Collaborate on Create Fake Online Bank Transfer Receipt for Non-profit Organizations with Ease Using airSlate SignNow

Create fake online bank transfer receipt for non-profit organizations

this tutorial is a project of nonprofit accounting basics. org a free resource developed by the greater Washington Society of CPA's Educational Foundation our goal is to encourage accuracy and accountability to help smaller nonprofits successfully manage and sustain their organizations hello my name is Tom chokis and I'm a member of the greater Washington Society of CPA's nonprofit accountability task force today I'm going to talk to you about any nonprofit banking fraud and the tools that you can use so today when you look at all the data breaches that are happening in the headlines things from like the IRS to the US government to JP Morgan Chase to Target and yes even our own very Dairy Queen has had data breaches where information's been compromised through various sources what does a fraud store look like when frauds being committed by a person typically 41% of frauds are happening from the age of 36 to 45 and 80% of those are men when you look at the next slide here of what happens as it relates to harvesting email uh harvesting a email account they're looking at all types of information from spamming where you're getting fishing emails to click on links so that they can get inside of your email account to hack them and send out um emails as well as getting information from those emails to harvesting information through Facebook your employment records your Banking online banking and actual sales that are being made at the various retailers this chart gives you a good idea of how it all happens as it relates to an email account being so what's the definition of social engineering social engineering is the context of information security that re refers to the psychological manipulation of people into performing actions or divulging confidential information fishing is a type of social engineering and as it relates to fishing typically what happens is it's acquiring your confidential information by masquerading as a trustworthy entity so possibly your bank your retailer um another person that's sending you an email and within that email is an embedded link um and based on that link it it would then download or upload um a virus so that it could then watch your keystrokes and watch what you're doing within your computer so things to watch for are obviously links to email spelling in grammar things that are coming from popular companies and thing and the email is it relates to creating a sense of urgency spoofing is where the spammer sends out an email to your email address um and it looks like it's coming from you and again on the slide you shows a copy of what an email would look like um it's going to come into your inbox it might match up as it relates to your email address or be off slightly but these are the types of emails that are coming to individuals so that you can click on the links and then of course it's where it's um the virus is infecting your computer so that it can remember the YP of um things that you're doing and the places that you're going so what is key logging key logging is basically spyware or monitoring software it's the equivalent of digital surveillance so every time that you click um on your keyboard type download um go somewhere as it relates to the internet like to your um online banking account it's going to remember the places that you go and the actual keystrokes that you're making so you're going to a bank website and you type in something in the first field typically that would be your user ID and then the second is the um password and so it's remembering these types of things and um keeping that information for the um frauders that are trying to get your information key loggers spread in much the same way as malicious programs spread excluding cases where key loggers are purchased installed like a jealous files or a partner key loggers are happening by Security Services key loggers are installing um on your system where you open a file or attachment or receive an email text uh instant message or social uh networks key loggers can also just be installed by visiting a website of a site that's infected how do you detect a key logger key loggers are very difficult to detect so how can you protect yourself just as you would maintain your own health on a daily basis there are many websites out there that you can go to uh download anti- virus software and the key thing is keeping it up to date so a lot of you are probably familiar with um Catch Me If You Can it was a movie by Leonardo Dicaprio and Tom Hanks where um this gentleman um portrayed himself as a fraudster and had the ability to um manufacture checks so that these checks um would look like they came from um American Airlines um another bank um a doctor's office and he would go through and um whitewash the checks so instead of them being for $100 he'd make them for $10,000 um and he would manufacture um identification and a whole series of things um so that he could obtain monies illegally he's somewhat um quite popular person his name was Frank abil and uh he worked for the FBI for 10 or 15 years after that that they caught him arrested him they used him um in doing additional training so the types of frauds that happen typically with Chuck fraud is where a fraudster accesses money to create counter for check um and getting your check stock or creating uh a new check stock so when you're looking at this particular check you see that it has routing numbers account numbers um and then in the top leftand Corner would be where the name and address of the person would go um to prevent this type of check fraud um there's a product that's called uh positive pay this is where you would upload to your financial institution and tell them what types um of checks to pay the check number the dollar amount and who the pay um is and this um will protect you from having uh checks come through for the wrong amount or checks come through that were never um written by you in the event that you forget to write down um or upload a check um it does create a reject report where you're able to then approve those rejects um so that the items can get paid or not get paid another type of check fraud is through remote deposit capture or a mobile phone this is where a check is um double debiting uh as an example they organization would have a check um it would be deposited through their remote deposit capture and then um the fraudster typically someone internally would then take that check and change um the dollar amount Andor make the check payable to a person and then deposited through the oldfashioned um means meaning going to the bank and actually depositing the check and in theory they would get credit once through the normal channel of how they were giving credit and then the fraudster would be taking it through a second Channel um and