Pulling fraud outof the shadows
Global Economic Crime and Fraud Survey 2018www.pwc.com/fraudsurvey

2 PwC’s Global Economic Crime and Fraud Survey 2018

Executive Summary

In PwC’s 2018 Global Economic
Crime and Fraud Survey, only 49%
of global organisations said they’dbeen a victim of fraud and economic
crime. However, we know thisnumber should be much higher.
So, what about the other 51%?
The reality is, too few companies are fully awareof the fraud risks they face. That’s why this year’s
Global Economic Crime and Fraud Survey, gatheringvaluable data from more than 7,200 respondents
across 123 different territories, aims to pull fraud
out from the shadows – and shed much-needed lighton some of the most important strategic challenges
confronting every organisation.

Didier Lavion
Principal, Global
Economic Crime andFraud Survey Leader,
PwC US

The biggest competitor you didn’tknow you had
Today, fighting fraud has moved front and centre
to become a core business issue. Long gone are thedays when it was viewed as an isolated incidentof bad behaviour, a costly nuisance, or a merecompliance issue. That’s because the scale andimpact of fraud has grown so significantly in today’s
digitally enabled world. Indeed, it can almost be
seen as a big business in its own right – one thatis tech-enabled, innovative, opportunistic andpervasive. Think of it as the biggest competitor you
didn’t know you had.
It’s not hard to see how we got here. On the one
hand, technology has advanced in leaps and bounds,
helping fraudsters become more strategic in theirgoals and more sophisticated in their methods.
On the other hand, regulatory regimes in muchof the world have become far more robust, with
enforcement intensifying, often in cross-bordercooperation. Moreover, in the face of well-publicised
corruption and other corporate scandals, public
expectations around the world are converging
around common standards of transparency andaccountability.

More and more companies, organisations and nation
states are now recognising that corruption and fraud
are holding them back from competing on the global
stage – and have simply become too costly to ignore.

A perfect storm of risks
In this era of unparalleled public scrutiny, today’sorganisations face a perfect storm of fraudrelated risks – internal, external, regulatory andreputational. The time is therefore right for them toadopt a new, more holistic view of fraud. One thatrecognises the true shape of the threat: not merely
a cost of doing business, but a shadow industry
which can impact every territory, every sector andevery function. Since it hides in the shadows, a lackof fraud-awareness within an organisation is highly
dangerous.
So, the important question is not: is yourorganisation the victim of fraud? Rather it’s:
are you aware of how fraud is touching yourorganisation? Are you fighting it blindfolded,
or with eyes wide open?

The fraud you don’t see is as
important as the fraud you do
PwC’s 2018 Global Economic Crime and Fraud
Survey shows that, while there is growing awarenessof the perils of economic crime, too few companies
are fully aware of the individual risks they face. This
report sets out to plug that awareness gap. In it, we
explore not only the visible fraud that companies
say they are facing, but also the blind spots that stopthem seeing the big picture – and what they can andshould do about them.
So, what does our survey tell us about the steps
your organisation can take today to fight fraud more
effectively?

3 PwC’s Global Economic Crime and Fraud Survey 2018

Four steps to fight fraud

Recognise fraud when you see it
4

Take a dynamic approach
10

Harness the protective power of technology
16

Invest in people, not just machines23

4 PwC’s Global Economic Crime and Fraud Survey 2018

Recognise fraud when
you see it5 PwC’s Global Economic Crime and Fraud Survey 2018

Is fraud really on the rise – or just
our awareness of it?
This year, 49% of respondents to our Global
Economic Crime and Fraud Survey said theircompanies had been victims of fraud or economic
crime, up from 36% in 2016. This rise can be
explained by a combination of growing global

awareness of fraud, a larger number of survey
responses, and greater clarity about what ‘fraud’actually means. But every organisation – no matter
how vigilant – is vulnerable to blind spots. And
because those blind spots usually only become
apparent with hindsight, throwing light onto
them as early as possible can vastly enhance fraudfighting efforts.

Exhibit 1: The reported rate of economic crime is on the rise
49%
45%

43%

43%

37%

37%

36%

2014

2016

34%
30%

2001

2003

2005

2007

2009

2011

2018

Q. Has your organisation experienced any fraud and/or economic crime within the last 24 months?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Exhibit 2: The reported rate of economic crime has increased across all territories
57% 62%Africa30%

Asia Pacific33%

Eastern Europe
Latin America
Middle East
North America
Western Europe

46%
47%

28%
25%

53%
35%
37%
40% 45%n Reported economic crime in 2018 n Reported economic crime in 2016
Q. Has your organisation experienced any fraud and/or economic crime within the last 24 months?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

54%

Companies today
face a perfect stormof fraud risk –internal, external,
regulatory andreputational6 PwC’s Global Economic Crime and Fraud Survey 2018

Just as the reported rate of economic crime has
increased since 2016, so has the amount thatcompanies are spending to fight it:these technology-based controls, many are also
expanding whistle-blower programmes and taking
steps to keep leadership in the loop.

