SA hide the Fraud Risk Management 2024.pptx

Fraud Monitoring

1. Fraud Risk Management

2. Company Exposure Experience & position Qualification &Certification Company Exposure = Afreximbank , Egypt (2023-24), Berhan (2016-23), CBO(2013- 16), CBE(2010-13), RVU(2016-22*Part time) Experience & position = AM-Bus Risk and Control, Manager-ERM, Head-Risk section, RMC –officer, CSO, Lecturer Qualification & Certification = BA(Aksum Un), MSc ( Mekele Un), MBA( St.Mary Un), ACCA Dip.(UK), Certified Risk Expert(Frankfurt School), Certified Anti Money Laundering, Chartered ESG, and CISI (UK) member, FMVA, PRM & ACCA candidate, and others Self Introduction Elias F. Sewunet B Samson Company Exposure Experience & position Qualification &Certification

3. Objective of the training At the end of the training, participants shall understand : What is Risk? Types of Risks in Banking Industry What is Fraud Risk and why? Why do we fight against fraud? Most common types of fraud and serious irregularities Who is responsible for fraud prevention, detection, and correction, and your role Red flags, controls, Reporting, and corrective measures PolarPlus 3

4. Training Contents Part 1. Introduction and Risk Management Part 2. Fraud Risk Part 3. Understanding of Fraud Risk Part 4. IT Fraud Risk Part 5. Fraud Risk Management and Control Part 6.Evaluation and Conclusion PolarPlus 4

5. Part 1. Introduction and Risk Management Introduction Risk Management Common risks in the banking Industry PolarPlus 5

6. Vision To become a bank of choice in Ethiopia by 2030, mainly by maximizing women’s economic capabilities;” Mission To remain true to our name, set the trend in the provision of excellent and inclusive banking services mainly by focusing on women’s economic needs and taking advantage of the state-of-the-art, innovative, and professional workforce with the aim of maximizing the value of our shareholders;”

7. Values Learning Organization Concern for Employee Approachable Dedication Team work Professionalism Integrity Impartiality Product and Services Consumer and Commercial Banking Digital Banking Money Transfer Money Transfer Services Empowering women's

8. What is Risk? Risk is defined in different ways Most common definition :- The International Organization for Standardization (ISO) defines Risk simply as the “ effect of uncertainty on objectives” OR Risk is the possibility of suffering harm or loss (American Heritage Dictionary, Houghton Mifflin Co.)

9. Common Risk in Banking sectors PolarPlus 9

10. Operational Risk Operational risk refers to the risk of direct or indirect loss resulting from inadequate or failed internal processes, people, systems/technology or from external events It also include Fraud(Internal Fraud &External Fraud)

11. What is fraud? FRAUD means providing false or misleading information for personal gain Claiming travel expenses for a trip you did not go on.

12. Forms of Fraud PolarPlus 12

13. PolarPlus 13

14. What is fraud? FRAUD means providing false or misleading information for personal gain TYPES OF FRAUD

15. Part 3. Understanding of Fraud Risk- Internal Fraud Internal Fraud: mainly committed by employees of the bank . Bank fraud committed internally can take the ff forms Transaction reversals  A teller accepts a deposit from a customer and then reverses the deposit and pockets the funds Account manipulation  A banking professional removes fees or charges from their account or a friend’s or relative’s accounts Data theft  Banking employees steal personal data from customers, and then, they open accounts or apply for loans in their names Internal collusion  Two or more bank employees work together to bypass internal controls and steal money from the bank 15 PolarPlus

16. Part 3. Understanding of Fraud Risk- Internal Fraud --- IT administrator  Someone in the IT department temporarily grants administer rights to an unauthorized employee so they can approve a fraudulent transaction Identity theft, identity piracy or identity infringement  occurs when someone uses another's personal identifying information, like their name, identifying number, Insider trading - the buying or selling of securities by individuals who have access to non-public information about a company or its securities This information can be about financial performance, strategic plans, or other material events that can significantly impact the price of the company’s operation securities. Insider trading leads to information or securities fraud Allowing insider trading can create a culture of corruption and self-dealing in which people in positions of power abuse their position for personal gain. This can have far-reaching consequences, damaging institutions and harming innocent people who become caught up in corruption 16 PolarPlus

17. Part 3. Understanding of Fraud Risk- Internal Fraud --- Red Flags for Internal Bank Fraud  The signs of internal fraud vary based on the type of fraud being committed. t he following are very common signs to indicate internal fraud in banks Multiple customer complaints about incorrect balances or your branch receives an increased volume of customer complaints about issues such as incorrect balances or deposits not being credited, an employee may be the culprit/offender. Unexplained increases in expenses or Unexplained increases in expenses may indicate that an employee is drafting payments to a fake vendor and pocketing the money. Unusual invoice patterns or Unusual patterns with invoices can also be a sign of internal bank fraud. 17 PolarPlus

