C HAPTER 5 Computer Fraud and Security

(1)

C

HAPTER 5

Computer Fraud and

Security

(2)

INTRODUCTION

• Questions to be addressed in this chapter:

– What is fraud, and how are frauds

perpetrated?

– Who perpetrates fraud and why?

– What is computer fraud, and what forms does

it take?

– What approaches and techniques are used to

commit computer fraud?

(3)

INTRODUCTION

• Information systems are becoming

increasingly more complex and society is

becoming increasingly more dependent on

these systems.

– Companies also face a growing risk of these

systems being compromised.

– Recent surveys indicate 67% of companies

suffered a security breach in the last year with

almost 60% reporting financial losses.

(4)

INTRODUCTION

• Companies face four types of threats to

their information systems:

– Natural and political disasters

• Include:

– Fire or excessive heat – Floods

– Earthquakes – High winds

– War and terrorist attack

• When a natural or political disaster strikes, many companies can be affected at the same time.

– Example: Bombing of the World Trade Center in NYC. • The Defense Science Board has

predicted that attacks on

information systems by foreign countries, espionage agents, and terrorists will soon be widespread.

(5)

INTRODUCTION

• Companies face four types of threats to

their information systems:

– Natural and political disasters

– Software errors and equipment

malfunction

• Include:

– Hardware or software failures

– Software errors or bugs – Operating system

crashes

– Power outages and fluctuations

– Undetected data transmission errors

• Estimated annual economic losses due to software

bugs = $60 billion.

• 60% of companies studied had significant software errors in previous year.

(6)

INTRODUCTION

• Companies face four types of threats to

their information systems:

– Natural and political disasters

– Software errors and equipment malfunction

– Unintentional acts

• Include

– Accidents caused by: • Human carelessness

• Failure to follow established procedures

• Poorly trained or supervised personnel

– Innocent errors or omissions

– Lost, destroyed, or misplaced data – Logic errors

– Systems that do not meet needs or are incapable of performing intended tasks

• Information Systems Security Assn. estimates 65% of security problems are

(7)

INTRODUCTION

• Companies face four types of threats to

their information systems:

– Natural and political disasters

– Software errors and equipment malfunction

– Unintentional acts

– Intentional acts (computer crime)

• Include:

– Sabotage

– Computer fraud

– Misrepresentation, false use, or unauthorized disclosure of data – Misappropriation of assets

– Financial statement fraud

• Information systems are increasingly vulnerable to these malicious attacks.

(8)

INTRODUCTION

• In this chapter we’ll discuss:

– The fraud process

– Why fraud occurs

– Approaches to computer fraud

– Specific techniques used to commit computer

fraud

– Ways companies can deter and detect

computer fraud

(9)

THE FRAUD PROCESS

• Fraud

is any and all means a person uses to

gain an unfair advantage over another person.

• In most cases, to be considered fraudulent, an

act must involve:

– A false statement (oral or in writing)

– About a material fact

– Knowledge that the statement was false when it was

uttered (which implies an intent to deceive)

– A victim relies on the statement

– And suffers injury or loss as a result

• The definition is the same whether it is a criminal or civil fraud case.

– The only difference is the burden of proof required.

• Criminal case: Beyond a reasonable doubt.

• Civil case: Preponderance of the evidence OR clear and convincing evidence.

(10)

THE FRAUD PROCESS

• Since fraudsters don’t make journal entries to

record their frauds, we can only estimate the

amount of losses caused by fraudulent acts:

– The Association of Certified Fraud Examiners (ACFE)

estimates that total fraud losses in the U.S. run

around 6% of annual revenues or approximately $660

billion in 2004.

• More than we spend on education and roads in a year. • 6 times what we pay for the criminal justice system.

– Income tax fraud (the difference between what

taxpayers owe and what they pay to the government)

is estimated to be over $200 billion per year.

– Fraud in the healthcare industry is estimated to

exceed $100 billion a year.

(11)

THE FRAUD PROCESS

• Fraud against companies may be committed by

an employee or an external party.

– Former and current employees (called

knowledgeable insiders

) are much more likely than

non-employees to perpetrate frauds (and big ones)

against companies.

• Largely owing to their understanding of the company’s

systems and its weaknesses, which enables them to commit the fraud and cover their tracks.

– Organizations must utilize controls to make it difficult

for both insiders and outsiders to steal from the

(12)

THE FRAUD PROCESS

• Fraud perpetrators are often referred to as

white-collar criminals

.

– Distinguishes them from violent criminals,

although some white-collar crime can

ultimately have violent outcomes, such as:

• Perpetrators or their victims committing suicide.

