# Presentation: 666864

## Online Fraud Trends – Staying Ahead of the Threats

- Matthew Biliouris, Information Systems Officer – NCUA

- Regions I & II - Nashville

## Credit Union Industry Statistics

## Credit Union Industry Statistics

**Notes:**
The year over year growth rate is about 15%.
Credit unions report almost 15.1 million members using on-line transactional services.  This represents a year over year growth rate of 25%. 

## Credit Union Industry Statistics

## Credit Union Industry Statistics

**Notes:**
This graph shows that the 39% of credit unions with an interactive/transactional type site represent 90% of FICU assets.
The 46% of credit unions without a site represent only 4% of FICU assets.
The 15% of credit unions with an informational site represent 6% of FICU assets.
Not surprisingly, this tells us that it is the smaller credit unions that are lagging in e-Commerce technology implementations.  This is a factor of there relative sophistication and resource levels.  However, we’ve previously seen credit unions with as little as $1 million in assets report a transactional site.  
The barriers to entry for small credit unions is eroding yearly.  Vendors continue to reduce pricing as competition grows.  Most vendors either offer their own solution or have partnered with a third-party to offer e-Commerce services to their members.  

Outlook

25% of those credit unions with out a site are planning to implement one.  Most of those sites will be informational. 
Credit unions with informational sites will continue to migrate to interactive/transactional sites for provide increased services for their members.
Likely to see increased adoption of statement/disclosure delivery and access to share draft images.  Also think that as vendors consolidate for bill payment and account aggregation, we may see increased penetration as well.  One of our larger credit unions is working with Master Card to implement a low cost electronic bill payment service.  If successful, it could make the service more attractive and affordable for credit unions.

## Risk Assessment Process

## Gramm-Leach-Bliley Act – 501(b)
Outlines Specific Objectives
Requires NCUA establish standards for safeguarding member records

**Security Programs**

- Gramm-Leach-Bliley Act – 501(b)
- Outlines Specific Objectives
- Requires NCUA establish standards for safeguarding member records

## Security Programs

- Credit Unions Must Have Process in Place to:
- Ensure Security & Confidentiality of Member Records
- Protect Against Anticipated Threats or Hazards
- Protect Against Unauthorized Access
- Specifically Stated in §748.0(b)(2)

## Slide 9

## Security Programs

- Appendix A – Guidelines for Safeguarding Member Information
- Involvement of Board of Directors
- Assess Risk
- Manage & Control Risk
- Oversee Service Providers
- Adjust the Program
- Report to the Board

## Security Programs

- Response Program Guidance
- Increasing Number of Security Events
- Congressional Inquiries
- GLBA Interpretation
- FFIEC Working Group
- Revise Part 748-Add New Appendix B

## Security Programs

- Credit Unions Must Have Process in Place to:
- Ensure Security & Confidentiality of Member Records
- Protect Against Anticipated Threats or Hazards
- Protect Against Unauthorized Access
**Respond to Incidents of Unauthorized Access to Member Information**

## Slide 13

## Security Programs

- Appendix B – Guidance on Response Programs
- Components of a Response Program
- Assessing Incident
- Notifying NCUA/SSA
- Notifying Law Enforcement Agencies
- Containing/Controlling Incident
- Notifying Affected Members

## Security Programs

- Appendix B – Guidance on Response Programs
- Content of Member Notice
- Account/Statement Review
- Fraud Alerts
- Credit Reports
- FTC Guidance

## PART 748 APPENDIX B

- Conflict with State Law – e.g., California Notice of Security Breach statute
- Requires notice to California residents when unencrypted member information is or may have been acquired by unauthorized person
- Gramm Leach Bliley Preemption Standards:  no intent to preempt where state law provides greater consumer protections

## NCUA Expectations

- Potential Questionnaire:
- Incorporated into Overall Security Program
- Escalation Process / Incident Response
- Review of Notices – Attorney Review?
- Enterprise Wide Approach
- Reporting to Senior Management
- Member Outreach / Awareness Programs
- Employee Training Programs

## “Phishing”

## “...The use of digital media also can lend fraudulent material an air of credibility. Someone with a home computer and knowledge of computer graphics can create an attractive, professional-looking Web site, rivaling that of a Fortune 500 company...”

*Arthur Levitt*
*Former Chairman of the SEC*

**Quotes**

## Phishing 101

- Phishing uses e-mail to lure recipients to bogus websites designed to fool them into divulging personal data.