18. Part 3. Understanding of Fraud Risk- Internal Fraud --- Red Flags for Internal Bank Fraud  Employees who refuse to take time off or An employee who works all the time and puts in extra hours on the weekend may seem like an asset to the company, but they can be a liability. For example, the collapse of French investment bank Société Générale in March 2008 was perpetrated by a trader who had not taken a day off for eight months. Employees under pressure or Most internal fraud does not happen in a vacuum. Thieves typically require four elements to commit a crime: pressure, opportunity, capacity and rationalization. Bypass of validation controls or If you see any signs that internal controls are being bypassed, your bank may be the victim of internal fraud. or Even if Internal controls are designed to reduce the risk of fraud, but they can be bypassed in different ways. Activity in dormant accounts or Dishonest employees may be tempted to steal funds from a dormant account. 18 PolarPlus

19. Part 3. Understanding of Fraud Risk- External Fraud --- External Fraud is the risk of unexpected financial, material or reputational loss as the result of fraudulent action of persons external to the firm. Example: Theft , Robbery, Forgery, cheque Kiting, cheque fraud Systems Security ( data hacking), Card Fraud Money laundering 19 PolarPlus

20. Part 3. Understanding of Fraud Risk- External Fraud --- While there are many different kinds of fraud the primary classifications are listed below: First Party Fraud -First-party fraud is when an individual or an organization purposely misrepresents their identity or P rovides incorrect information to gain an unfair or unlawful advantage. This may involve using a synthetic identity. The risk to be covered under this sub risk types/events includes Credit card fraud Misrepresenting identity Second Party Fraud This type of fraud involves an individual agreeing to give their personal information to a family member or a close friend to commit the fraud 20 PolarPlus

21. Part 3. Understanding of Fraud Risk- External Fraud --- Money mulling / Friendly fraud Third Party Fraud • It involves fraudsters using an innocent person’s identity and information to take over their bank account without their consent. The risk to be covered under this sub risk types/events includes: Account takeover (ATO) /hijack account ( eg. Mobile banking, online banking) Payment to stolen identity Forgery : (e.g. Encashment of forged notes, forged documentation, forgery of signature etc ) Fraud/forgery of financial instrument (Check fraud, CPO fraud and others) Robbery Agent/ broker/ intermediary fraud 21 PolarPlus

22. Part 3. Understanding of Fraud Risk- External Fraud --- Risks arising from agents , intermediaries and other parties who intermediate between the customer and the Bank. The risk to be covered under this sub risk types/events includes, Unauthorized fee by agents Unauthorized access to customer PIN Split withdrawal Agent misdirect fund Agent counterfeit currency Voucher fraud Theft by service provider Robbery by service provider 22 PolarPlus

23. PolarPlus 23

24. Part 5-Fraud Risk Management F raud risk management - .is a holistic and proactive fraud mitigation approach that is embedded within an organization Is a systematic process used to identify, analyze, and mitigate the potential risks of fraud within an organization.  It involves evaluating the likelihood and potential impact of fraudulent activities on the organization’s objectives, operations, finances, and reputation 24 PolarPlus

25. Fraud Risk Management E ffective fraud risk management involves a strategic approach comprising three key steps. Step1:Risk identification Step 2: Preventive measures Step 3: Detection and response 25 PolarPlus

26. Fraud Risk Management Step1:Risk identification - (Three stages) Understanding potential threats - a thorough examination of the environment to understand the types of fraud threats that exist Assessing vulnerabilities - pinpoint areas vulnerable to fraud and examine weak cells! Prioritizing risks - prioritize identified risks based on their potential impact and likelihood 26 PolarPlus

27. Fraud Risk Management Step 2: Preventive Measures ( Three Stages) Building strong defenses -I mplementing safeguards and controls (prevention) - setting up rules, policies, and security measures to make it challenging for fraudsters to succeed Employee training and awareness creation - Provide comprehensive training to employees, helping them recognize potential risks and understand their role in fraud prevention Technological advancements - Leverage cutting-edge fraud prevention technologies and tools that can proactively identify and mitigate fraud risks. These tools act as electronic guards, constantly monitoring for suspicious activities and anomalies. Segregation of duties-Four eyes principle Transactions are authorized and approved Physical control of assets 27 PolarPlus

28. Fraud Risk Management Step 3: Detection and response - the act or process of extracting information (Three stages) Early warning systems - establish systems (Advanced analytics and monitoring systems) that can detect fraud in its early stages Response protocols - have well-defined procedures for responding to detected fraud, including immediate action to mitigate the situation, conducting investigations, and fraud reporting Continuous improvement - Regularly evaluate and refine FRM strategy, learn from past incidents, adjust prevention measures promptly, and enhance detection capabilities to stay ahead of evolving threats. 28 PolarPlus

29. Fraud Risk Management- control FRAUD CONTROL! Why should I Care? Protect yourself and your friends Protect the bank’s assets Help deter fraud Watch out for Management directives Your work basement must be the policy & procedure of the bank 29 PolarPlus

30. Fraud Risk Management- control FRAUD CONTROL! Why should I Care? Value your Signature! Know what you are signing -You are responsible for what you have signed Don’t use a rubber stamp Don’t sign blank forms Don’t let other people sign your name or initials Before signing! Document, What? Why? 30 PolarPlus