• Healthcare patients killed because of alteration of

(13)

Types of Frauds

OCCUPATIONAL • Fraudulent Statements – Financial – Non-financial • Asset Misappropriation – Theft of Cash – Fraudulent disbursements – Inventory and other assets

• Bribery and Corruption

– Bribery

– Illegal gratuities – Economic extortion – Conflict of interest

OTHER

• Intellectual property theft • Financial institution fraud • Check and credit card fraud • Insurance fraud • Healthcare fraud • Bankruptcy fraud • Tax fraud • Securities fraud • Money laundering • Consumer fraud

(14)

THE FRAUD PROCESS

• Three types of occupational fraud:

– Misappropriation of assets

• Involves theft, embezzlement, or misuse of company assets for personal gain.

• Examples include billing schemes, check tampering, skimming, and theft of inventory.

• In the 2004 Report to the Nation on Occupational

Fraud and Abuse, 92.7% of occupational frauds

involved asset misappropriation at a median cost of $93,000.

(15)

THE FRAUD PROCESS

• Three types of occupational fraud:

– Misappropriation of assets

– Corruption

• Corruption involves the wrongful use of a position, contrary to the responsibilities of that position, to procure a benefit.

• Examples include kickback schemes and conflict of interest schemes.

• About 30.1% of occupational frauds include corruption schemes at a median cost of

(16)

THE FRAUD PROCESS

• Three types of occupational fraud:

– Misappropriation of assets

– Corruption

– Fraudulent statements

• Financial statement fraud involves misstating the financial condition of an entity by intentionally misstating amounts or disclosures in order to deceive users.

• Financial statements can be misstated as a result of intentional efforts to deceive or as a result of undetected asset misappropriations that are so large that they cause misstatement.

• About 7.9% of occupational frauds involve fraudulent statements at a median cost of $1 million. (The median pales in comparison to the

(17)

THE FRAUD PROCESS

• A typical employee fraud has a number of important elements or characteristics:

– The fraud perpetrator must gain the trust or confidence of the person or company being defrauded in order to commit and conceal the fraud.

– Instead of using a gun, knife, or physical force, fraudsters use weapons of deceit and misinformation.

– Frauds tend to start as the result of a perceived need on the part of the employee and then escalate from need to greed. Most fraudsters can’t stop once they get started, and their frauds grow in size.

– The fraudsters often grow careless or overconfident over time. – Fraudsters tend to spend what they steal. Very few save it.

– In time, the sheer magnitude of the frauds may lead to detection. – The most significant contributing factor in most employee frauds

(18)

THE FRAUD PROCESS

• The National Commission on Fraudulent

Financial Reporting (aka, the Treadway

Commission) defined fraudulent financial

reporting as intentional or reckless conduct,

whether by act or omission, that results in

materially misleading financial statements.

• Financial statements can be falsified to:

– Deceive investors and creditors

– Cause a company’s stock price to rise

– Meet cash flow needs

(19)

THE FRAUD PROCESS

• Fraudulent financial reporting is of great

concern to independent auditors, because

undetected frauds lead to half of the

lawsuits against auditors.

• In the case of Enron, a financial statement

fraud led to the total elimination of Arthur

Andersen, a premiere international public

accounting firm.

(20)

THE FRAUD PROCESS

• Common approaches to “cooking the

books” include:

– Recording fictitious revenues

– Recording revenues prematurely

– Recording expenses in later periods

– Overstating inventories or fixed assets

(WorldCom)

(21)

THE FRAUD PROCESS

• The Treadway Commission recommended four

actions to reduce the possibility of fraudulent

financial reporting:

– Establish an organizational environment that

contributes to the integrity of the financial reporting

process.

– Identify and understand the factors that lead to

fraudulent financial reporting.

– Assess the risk of fraudulent financial reporting within

the company.

– Design and implement internal controls to provide

reasonable assurance that fraudulent financial

(22)

THE FRAUD PROCESS

• SAS 99: The Auditor’s Responsibility

to Detect Fraud

– In 1997, SAS-82, Consideration of Fraud in a

Financial Statement Audit, was issued to

clarify the auditor’s responsibility to detect

fraud.

(23)

THE FRAUD PROCESS

• A revision to SAS-82, SAS-99, was issued in

December 2002. SAS-99 requires auditors to:

– Understand fraud

• Auditors can’t effectively audit something they don’t understand.

• SAS-99 also indicated that auditors are not lawyers and “do not make legal determinations of whether fraud has occurred.”

• The external auditor’s interest specifically relates to acts that result in a material misstatement of the financial statements. • Note that SAS-99 relates to external auditors. Internal auditors

will have a more extensive interest in fraud than just those that impact financial statements.

(24)

THE FRAUD PROCESS

• A revision to SAS-82, SAS-99, was issued in

December 2002. SAS-99 requires auditors to:

– Understand fraud

– Discuss the risks of material fraudulent

misstatements

• While planning the audit, members of the audit team should discuss how and where the company’s financial statements might be susceptible to fraud.

(25)

THE FRAUD PROCESS

• A revision to SAS-82, SAS-99, was issued in

December 2002. SAS-99 requires auditors to:

– Understand fraud

– Discuss the risks of material fraudulent misstatements

– Obtain information

• The audit team must gather evidence about the existence of fraud by:

– Looking for fraud risk factors – Testing company records

– Asking management, the audit committee, and others if they know of any past or current fraud or of fraud risks the

organization faces.

