FraudBasics
Bob, an internal auditor for ABC Company, is conducting a routine cash receipts controls review. The procedure calls for the day's checks to be deposited remotely in a company bank account daily. Susan, the clerk who processes customer checks, had gone home sick on Monday. Before she left, she completed the remote deposit procedure, which involves scanning each check and electronically sending those scans to the bank. Then she put the checks she had just scanned in her work-in-process file and went home, intending to properly file them away the next day. Unfortunately, when Betty — who had done Susan's job years ago — was assigned to cover Susan's desk on Tuesday, she came across the previous day's checks. Without asking anyone, Betty prepared a deposit slip — as she had done in the past — and took the checks to the nearby bank branch and made the deposit. When Susan came in on Wednesday, she noticed that the stack of checks she had processed on Monday were not where she had put them and immediately asked Betty where they were. Oops ... The checks had been deposited twice. They immediately contacted the bank. The bank manager explained that the bank's duplicate check detecting software had caught the error and that all was well. If the bank had not had the duplicate check software working properly or if Susan and Betty had conspired to modify the original paper checks before re-depositing them, the bank could have been liable for some big bucks. This fictitious example could easily have happened.
Banking industry experts report that check processing is moving rapidly away from the traditional paper methods and toward the processing of electronic images of checks. As of August 2011, almost 70 percent of all institutions are now receiving check images, according to CheckImage Central. With the implementation in 2004 of the Check Clearing for the 21st Century Act, or Check 21, auditors and CFEs cannot afford to ignore the new risks and challenges associated with processing of increasingly larger volumes of electronic check images.
Even with so many more consumers and businesses paying their bills electronically, checks are still the standard for many. The major impetus for banks moving to check images is that electronic processing costs much less than paper check processing. Historically, paper processing had been a cumbersome procedure that required physically moving millions of paper checks through the banking system.
Before Check 21 processing, when a person deposited a paper check in his bank, that person would be credited for the amount of the deposit. Then, at the end of the day, the bank would sort that day's processed paper checks and forward them to the Federal Reserve — or another check-clearing entity — where the checks would be cleared. The paper checks then would be sorted and sent back to the banks the checks were drawn on (and in some cases returned to the check writer). Grounded planes following the terrorist attacks of 9/11 caused major delays in check processing and brought increased awareness to antiquated paper-check procedures. A number of electronic payment processing technologies are now in wide use, including Check 21 technology.
Under Check 21 processing, paper checks are scanned, and the images are used to process the checks. Alternatively, banks that desire to continue receiving and processing paper checks may print and process copies of the images, called substitute checks. The substitute checks are the legal equivalent of the original checks and can be used to document payments in the same way that cancelled scanned checks would.
Although compliance with Check 21 is not mandatory, most banks are expected to invest in check imaging technology eventually to take advantage of the projected costs savings. So far, the adoption from paper to digital has been slower than expected as the banking world upgrades its technology for image processing. The underlying cause of the delay has been the significant investment in the technology required to both create and process check images and substitute checks. Sources in the banking world in 2004 estimated a cost of $1.5 billion to $2.5 billion to fully implement Check 21 technology in the U.S. [See "The Domino Effect of Check 21," by J.D. (Denny) Carreker.] The Federal Reserve expects that the use of substitute checks should decline as more banks have the technological capability to process check images directly.
THE CRUX OF THE PROBLEM
Check truncation — the process of digitally scanning paper checks — greatly increases the chances of a check being processed twice, either accidentally or fraudulently. Duplicate check processing occurs when a business uses remote processing to scan incoming checks and also drops the paper checks off at a bank branch. The branch then forwards the paper check to the Federal Reserve to be processed. Thus, as in the opening case, checks can be processed twice.
Before Check 21, duplicate check processing rarely happened. However, American Banker magazine now estimates that duplicate check processing is a $500 million problem, which accounts for about half of the total check fraud in the U.S. (See "Seeing Double," by Glen Fest in American Banker, Nov. 1, 2010.)
Whether done by accident or fraudulently, duplicate check processing is becoming increasingly more expensive to weed out. Many believe that the new technology creates a unique opportunity for fraudsters. The problem is expected to increase as the remote deposit capture continues, especially as consumers are using smartphones to capture deposits. (That has to be the subject of another column.)
The banking industry, recognizing this problem, has developed software to identify checks that are deposited twice, but it is not foolproof. It tends to create false positives because the software only identifies checks that are identical in amount and payee. Complicating the situation further is when fraudsters get involved and change the payee and/or the amount of the check. The duplicate identification software is not designed to identify this type of fraudulent check.
Reformed con man Frank Abagnale has said that banks are generally liable for "ordinary care," according to U.S. Uniform Commercial Code (UCC) 4-103, and the bank that accepts a fraudulent check — paper or electronic image — is liable for any losses. Therefore, the banking industry has a real stake in doing what it can to reduce these losses. (See UCC provisions and "Check Fraud: A National Epidemic," by Frank Abagnale, New Jersey CPA, May/June 2010.) This is where CFEs can help.
High-tech fraudsters are always looking for new ways to access and manipulate digitized information. Basically, substitute checks may be altered, counterfeited, duplicated and/or created from scratch. If a payment is in question, only the substitute check image can be accessed. The result is that proving alterations and forgeries becomes even more difficult because many of the traditional security features so evident on paper checks are lost when the originals are scanned in the clearing process. In addition, with no actual cancelled paper checks to examine, evidence of counterfeiting, forgery and alterations (such as fingerprints) are not available for the auditor or CFE.
Systems controls need to be in place and working properly to prevent unauthorized persons from accessing electronic check processing data and to protect private customer information. CFEs can help implement these controls. Also, CFEs must keep current on changes in check-imaging technology and auditing electronic payment controls. Multiple lines of defense are needed to prevent problems. CFEs need to monitor controls to prevent/detect duplicate check processing.
VIGILANT WATCHDOGS
Electronic check processing technologies may make check fraud crimes harder to prove, especially if a jury is involved. It is important that consumers, businesses and banks are aware of the possible risks and take appropriate steps to protect themselves and their sensitive data. Electronic check processing is here to stay, and auditors and CFEs need to be ready to meet the challenges. Unless the watchdogs are vigilant, the community has to deal with increasingly more sophisticated fraudsters trying to commit electronic check fraud using altered substitute checks or check images.
Linda Lee Larson, DBA, CFE, CPA, CISA, is an associate professor of accounting at Central Washington University – Lynnwood Center in Lynnwood, Wash.
The Association of Certified Fraud Examiners assumes sole copyright of any article published onwww.fraud-magazine.com or www.ACFE.com. ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be emailed to FraudMagazine@ACFE.com.