## Phishing 101

- E-mail
- Spoofed address
- Convincing
- Sense of urgency
- Embedded link (but not always)

## Phishing Trends

_**Anti-Phishing Working Group**_**Industry association focused on eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. **_**APWG Members**_**- Over 400 members****- Over 250 companies****- 8 of the top 10 US banks****- 4 of the top 5 US ISPs****- Over 100 technology vendors****- Law enforcement from Australia, CA, UK, USA**_** **_

## Phishing Trends

- Source: APWG Phishing Attach Trends Report  - March 2005

## Phishing Trends

**Phishing Trends**

## Examples (June 2004)

**Examples (June 2004)**

## Examples (June 2004)

**Examples (June 2004)**

## Examples (June 2004)

**Examples (June 2004)**

## Examples (June 2004)

**Examples (June 2004)**

## Examples (March 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (March 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (May 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Training / Policy Development
Awareness
Handling complaints & reports of suspicious e-mails/sites 
Protect on-line identity of credit union
Response Plan

- Awareness
- Handling complaints & reports of suspicious e-mails/sites
- Protect on-line identity of credit union
- Response Plan

**Phishing Action Plans – Employee Education**

## Communication Methods
Internet Banking Agreements
Newsletters 
Statement Stuffers 
Recordings when on “hold”
Website (FAQs / Advisories / Links)

- Internet Banking Agreements
- Newsletters
- Statement Stuffers
- Recordings when on “hold”
- Website (FAQs / Advisories / Links)

**Phishing Action Plans – Member Education**

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## Content
We will never ask for xxx via e-mail
We will never alert you of xxx via e-mail
Always feel free to call us at # on statement
Always type in our site URL (see statement / newsletter / previous bookmark)

- We will never ask for xxx via e-mail
- We will never alert you of xxx via e-mail
- Always feel free to call us at # on statement
- Always type in our site URL (see statement / newsletter / previous bookmark)

**Phishing Action Plan Ideas – Member Education**

## Content (cont’d)
Sites can be convincingly copied
Report suspicious e-mails & sites 
Where to get more advice on phishing
Importance of patching
How to validate site (via cert or seal)
Where to go for ID theft help

- Sites can be convincingly copied
- Report suspicious e-mails & sites
- Where to get more advice on phishing
- Importance of patching
- How to validate site (via cert or seal)
- Where to go for ID theft help

**Phishing Action Plan Ideas – Member Education**

## Considerations:
Keep certificates up-to-date
Practice good domain name controls
Don’t let URLs lapse
Purchase similar URLs / Search for similar URLs

- Keep certificates up-to-date
- Practice good domain name controls
- Don’t let URLs lapse
- Purchase similar URLs / Search for similar URLs

**Phishing Action Plan Ideas – ****Protection of CU’s Online Identity**

## NCUA

(8/03) LTR 03-CU-12 Fraudulent Newspaper Advertisements, and Websites by Entities Claiming to be Credit Unions

(04/04) LTR 04-CU-05 Fraudulent E-Mail Schemes

(05/04) LTR 04-CU-06 E-Mail & Internet Related Fraudulent Schemes Guidance

FFIEC Agency Brochure

- (8/03) LTR 03-CU-12 Fraudulent Newspaper Advertisements, and Websites by Entities Claiming to be Credit Unions
- (04/04) LTR 04-CU-05 Fraudulent E-Mail Schemes
- (05/04) LTR 04-CU-06 E-Mail & Internet Related Fraudulent Schemes Guidance
- FFIEC Agency Brochure

**Phishing Resources**

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## Inside the Examiner’s Playbook

- Think Globally
- Vendor Management
- Security Program (Part 748)
- Employee Remote Access
- Risk Assessment

- Patch Management
- IDS/Incident Response
- Virus Definition Updates
- BCP
- Formal Policies

## Slide 44

## Slide 45

## Slide 46

## FFIEC IT Handbook

## FFIEC IT Examination Handbook

- Development & Acquisition
- Management
- Operations
- Outsourcing
- Retail Payment Systems
- Wholesale Payment Systems

- Issued:
- BCP
- Information Security
- Supervision of TSPs
- Audit
- E-Banking
- Fedline

## Slide 49

## Slide 50

## Slide 51

## Contact Information:

- Matthew Biliouris
- 703-518-6394
- _[matthewb@ncua.gov](mailto:matthewb@ncua.gov)_

**Questions??**