• Special care needs to be exercised in examining revenue accounts, since they are particularly popular fraud targets.

(26)

THE FRAUD PROCESS

• A revision to SAS-82, SAS-99, was issued in

December 2002. SAS-99 requires auditors to:

– Understand fraud

– Discuss the risks of material fraudulent misstatements

– Obtain information

– Identify, assess, and respond to risks

• Use the gathered information to identify, assess, and respond to risks.

• Auditors can respond by varying the nature, timing, and extent of auditing procedures they perform.

• They should also carefully evaluate risks related to management override of controls.

(27)

THE FRAUD PROCESS

• A revision to SAS-82, SAS-99, was issued in

December 2002. SAS-99 requires auditors to:

– Understand fraud

– Discuss the risks of material fraudulent misstatements

– Obtain information

– Identify, assess, and respond to risks

– Evaluate the results of their audit tests

• Auditors must assess the risk of fraud throughout the audit.

• When the audit is complete, they must evaluate whether any identified misstatements indicate the presence of fraud. • If so, they should determine the impact on the financial

(28)

THE FRAUD PROCESS

• A revision to SAS-82, SAS-99, was issued in

December 2002. SAS-99 requires auditors to:

– Understand fraud

– Discuss the risks of material fraudulent misstatements

– Obtain information

– Identify, assess, and respond to risks

– Evaluate the results of their audit tests

– Communicate findings

• Auditors communicate their fraud findings to management, the audit committee, and others.

(29)

THE FRAUD PROCESS

• A revision to SAS-82, SAS-99, was issued in

December 2002. SAS-99 requires auditors to:

– Understand fraud

– Discuss the risks of material fraudulent misstatements

– Obtain information

– Identify, assess, and respond to risks

– Evaluate the results of their audit tests

– Communicate findings

– Document their audit work

(30)

WHO COMMITS FRAUD AND WHY

• Researchers have compared the psychological and

demographic characteristics of three groups of people:

– White-collar criminals – Violent criminals

– The general public

• They found:

– Significant differences between violent and white-collar criminals. – Few differences between white-collar criminals and the general

(31)

WHO COMMITS FRAUD AND WHY

• White-collar criminals tend to mirror the general

public in:

– Education

– Age

– Religion

– Marriage

– Length of employment

– Psychological makeup

(32)

WHO COMMITS FRAUD AND WHY

• Perpetrators of computer fraud tend to be

younger and possess more computer

knowledge, experience, and skills.

• Hackers and computer fraud perps tend to be

more motivated by:

– Curiosity

– A quest for knowledge

– The desire to learn how things work

– The challenge of beating the system

(33)

WHO COMMITS FRAUD AND WHY

• They may view their actions as a game rather than

dishonest behavior.

• Another motivation may be to gain stature in the hacking

community.

• Some see themselves as revolutionaries spreading a

message of anarchy and freedom.

• But a growing number want to profit financially. To do

so, they may sell data to:

– Spammers

– Organized crime – Other hackers

(34)

WHO COMMITS FRAUD AND WHY

• Some fraud perpetrators are disgruntled and

unhappy with their jobs and are seeking revenge

against their employers.

• Others are regarded as ideal, hard-working

employees in positions of trust.

• Most have no prior criminal record.

(35)

WHO COMMITS FRAUD AND WHY

• Criminologist Donald Cressey, interviewed 200+

convicted white-collar criminals in an attempt to

determine the common threads in their crimes.

As a result of his research, he determined that

three factors were present in the commission of

each crime. These three factors have come to

be known as the fraud triangle.

– Pressure

– Opportunity

– Rationalization

(36)

The “Fraud Triangle”

Donald Cressey

Pressure

Opportunity

(37)

WHO COMMITS FRAUD AND WHY

• Pressure

– Cressey referred to this pressure as a

“perceived non-shareable need.”

– The pressure could be related to

finances, emotions, lifestyle, or some

combination.

(38)

WHO COMMITS FRAUD AND WHY

• The most common pressures were:

-

Not being able to pay one’s debts, nor admit it to

one’s employer, family, or friends (which makes in

non-shareable)

• May be associated with vices, such as drugs, gambling, mistresses, etc.

(39)

WHO COMMITS FRAUD AND WHY

• The most common pressures were:

-

Not being able to pay one’s debts, nor admit it to

one’s employer, family, or friends (which makes in

non-shareable)

-

Fear of loss of status because of a personal

failure

_{• Example would be mismanagement of}

a personal investment or retirement fund.

(40)

WHO COMMITS FRAUD AND WHY

• The most common pressures were:

-

Not being able to pay one’s debts, nor admit it to

one’s employer, family, or friends (which makes in

non-shareable)

-

Fear of loss of status because of a personal failure

-

Business reversals

• Not many people can walk away from a failing business.

