, said that recent court decisions have ruled that if fraudsters are able to steal customer identities or money, it is the bank’s obligation to help their customers, even if the fraud is out of the bank’s control.
“So if a customer gets fooled on their mobile devices, then the bank has the responsibility to monitor usage of their bank accounts,” Kalinich said.
Six Best Practices For Effective WC Management
It’s no secret that the professionals responsible for managing workers compensation programs need to be constantly vigilant.
Rising health care costs, complex state regulation, opioid-based prescription drug use and other scary trends tend to keep workers comp managers awake at night.
“Risk managers can never be comfortable because it’s the nature of the beast,” said Debbie Michel, president of Helmsman Management Services LLC, a third-party claims administrator (and a subsidiary of Liberty Mutual Insurance). “To manage comp requires a laser-like, constant focus on following best practices across the continuum.”
Michel pointed to two notable industry trends — rises in loss severity and overall medical spending — that will combine to drive comp costs higher. For example, loss severity is predicted to increase in 2014-2015, mainly due to those rising medical costs.
Debbie discusses the top workers’ comp challenge facing buyers and brokers.
The nation’s annual medical spending, for its part, is expected to grow 6.1 percent in 2014 and 6.2 percent on average from 2015 through 2022, according to the Federal Government’s Centers for Medicare and Medicaid Services. This increase is expected to be driven partially by increased medical services demand among the nation’s aging population – many of whom are baby boomers who have remained in the workplace longer.
Other emerging trends also can have a potential negative impact on comp costs. For example, the recent classification of obesity as a disease (and the corresponding rise of obesity in the U.S.) may increase both workers comp claim frequency and severity.
“The true goal here is to think about injured employees. Everyone needs to focus on helping them get well, back to work and functioning at their best. At the same time, following a best practices approach can reduce overall comp costs, and help risk managers get a much better night’s sleep.”
– Debbie Michel, President, Helmsman Management Services LLC (a subsidiary of Liberty Mutual)
“These are just some factors affecting the workers compensation loss dollar,” she added. “Risk managers, working with their TPAs and carriers, must focus on constant improvement. The good news is there are proven best practices to make it happen.”
Michel outlined some of those best practices risk managers can take to ensure they get the most value from their workers comp spending and help their employees receive the best possible medical outcomes:
1. Workplace Partnering
Risk managers should look to partner with workplace wellness/health programs. While typically managed by different departments, there is an obvious need for risk management and health and wellness programs to be aligned in understanding workforce demographics, health patterns and other claim red flags. These are the factors that often drive claims or impede recovery.
“A workforce might have a higher percentage of smokers or diabetics than the norm, something you can learn from health and wellness programs. Comp managers can collaborate with health and wellness programs to help mitigate the potential impact,” Michel said, adding that there needs to be a direct line between the workers compensation goals and overall employee health and wellness goals.
Debbie discusses the second biggest challenge facing buyers and brokers.
2. Financing Alternatives
Risk managers must constantly re-evaluate how they finance workers compensation insurance programs. For example, there could be an opportunity to reduce costs by moving to higher retention or deductible levels, or creating a captive. Taking on a larger financial, more direct stake in a workers comp program can drive positive changes in safety and related areas.
“We saw this trend grow in 2012-2013 during comp rate increases,” Michel said. “When you have something to lose, you naturally are more focused on safety and other pre-loss issues.”
3. TPA Training, Tenure and Resources
Businesses need to look for a tailored relationship with their TPA or carrier, where they work together to identify and build positive, strategic workers compensation programs. Also, they must exercise due diligence when choosing a TPA by taking a hard look at its training, experience and tools, which ultimately drive program performance.
For instance, Michel said, does the TPA hold regular monthly or quarterly meetings with clients and brokers to gauge progress or address issues? Or, does the TPA help create specific initiatives in a quest to take the workers compensation program to a higher level?
4. Analytics to Drive Positive Outcomes, Lower Loss Costs
Michel explained that best practices for an effective comp claims management process involve taking advantage of today’s powerful analytics tools, especially sophisticated predictive modeling. When woven into an overall claims management strategy, analytics can pinpoint where to focus resources on a high-cost claim, or they can capture the best data to be used for future safety and accident prevention efforts.
“Big data and advanced analytics drive a better understanding of the claims process to bring down the total cost of risk,” Michel added.
5. Provider Network Reach, Collaboration
Risk managers must pay close attention to provider networks and specifically work with outcome-based networks – in those states that allow employers to direct the care of injured workers. Such providers understand workers compensation and how to achieve optimal outcomes.
Risk managers should also understand if and how the TPA interacts with treating physicians. For example, Helmsman offers a peer-to-peer process with its 10 regional medical directors (one in each claims office). While the medical directors work closely with claims case professionals, they also interact directly, “peer-to-peer,” with treatment providers to create effective care paths or considerations.
“We have seen a lot of value here for our clients,” Michel said. “It’s a true differentiator.”
6. Strategic Outlook
Most of all, Michel said, it’s important for risk managers, brokers and TPAs to think strategically – from pre-loss and prevention to a claims process that delivers the best possible outcome for injured workers.
Debbie explains the value of working with Helmsman Management Services.
Helmsman, which provides claims management, managed care and risk control solutions for businesses with 50 employees or more, offers clients what it calls the Account Management Stewardship Program. The program coordinates the “right” resources within an organization and brings together all critical players – risk manager, safety and claims professionals, broker, account manager, etc. The program also frequently utilizes subject matter experts (pharma, networks, nurses, etc.) to help increase knowledge levels for risk and safety managers.
“The true goal here is to think about injured employees,” Michel said. “Everyone needs to focus on helping them get well, back to work and functioning at their best.
“At the same time, following a best practices approach can reduce overall comp costs, and help risk managers get a much better night’s sleep,” she said.
To learn more about how a third-party administrator like Helmsman Management Services LLC (a subsidiary of Liberty Mutual) can help manage your workers compensation costs, contact your broker.
Debbie discusses how Helmsman drives outcomes for risk managers.
Debbie explains how to manage medical outcomes.
Debbie discusses considerations when selecting a TPA.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Helmsman Management Services. The editorial staff of Risk & Insurance had no role in its preparation.