Computer Fraud - Chapter 5

Natural and Political Disasters: Includes events like storms, hurricanes, tornadoes, and earthquakes.
Software Errors and Equipment Malfunctions: Software bugs that impair business operations.
Unintentional Acts: Mistakes made by humans.
Intentional Acts:
- Computer crime.
- Fraud.
- Intentional sabotage of information systems.
- Reference to Brian Krebs' blog (krebsonsecurity.com).

Definition: Any means used to gain an unfair advantage over another person.
Elements:
- False statement, representation, or disclosure.
- Material fact inducing action by a victim.
- Intent to deceive.
- Victim reliance on misrepresentation.
- Injury or loss suffered by the victim.
Characterization:
- White-collar crime: Financially motivated, nonviolent crime.
- Examples: Identity theft.
- Often perpetrated by knowledgeable insiders.

Misappropriation of Assets:
- Theft of company assets.
- Includes physical assets (e.g., cash, inventory) and digital assets (e.g., intellectual property, customer data).
Fraudulent Financial Reporting:
- "Cooking the books".
- Examples: Booking fictitious revenue, overstating assets.

Three conditions must be present for fraud to occur:
- Pressure:
  - Employee:
    - Financial pressures.
    - Lifestyle pressures.
    - Emotional pressures.
  - Financial Statement:
    - Financial pressures.
    - Management pressures.
    - Industry conditions.
- Opportunity:
  - To commit fraud.
  - To conceal fraud.
  - To convert assets to personal gain.
- Rationalization:
  - Justifying behavior.
  - Attitude that rules don’t apply.
  - Lack of personal integrity.
Indicators related to Pressure, Opportunity, or Rationalization:
- Significant cash flow problems or difficulties in collecting receivables or paying payables.
- Dominant and unchallenged management.
- The perception that everyone is committing fraud.

Definition: Fraud committed using a computer.
Classifications:
- Input fraud.
- Processor fraud.
- Computer instruction fraud.
- Data fraud.
- Output fraud.
Example: The movie "Office Space," where employees change computer code to divert fractions of pennies to their account.
Other movies with fraud-related plots: "Catch Me If You Can," "The Informant!"

Make Fraud Less Likely to Occur
- Organizational Systems:
  - Create a culture of integrity.
  - Adopt a structure that minimizes fraud; create governance (e.g., Board of Directors).
  - Assign authority for business objectives and hold individuals accountable; ensure effective supervision and monitoring.
  - Communicate policies.
  - Develop security policies to guide control procedures.
  - Implement change management and project development acquisition controls.
Make It Difficult to Commit
- Organizational Systems:
  - Develop strong internal controls.
  - Segregate accounting functions.
  - Use properly designed forms.
  - Require independent checks and reconciliations.
  - Restrict access.
  - Implement system authentication.
  - Use computer controls over input, processing, storage, and output.
  - Use encryption.
  - Fix software bugs and update systems regularly.
  - Destroy hard drives when disposing of computers.
Improve Detection
- Organizational Systems:
  - Assess fraud risk.
  - Conduct external and internal audits.
  - Establish a fraud hotline (e.g., In Dubai - 800-2626).
  - Maintain an audit trail of transactions.
  - Install fraud detection software.
  - Monitor system activities (user and error logs, intrusion detection).
Reduce Fraud Losses
- Organizational Systems:
  - Insurance.
  - Business continuity and disaster recovery plan.
  - Store backup copies of program and data files in a secure, off-site location.
  - Monitor system activity.

Scenario: An executive confesses to kiting $100,000$ .
- What is kiting, and how can it be prevented?
- How to respond to the confession?
- What issues to consider before pressing charges?

Definition: Creating cash using the time lag between check deposit and clearance.
Illegally exploiting float time between banks, creating false balances and accessing unavailable money.

Person A has two bank accounts:
- Bank 1 (Account A): Little money.
- Bank 2 (Account B): Little or no money.
Steps:
1. Person A writes a check for $5,000$ from Account A (Bank 1) and deposits it into Account B (Bank 2).
2. Bank 2 credits Account B with $5,000$ immediately (banks often make funds available before clearance).
  - Note: Regulations (e.g., U.S. Federal Reserve’s Regulation CC) require banks to make certain amounts available quickly (e.g., $225$ the next business day in the U.S.).
3. Before Bank 1 realizes insufficient funds in Account A, Person A withdraws $5,000$ from Account B (Bank 2).
4. Bank 1 finds insufficient funds and returns the check unpaid.
Result:
- Bank 2 is missing $5,000$ .
- Person A has taken the money, benefiting from "created" money.

First National Bank of Keystone:
- Executives involved in a famous check kiting scandal in the late 1990s.
- Lesson: Check kiting can collapse banks/companies (e.g., a loss of $778$ million).
Frank Abagnale:
- Forged and passed checks worth millions in the 1960s.
- His life story was popularized by the movie "Catch Me If You Can."
- Lesson: Trust in appearance can be dangerous.

Detection: Analyze all interbank transfers; a significant increase is a red flag.
Immediate Actions:
- Investigate the fraud and determine actual losses (employees may under-report).
- Determine controls to prevent or detect similar frauds.

Which control is most important to deter fraud?
- (c) Segregation of duties (Correct).