(41)

WHO COMMITS FRAUD AND WHY

• The most common pressures were:

-

Not being able to pay one’s debts, nor admit it to

one’s employer, family, or friends (which makes in

non-shareable)

-

Fear of loss of status because of a personal failure

-

Business reversals

-

Physical isolation

• When an individual is isolated,

physically or psychologically, almost any pressure becomes

(42)

WHO COMMITS FRAUD AND WHY

• The most common pressures were:

-

Not being able to pay one’s debts, nor admit it to

one’s employer, family, or friends (which makes in

non-shareable)

-

Fear of loss of status because of a personal failure

-

Business reversals

-

Physical isolation

-

Status gaining

-

Difficulties in employer-employee relations

• May create pressure to get revenge, take the money you feel is rightfully owed to you, etc.

(43)

WHO COMMITS FRAUD AND WHY

• Financial statement fraud is distinct from other

types of fraud in that the individuals who commit

the fraud are not the direct beneficiaries.

– The company is the direct beneficiary.

(44)

WHO COMMITS FRAUD AND WHY

• In the case of financial statement frauds, common

pressures include:

– To prop up earnings or stock price so that management can: • Receive performance-related compensation.

• Preserve or improve personal wealth held in company stock or stock options.

• Keep their jobs.

– To cover the inability to generate cash flow. – To obtain financing.

– To appear to comply with bond covenants or other agreements. – May be opposite of propping up earnings in cases involving

income-tax motivations, government contracts, or regulation.

• Click here for a comprehensive list of pressures

.

Pressures

(45)

PRESSURES THAT LEAD TO EMPLOYEE

FRAUD

FINANCIAL • Living beyond means • High personal debt/expenses • “Inadequate” salary/income

• Poor credit ratings • Heavy financial losses • Bad investments • Tax avoidance • Meet unreasonable quotas/goals EMOTIONAL • Greed • Unrecognized performance • Job dissatisfaction • Fear of losing job • Power or control • Pride or ambition • Beating the system • Frustration • Non-conformity • Envy, resentment • Arrogance, dominance LIFESTYLE • Support gambling habit • Drug or alcohol addiction • Support sexual relationships • Family/peer pressure

(46)

WHO COMMITS FRAUD AND WHY

• Opportunity is the opening or gateway that

allows an individual to:

– Commit the fraud

– Conceal the fraud

(47)

WHO COMMITS FRAUD AND WHY

• Committing the fraud might involve acts

such as:

– Misappropriating assets.

– Issuing deceptive financial statements.

– Accepting a bribe in order to make an

arrangement that is not in the company’s best

interest.

(48)

WHO COMMITS FRAUD AND WHY

• Concealing the fraud often takes more time and

effort and leaves more evidence than the actual

theft or misrepresentation.

• Examples of concealment efforts:

– Charge a stolen asset to an expense account or to an

account receivable that is about to be written off.

– Create a ghost employee who receives an extra

paycheck.

(49)

WHO COMMITS FRAUD AND WHY

• Concealing the fraud often takes more time and

effort and leaves more evidence than the actual

theft or misrepresentation.

• Examples of concealment efforts:

– Charge a stolen asset to an expense account or to an

account receivable that is about to be written off.

– Create a ghost employee who receives an extra

paycheck.

– Lapping.

• Steal a payment from Customer A.

• Apply Customer B’s payment to Customer A’s account so Customer A won’t get a late notice.

• Apply Customer C’s payment to Customer B’s account, so Customer B won’t get a late notice, etc.

(50)

WHO COMMITS FRAUD AND WHY

• Concealing the fraud often takes more time and

effort and leaves more evidence than the actual

theft or misrepresentation.

• Examples of concealment efforts:

– Charge a stolen asset to an expense account or to an

account receivable that is about to be written off.

– Create a ghost employee who receives an extra

paycheck.

– Lapping.

– Kiting.

• Creates “cash” by transferring money between banks. • Requires multiple bank accounts.

• Basic scheme:

– Write a check on the account of Bank A.

– Bank A doesn’t have sufficient funds to cover the

check, so write a check from an account in Bank B to be deposited in Bank A.

– Bank B doesn’t have sufficient funds to cover the

check, so write a check from an account in Bank C to be deposited in Bank B, etc.

(51)

WHO COMMITS FRAUD AND WHY

• Unless the target of the theft is cash, then

the stolen goods must be converted to

cash or some form that is beneficial to the

perpetrator.

– Checks can be converted through alterations,

forged endorsements, check washing, etc.

– Non-cash assets can be sold (online auctions

are a favorite forum) or returned to the

(52)

WHO COMMITS FRAUD AND WHY

• If the fraud is a financial statement fraud,

then the gains received may include:

– I got to keep my job.

– The value of my stock or stock options rose.

– I got a raise, promotion, or bonus.

(53)

• There are many opportunities that enable fraud.

Some of the most common are:

– Lack of internal controls

– Failure to enforce controls (the most prevalent

reason)

– Excessive trust in key employees

– Incompetent supervisory personnel

– Inattention to details

– Inadequate staff

• Click here for a comprehensive list of

opportunities.