31. Fraud Risk Management- control FRAUD CONTROL! Why should I Care? Protect your Password Don’t share your password with anybody else, NEVER & EVER! Don’t let anyone watch you enter your password. Use a strong password that you don’t have to write down. “TRUST AFTER LOCK”! 31 PolarPlus

32. Fraud Risk Management- control FRAUD CONTROL! Why should I Care? Segregation of Duties - No one should control any process from initial to end. No one can approve their transaction, or each transaction should have at least 2 people involved: an initiator and an approver. Reduces the possibility of errors - Financial and Other Reports Review financial reports regularly, Review reports showing who accessed computer files Review suspense Accounts Regularly Investigate unusual transactions 32 PolarPlus

33. Fraud Risk Management- control FRAUD CONTROL! Simple Rule Not  everything that looks suspicious is a fraud, but every fraud looks suspicious. If it looks suspicious, follow up. Your work basement must be the policy & procedure of the bank 33 PolarPlus

34. Fraud Risk Management- example IN XYZ BANK (Cases by employees & customers) - Based on circular issued from Branch Affairs Directorate, identified fraud events: Producing forgery cheque Using International money transfer Using lost or stolen cheque Modifying customers data on core banking Illicit ID Illegal name Un-Renewed ID card Emulating customers signature Producing forgery power of Attorney Amending customers telephone number 34 PolarPlus

35. Fraud Risk Management- example IN ABC BANK (Cases by employees & customers) - Based on circular issued from Branch Affairs Directorate, identified fraud events: Producing forgery confirmation letter stealing ATM card Forgery trade license & related documents Forgery CPO, Title deed documents Opening account with forgery ID -VISA card, using own authority position Presenting incomplete ID card POS, Stealing pass word Producing forgery letter of guarantee 35 PolarPlus

36. Fraud Risk Management- example Disciplinary measures taken by XYZ Bank Bingo Withdrawing money from a customer account by transferring to another person's account Sentenced to 16 years imprisonment and Birr 15,000 fine 2 Head Office Branch Falsification of documents on system and unlawful withdrawal of money Sentenced to 3 years rigorous imprisonment & Birr 2000 fine Head Office Branch Falsification of documents on the system and unlawful withdrawal of money Sentenced to 5 years of imprisonment and Birr 4000 fine. 36 PolarPlus

37. Fraud Risk Management- example Head Office Fraud with forged power of attorney Each sentenced to 4 years of imprisonment and Birr 10,000 fine. X branch Withdrawal of Money with forged ID Sentenced with 2 years of rigorous imprisonment & 2000 br penalty fee Y Branch Attempted crime on withdrawal of money with stolen pass book Sentenced with 1 year and 4 months of imprisonment and 500 br penalty fee 37 PolarPlus

38. Fraud Risk Management- example Mr. Simon, staff of TRans , Energy Ltd's email account was hacked. Hacker sends payment request of USD3,000,000 Loan Disbursement unit received a payment request from Mat Energy Limited on April 2023 to process the payment of Euro 528,000 to Mass Repair and Supply Limited. Where the Mat did not send the request The North Region discovered a fraudulent transfer attempt on August 2023. The team was supposed to receive a bank transfer of EUR 1.7 million and EUR 3.1 from X Bank Guinea to reimburse the loan. The bank did not send the request. 38 PolarPlus

39. Fraud Risk Management- example Head Office Fraud with forged power of attorney Each sentenced to 4 years of imprisonment and Birr 10,000 fine. X branch Withdrawal of Money with forged ID Sentenced with 2 years of rigorous imprisonment & 2000 br penalty fee Y Branch Attempted crime on withdrawal of money with stolen pass book Sentenced with 1 year and 4 months of imprisonment and 500 br penalty fee 39 PolarPlus

40. Fraud Cases-1 Mr. Sani was posted as Assistant Branch Manager (ABM) of the Tani branch. His primary role is to source business, conduct Personal Discussions (PD) with prospective borrowers, and furnish a PD report as a part of the pre-sanction loan process. Borrower Ms. Kari visited the branch to pre-close her retail loan. Mr. Sani collected the cash and provided a pre-closure statement along with his signature and branch stamp as acknowledgment (fake receipt). Instead of accounting the cash into the borrower’s account, ABM handed over this cash to Mr. Pati posted as Receivables Officer (RO). ABM and RO colluded and mis-utilized the pre-closure amount received from the borrower. Branch Manager (BM) Mr. Vati having known the facts of the case, did not escalate the incident to their supervisors/Head Office. Ms. Kari raised a complaint through customer support about the non-receipt of SMS towards the pre-closure of the loan account. What went wrong / Lapses, which enabled the perpetration of fraud? Action taken ? 40 PolarPlus

41. Fraud Cases-solution Who are the participants in the case = ABM, BM, RO, Borrower What is their role = Customer relationship, managing branch, receivable controller What went wrong = fake receipt issued in return for cash Who should have taken a ction? Branch Manager What type of fraud has happened = collusion What control mechanism was violated/broken = Integrity failure and customer complaint handling failure 41 PolarPlus

42. Speaking impact 42

43. Thank you WE ALL ARE POLAR PLUS