then if the writer of the check doesn't balance their checks maybe except on a monthly basis it would take 30 to 60 days to actually find out this was happening um another type of fraud is a fraud the fraudsters target nonprofit organizations in search of trying to get bigger payouts they would steal their online banking credentials through um the earlier methods that I talked about with fishing um and um spamming them to get their loog to to track their logging of their Bank user ID and password once they have the credentials they're then able to send out ACS or wires from those bank accounts um to the fraudsters accounts wherever they may be um in addition they would also be able to create files um from outside the organization where they're coming inside to actually debit the person's account the solution here would be a positive pay this allows a a client to assign a filter or block um the ability to have U monies taken out of the account so in theory if um the only types of debits coming from your account are American Express and for your Verizon um phone bill you would then only allow those two companies to debit your account and then you can set up a dollar amount um where if it's typically a $5,000 a month debit you can put a cap of that charge of no more than $5,000 in $1 as an example another way to protect your online banking environment is through creating a secure connection to your bank um as an example trust Defender is a lock down of um the actual entry point to your bank so what this does is it creates a portal that goes from your laptop to the bank and would not or will not allow anyone else to jump on or attach to that portal that you're communicating with your bank so it's done through locking down your browser and blocking any and other internet traffic including email again this is a way to protect your um online banking environment another way is through two-party Factor authentication the best way to use this is to communicate to your bank when it's sending you your password um and or approving a computer um so as we talked about earlier if your email accounts being and the fraudsters are in your email account having the bank um email you your password is probably a bad idea because if the fraudsters are already in there then they're able to get your new password so we highly recommend that you use a two-factor authenication process where it's actually texting it to your cell phone or calling your cell phone therefore you then would put in that code it which then is approving um the IP address that that computer is using at that time another way is to educate your employees um obviously having um an education program to work with letting your employees know what um the best types of passwords that are available in the example here it lists um you know four different scenarios on passwords and the frauders because they're harvesting this information through your email account through your Facebook and Linkedin sites they're having things like your date of birth your mother's maiden name your anniversary date and when you look at the third selection for a password May 2009 Marie that's very possible the year that the person was married and their spouse's first name so it should be um a series of numbers and letters upper and lower case as in the fourth option listed um the next thing you want to do is always look at um unexplained account or network activity you can do this through uh signing up for alerts from your bank that will alert you on a um daily basis of what your balance is if large dollar transactions are happening if you're overdrawing your account or if deposits or withdrawals are being made in the um example here listed we're um suggesting that you reconcile your operating account on a daily basis um and this would be through you going to your online banking environment and watching whatever activi is taking place um the traditional of yester years where someone would get their bank statement at the end of the month and then within the next 30 days balancing their um statement is certainly not a very good idea as um things could have already happened and over a period of 30 Days A lot can happen last thing is you want to talk to your Banker about programs that are Safeguard uh for unauthorized tra transactions um like I as I spoke earlier about positive pay and other services that the bank offers through authentication and having multi- um persons approve wires ACS and uh the different types of transaction on your account are critical um again recapping positive pay positive pay is an anti- uh fraud service offered by most banks it's a general term that's being used through the industry that can um protect businesses against altered checks and counter foot check stock it basically is uploading to the bank um the activity from the business as it relates to matching the account number check number and dollar amounts presented um to the bank and as I said the a positive pay comes through either blocking all transactions Andor filtering where you're only allowing certain types of transaction with certain types of dollar amounts and then again remembering that you'll always have the ability to um pay or return exception items so this is probably the single most important slide for anyone um under uh the electronic funds transfer act also known as regulation in as regulation e in 1978 it was established uh for rights and liabilities for consumers um as well as the um financial institutions so most folks are com are um familiar with if your a debit card or credit card got stolen or if there was fraudulent activities on your bank that you um are limited to losses of no more than $50 provided that you notify your Banks U within two days so this is the consumer protection um that's afforded through regulation e for businesses organizations and nonprofits there's currently no type of loss protection for commercial checking account customers so what this means is if your account debit card credit card has fraud and lot activity um most institutions are not offering any type of protection unless you agree to the earlier products and services that I talked about like positive pay um and a filters so it's very important to keep your account secure um with your banking institution and checking with your Banker as it relates to what type of products and services are available to protect your funds lastly uh here's a couple of links and places that you can go for resources uh the acfe fraud prevention checkup is a great handout um if you go to the greater Washington Society of CPAs and click on the nonprofit accounting basic's website there's a lot of information and then finally if you go to the Federal Communications Commission they have 10 cyber security strategies for businesses so with that I'd like to thank you all for participating in the webinar if you have additional questions feel free to contact me Andor go through the nonprofit accounting Basics website thank you