(54)

OPPORTUNITIES PERMITTING EMPLOYEE

AND FINANCIAL STATEMENT FRAUD

• Internal Control Factors

– Failure to enforce/monitor internal controls – Management not involved in control system

– Management override of controls and guidelines – Managerial carelessness, inattention to details – Dominant and unchallenged management

– Ineffective oversight by board of directors – No effective internal auditing staff

– Infrequent third-party reviews

– Insufficient separation of authorization, custody, and record-keeping duties

– Too much trust in key employees – Inadequate supervision

(55)

OPPORTUNITIES PERMITTING EMPLOYEE

AND FINANCIAL STATEMENT FRAUD

– Lack of proper authorization procedures – No independent checks on performance – Inadequate documents and records

– Inadequate system for safeguarding assets – No physical or logical security system

– No audit trails

– Failure to conduct background checks

(56)

OPPORTUNITIES PERMITTING EMPLOYEE

AND FINANCIAL STATEMENT FRAUD

• Other Factors

– Large, unusual, or complex transactions – Numerous adjusting entries at year end – Related-party transactions

– Accounting department understaffed and overworked – Incompetent personnel

– Rapid turnover of key employees – Lengthy tenure in a key job

– Unnecessarily complex organizational structure

– No code of conduct, conflict of interest statements, or definitions of unacceptable behavior

– Frequently changing auditors, legal counsel – Operating on a crisis basis

(57)

OPPORTUNITIES PERMITTING EMPLOYEE

AND FINANCIAL STATEMENT FRAUD

– Assets highly susceptible to misappropriation – Questionable accounting practices

– Pushing accounting principles to the limit – Unclear company policies and procedures – Failing to teach and stress corporate honesty – Failure to prosecute dishonest employees – Low employee morale and loyalty

(58)

WHO COMMITS FRAUD AND WHY

• Internal controls that may be lacking or

un-enforced include:

– Authorization procedures

– Clear lines of authority

– Adequate supervision

– Adequate documents and records

– A system to safeguard assets

– Independent checks on performance

– Separation of duties

∙ One control feature that many companies lack is

a background check on all potential employees.

(59)

WHO COMMITS FRAUD AND WHY

• Management may allow fraud by:

– Not getting involved in the design or

enforcement of internal controls;

– Inattention or carelessness;

– Overriding controls; and/or

– Using their power to compel subordinates to

carry out the fraud.

(60)

WHO COMMITS FRAUD AND WHY

• How many people do you know who regard

themselves as being unprincipled or sleazy?

• It is important to understand that fraudsters do

not regard themselves as unprincipled.

– In general, they regard themselves as highly

principled individuals.

– That view of themselves is important to them.

– The only way they can commit their frauds and

maintain their self image as principled individuals is to

create rationalizations that recast their actions as

(61)

WHO COMMITS FRAUD AND WHY

• These rationalizations take many forms,

including:

– I was just borrowing the money.

– It wasn’t really hurting anyone. (Corporations are

often seen as non-persons, therefore crimes against

them are not hurting “anyone.”)

– Everybody does it.

– I’ve worked for them for 35 years and been underpaid

all that time. I wasn’t stealing; I was only taking what

was owed to me.

– I didn’t take it for myself. I needed it to pay my child’s

medical bills.

(62)

WHO COMMITS FRAUD AND WHY

• Creators of worms and viruses often use

rationalizations like:

– The malicious code helped expose security flaws, so I

did a good service.

– It was an accident.

– It was not my fault—just an experiment that went bad.

– It was the user’s fault because they didn’t keep their

security up to date.

– If the code didn’t alter or delete any of their files, then

what’s the problem?

(63)

WHO COMMITS FRAUD AND WHY

• Fraud occurs when:

– People have perceived, non-shareable pressures; – The opportunity gateway is left open; and

– They can rationalize their actions to reduce the moral impact in their minds (i.e., they have low integrity).

• Fraud is much less likely to occur when

– There is low pressure, low opportunity, and high integrity.

• Unfortunately, there is usually a mixture of these forces

in play, and it can be very difficult to determine the

pressures that may apply to an individual and the

rationalizations he/she may be able to produce.

(64)

APPROACHES TO COMPUTER FRAUD

• The U.S. Department of Justice defines

computer fraud as any illegal act for

which knowledge of computer technology

is essential for its:

– Perpetration;

– Investigation; or

– Prosecution.

(65)

APPROACHES TO COMPUTER FRAUD

• Computer fraud includes the following:

– Unauthorized theft, use, access, modification,

copying, and destruction of software or data.

– Theft of money by altering computer records.

– Theft of computer time.

– Theft or destruction of computer hardware.

– Use or the conspiracy to use computer

resources to commit a felony.

– Intent to illegally obtain information or tangible

property through the use of computers.

(66)

APPROACHES TO COMPUTER FRAUD

• In using a computer, fraud perpetrators

can steal:

– More of something

– In less time

– With less effort

• They may also leave very little evidence,

which can make these crimes more

(67)

APPROACHES TO COMPUTER FRAUD

• Computer systems are particularly vulnerable to

computer crimes for several reasons:

– Company databases can be huge and access

privileges can be difficult to create and enforce.

Consequently, individuals can steal, destroy, or alter

massive amounts of data in very little time.

– Organizations often want employees, customers,

suppliers, and others to have access to their system

from inside the organization and without. This access

also creates vulnerability.

– Computer programs only need to be altered once,

and they will operate that way until:

• The system is no longer in use; or • Someone notices.

(68)

APPROACHES TO COMPUTER FRAUD

– Modern systems are accessed by PCs, which

are inherently more vulnerable to security

risks and difficult to control.

• It is hard to control physical access to each PC.

• PCs are portable, and if they are stolen, the data

and access capabilities go with them.

• PCs tend to be located in user departments, where

one person may perform multiple functions that

should be segregated.

• PC users tend to be more oblivious to security

concerns.

(69)

APPROACHES TO COMPUTER FRAUD

– Computer systems face a number of unique

challenges:

• Reliability (accuracy and completeness)

• Equipment failure

• Environmental dependency (power, water damage,

fire)

• Vulnerability to electromagnetic interference and

interruption

• Eavesdropping

• Misrouting

(70)

APPROACHES TO COMPUTER FRAUD

• These frauds cost billions of dollars each

year, and their frequency is increasing

because:

– Not everyone agrees on what constitutes

computer fraud.

• Many don’t believe that taking an unlicensed copy

of software is computer fraud. (It is and can result

in prosecution.)

• Some don’t think it’s a crime to browse through

someone else’s computer if their intentions aren’t

malicious.

(71)

APPROACHES TO COMPUTER FRAUD

– Many computer frauds go undetected.

– An estimated 80-90% of frauds that are

uncovered are not reported because of fear

of:

• Adverse publicity

• Copycats

• Loss of customer confidence.

– There are a growing number of competent

computer users, and they are aided by easier

access to remote computers through the

(72)

APPROACHES TO COMPUTER FRAUD

– Some folks believe “it can’t happen to us.”

– Many networks have a low level of security.

– Instructions on how to perpetrate computer

crimes and abuses are readily available on

the Internet.

– Law enforcement is unable to keep up with

the growing number of frauds.

– The total dollar value of losses is difficult to

calculate.

(73)

APPROACHES TO COMPUTER FRAUD

• Economic espionage

, the theft of

information and intellectual property, is

growing especially fast.

• This growth has led to the need for

(74)

APPROACHES TO COMPUTER FRAUD

• Computer Fraud Classification

– Frauds can be categorized according to the

data processing model:

• Input

• Processor

• Computer instructions

• Stored data

(75)

COMPUTER FRAUD CLASSIFICATIONS

Processor

Fraud

Input

Fraud

Output

Fraud

Data

Fraud

Computer

Instructions

(76)

APPROACHES TO COMPUTER FRAUD

• Processor Fraud

– Involves computer fraud committed through

unauthorized system use.

– Includes theft of computer time and services.

– Incidents could involve employees:

• Surfing the Internet;

• Using the company computer to conduct personal business; or

• Using the company computer to conduct a competing business.

(77)

APPROACHES TO COMPUTER FRAUD

• In one example, an agriculture college at a major state

university was experiencing very sluggish performance from

its server.

• Upon investigating, IT personnel discovered that an individual

outside the U.S. had effectively hijacked the college’s server

to both store some of his/her research data and process it.

• The college eliminated the individual’s data and blocked future

access to the system.

• The individual subsequently contacted college personnel to

protest the destruction of the data.

• Demonstrates both:

– How a processor fraud can be committed.

– How oblivious users can sometimes be to the unethical or illegal nature of their activities.

(78)

APPROACHES TO COMPUTER FRAUD

• Computer Instructions Fraud

– Involves tampering with the software that

processes company data.

– May include:

• Modifying the software

• Making illegal copies

• Using it in an unauthorized manner

– Also might include developing a software

program or module to carry out an

(79)

APPROACHES TO COMPUTER FRAUD

• Data Fraud

– Involves:

• Altering or damaging a company’s data files; or • Copying, using, or searching the data files without

authorization.

– In many cases, disgruntled employees have

scrambled, altered, or destroyed data files.

– Theft of data often occurs so that perpetrators can sell

the data.

• Most identity thefts occur when insiders in financial

institutions, credit agencies, etc., steal and sell financial

(80)

APPROACHES TO COMPUTER FRAUD

• Output Fraud

– Involves stealing or misusing system output.

– Output is usually displayed on a screen or printed on

paper.

– Unless properly safeguarded, screen output can

easily be read from a remote location using

inexpensive electronic gear.

– This output is also subject to prying eyes and

unauthorized copying.

– Fraud perpetrators can use computers and peripheral

devices to create counterfeit outputs, such as checks.

(81)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Data diddling

• Changing data before, during, or after it is entered into the system.

• Can involve adding, deleting, or altering key system data.

(82)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Data diddling

∙ Data leakage

(83)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Data diddling ∙ Data leakage

∙ Denial of service attacks

• An attacker overloads and shuts down an Internet Service Provider’s email system by sending email bombs at a rate of thousands per second—often from randomly generated email addresses.

• May also involve shutting down a web server by sending a load of requests for the web pages.

(84)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Denial of service attacks

∙ Eavesdropping

• Perpetrators surreptitiously observe

private communications or transmission of data.

• Equipment to commit these “electronic wiretaps” is readily available at

(85)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Denial of service attacks ∙ Eavesdropping

∙ Email threats

• A threatening message is sent to a victim to induce the victim to do something that would make it possible to be defrauded.

• Several banks in the Midwest were contacted by an overseas perpetrator who indicated that:

– He had broken into their computer system and obtained personal and banking information about all of the bank’s customers.

– He would notify the bank’s customers of this breach if he was not paid a specified sum of money.

(86)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Email threats

∙ Email forgery (aka, spoofing)

• Involves sending an email message that appears to have come from someone other than the actual sender.

• Email spoofers may:

– Claim to be system administrators and ask users to change their

passwords to specific values. – Pretend to be management and

request a copy of some sensitive information.

(87)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Email threats

∙ Email forgery (aka, spoofing)

∙ Hacking

• Unauthorized access to and use of computer systems—usually by means of a personal computer and a telecommunications

network.

• Most hackers break into systems using known flaws in operating systems, applications programs, or access controls.

• Some are not very malevolent and mainly motivated by curiosity and a desire to overcome a challenge.

(88)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Email threats

∙ Email forgery (aka, spoofing) ∙ Hacking

∙ Phreaking

• Hacking that attacks phone systems and uses phone lines to transmit viruses and to access, steal, and destroy data.

• They also steal telephone services and may break into voice mail systems.

• Some hackers gain access to systems through dial-up modem lines.

(89)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Email threats

∙ Phreaking

∙ Hijacking

• Involves gaining control of someone else’s computer to carry out illicit

activities without the user’s knowledge. • The illicit activity is often the

(90)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Email threats

∙ Phreaking ∙ Hijacking

∙ Identity theft

• Assuming someone’s identity, typically for economic gain, by illegally obtaining and using confidential information such as the person’s social security number, bank account number, or credit card number.

• Identity thieves benefit financially by:

– Taking funds out of the victim’s bank account.

– Taking out mortgages or other loans under the victim’s identity.

– Taking out credit cards and running up large balances. • If the thief is careful and ensures that bills and notices are

sent to an address he controls, the scheme may be prolonged until such time as the victim attempts to buy a home or car and finds out that his credit is destroyed.

(91)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Internet misinformation

• Using the Internet to spread false or misleading information about people or companies.

• May involve:

– Planting inflammatory messages in online chat rooms. – Websites with misinformation.

– Pretending to be someone else online and making inflammatory comments that will be attributed to that person.

– A “pump-and-dump” occurs when an individual spreads

(92)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Internet misinformation

∙ Internet terrorism

• Hackers use the Internet to disrupt electronic commerce and destroy company and individual communications.

(93)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Internet misinformation ∙ Internet terrorism

∙ Logic time bombs

• A program that lies idle until triggered by some circumstance or a particular time.

• Once triggered, it sabotages the system, destroying programs, data, or both.

• Usually written by disgruntled programmers.

• EXAMPLE: A programmer places a logic bomb in a payroll application that will destroy all the payroll records if the

(94)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Logic time bombs

∙ Masquerading or impersonation

• The perpetrator gains access to the system by pretending to be an authorized user.

• The perpetrator must know the legitimate user’s ID and password. • Once in the system, he enjoys the same privileges as the legitimate

(95)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Masquerading or impersonation

∙ Packet sniffers

• Programs that capture data from information packets as they travel over the Internet or company networks.

• Confidential information and access information can be gleaned from the captured data—some of which is later sold.

(96)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Masquerading or impersonation ∙ Packet sniffers

∙ Password cracking

• An intruder penetrates a system’s defenses, steals the file of valid passwords, decrypts them, and then uses them to gain access to almost any system resources.

(97)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Password cracking

∙ Phishing

• Sending out a spoofed email that appears to come from a

legitimate company, such as a financial institution. EBay, PayPal, and banks are commonly spoofed.

• The recipient is advised that information or a security check is needed on his account, and advised to click on a link to the company’s website to provide the information.

• The link connects the individual to a website that is an imitation of the spoofed company’s actual website. These counterfeit websites appear very authentic, as do the emails.

(98)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Phishing

• One newly graduated college student recently took a job in

California and deposited his first paycheck of approximately $5,000 in the bank.

• That same night, he received an email from the bank, inviting him to click on the link in the email to set up online banking for his new bank account.

• He followed directions and provided the requested information to set up online banking.

• Two hours later, he was nervous and called the bank—only to find out that his bank account had been cleaned out and closed.

(99)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Phishing

• As a rule of thumb, it is a good idea not to click on any link provided in an email and to go directly to the website instead. • PayPal, whose email address is commonly spoofed for phishing

scams, offers the following advice:

– If PayPal ever sends you an email, they will include your first and last name in the salutation of the email.

– If you need to enter PayPal’s website, type “https:” in the URL instead of “http:” in order to enter on the company’s secured server.

– If you receive a suspicious email, get out of your browser and go back in before proceeding directly to a company website.

(100)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Phishing

▪ In 2004, a phishing-related scam took place in South America with

respect to three large South American banks. Once an individual opened the related email, a script was downloaded on their

computer. The script would alter the individual’s web browser so that if the user entered the URL of one of these three banks, the

browser would redirect them to a counterfeit website for that bank. The oblivious user would provide ID and password information,

and was instantly set up for a high-tech robbery of his bank account.

(101)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Phishing

• Consumer Reports suggests that if you have any questions about

the legitimacy of a website, you should try entering the wrong password. A phishing website will typically accept an incorrect password—which cues you that it is a phishing scam.

(102)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

(103)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Password cracking ∙ Phishing

∙ Piggybacking

• Tapping into a telecommunications line and latching onto a legitimate user before that user logs into a system.

• The legitimate user unknowingly carries the perpetrator into the system.

(104)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Masquerading or impersonation ∙ Packet sniffers ∙ Password cracking ∙ Phishing ∙ Piggybacking ∙ Round-down technique

• Made famous in the movie,

Office Space.

• The programmer instructs the computer to round interest calculations down to two

decimal places and deposits the remaining fraction into the

account of a programmer or an accomplice.

(105)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Masquerading or impersonation ∙ Packet sniffers ∙ Password cracking ∙ Phishing ∙ Piggybacking ∙ Round-down technique ∙ Salami technique

• Involves the theft of tiny slices of money over a period of time.

• The round-down is just a special form of a salami

(106)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Social engineering

• Perpetrators trick employees into giving them information they need to get into the system.

• A perpetrator might call an employee and indicate he is the systems administrator and needs to get the

(107)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Social engineering

∙ Software piracy

• Copying software without the publisher’s permission.

• In the U.S., it’s estimated that 26% of software in use is pirated. • Fines for individuals and corporations are stiff, and individuals

(108)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Social engineering ∙ Software piracy

∙ Spamming

• Emailing an unsolicited message to multitudes of people, often in an attempt to sell a product.

(109)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Spamming

• Spammers use creative means to find valid email addresses: – Scanning the Internet for addresses posted online.

– Hacking into company databases and stealing mailing lists. – Staging dictionary (aka direct harvesting) attacks.

• These attacks use special software to guess addresses at a particular company and send blank emails.

(110)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Spamming

• Companies may use filtering software to detect dictionary attacks, search mail for competitive leaks, and block inappropriate attachments, such as pornography and illegal MP3 files.

• Filtering is not always viable. The director of internal audit at a major healthcare

company changes email addresses

frequently because of the volume of spam email in his inbox. When asked why his company did not filter the spam, he

replied, “Because we’re a healthcare company, we cannot filter out any

references to body parts or prescription medications.”

• There is increasing public clamor for laws to clamp down on spamming. In December 2004, a federal judge awarded over $1

billion to a small Midwestern Internet

(111)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Social engineering ∙ Software piracy ∙ Spamming

∙ Spyware

• Software that monitors computing habits, such as web-surfing habits, and sends the data it gathers to someone else, typically without the user’s permission.

– One type, called adware (for

advertising-supported software) does two things:

• Causes banner ads to pop up on your monitor as you surf the net.

• Collects information about your

Web-surfing and spending habits and forwards it to a company gathering the

(112)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Spyware

• Usually comes bundled with freeware and shareware

downloaded from the Internet. • May be disclosed in the

licensing agreement, but users are unlikely to read it.

• Reputable adware companies claim they don’t collect

sensitive or identifying data.

– But there is no way for users to control or limit the activity.

– It is not illegal, but many find it objectionable.

• Software has been developed to detect and eliminate spyware, but it may also impair the

downloaded software.

– Some is intentionally difficult to uninstall.

(113)

COMPUTER FRAUD AND ABUSE

TECHNIQUES

∙ Perpetrators have devised many methods to commit

computer fraud and abuse. These include:

∙ Spyware

∙ Keystroke loggers

• A keystroke logger records a user’s keystrokes and emails them to or saves them for the party that planted the logger. These are sometimes used by:

– Parents to monitor their children’s computer usage.

– Businesses to monitor employee activity.

– Fraudsters to capture passwords, credit card numbers, etc.

– A keystroke logger can be a hardware device attached to a computer or can be downloaded on an individual’s computer in the same way that any Trojan horse