•	42% of respondents said their companies had
increased spending on combatting fraud andeconomic crime over the past two years (up from
39% in 2016).

But do these measures represent a genuine
shift to more proactive approaches to fraud andcorruption? Or are they just a rear-guard action,
driven principally by enhanced anti-bribery/anticorruption legislation and increasingly globalised
forms of enforcement? In other words, are we still
missing something vital in the fight against fraud?

•	44% of respondents said they plan to boost
spending over the next two years.
Where is this money being spent? Organisations
are using ever-more powerful technology and data
analytics tools to fight fraud. And, in addition to

Our survey results strongly suggest we are.

Exhibit 3: Organisations continue to increase spending on combatting fraud
Past 24 months

Next 24 months

16%

13%
Significant Increase

13%

13%

26%

31%
Some Increase

26%

31%

54%

51%
About the same level

57%

51%
4%

6%
Decrease

4%6%n 2018 n 2016

n 2018 n 2016

Q. How has/is your organisation adjusting the amount of funds used to combat fraud and/or economic crime?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

7 PwC’s Global Economic Crime and Fraud Survey 201859%of CEOs agree orstrongly agree thatorganisations are
currently experiencing
increased pressure
to hold individual
leaders accountable
for any organisational
misconduct
Source: PwC’s 21st
CEO Survey

71%

of CEOs measure trust
between their workforce
and their organisation’s
senior leadership

Fraud risk assessments are the firststep in preventing fraud before it
takes root
Despite the increase in spending, manyorganisations are still addressing fraud prevention
by using a reactive, defensive approach:•	Only 54% of global organisations said they
have conducted a general fraud or economic
crime risk assessment in the past 2 years.
•	Less than half said they had conducted acybercrime risk assessment.
•	Fewer than a third said their company performed
risk assessments in the critical areas of antibribery and corruption, anti-money laundering,or sanctions and export controls.
•	
One in ten respondents had not performed
any risk assessments at all in the past 2 years.

However, the rules of the game are changing
profoundly and irreversibly. Public tolerance
for corporate and/or personal misbehaviour isvanishing. Not only is sensitivity to corporate
misconduct at an all-time high, some corporations
and leaders are also now being held to account forpast behaviour, conducted when the ‘unspoken
rules’ of doing business might have been thought
to be different. PwC’s 21st CEO Survey underscores
this theme: in it, chief executives cite trust andleadership accountability as two of the mostsignificant threats to business growth.
This points to a heightened risk when fraud or
economic crime spills into public view – and agreater need for organisations to take a lead inpreventing fraud before it can take root. Fraud
risk assessments can help organisations do so byidentifying the specific frauds they need to look for.
Moreover, these assessments are increasingly lookedon favourably by regulators in enforcement actions.

Source: PwC’s 21st
CEO Survey

Exhibit 4: Less than half of all organisations have performed targeted risk assessments in the last 2 years

Generalfraud risk assessment

54%

Cyber-attack
vulnerability
Anti-Bribery andCorruption (ABAC)

Annual or routine process51%

As part of an audit plan47%

As part of Enterprise
Risk Management strategy

6%

Driven by specific events

2%

Don’t know

33%

Cyber response plan

30%

Industry specificregulatory obligations

27%

Anti-Money
Laundering (AML)23%

Sanctions andexport controls

19%

Anti-competitive / Anti-trust
Other

60%

46%

16%
2%

Don’t know

11%

No risk assessments performedin the last 24 months

10%

Q. In the last 24 months, has your organisation performed a risk assessment on any of thefollowing areas?

Q. What prompted your organisation to perform a risk
assessment?

Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Source: PwC’s 2018 Global Economic Crime and Fraud Survey

8 PwC’s Global Economic Crime and Fraud Survey 2018

Exhibit 5: Asset misappropriation, consumer fraud and cybercrime were the most frequently reported
frauds across industries
Consumer

Professional Services

Assetmisappropriation

Assetmisappropriation

48%

40%

Business misconduct

31%

Accounting fraud

32%

Cybercrime30%

Business misconduct

30%

Bribery andCorruption

28%

Procurement fraud

28%

Consumer fraud

26%

Bribery andCorruption

26%

Financial Services

Technology
56%

Consumer fraud

Assetmisappropriation

Assetmisappropriation

41%

Cybercrime

Cybercrime

41%

Business misconduct

31%

Business misconduct
Money laundering

Consumer fraud

20%

Procurement fraud

43%
39%
31%
26%
23%

Industrial Products
Assetmisappropriation

48%

Bribery andCorruption

29%

Procurement fraud

29%

Business misconduct

26%

Cybercrime26%n Indicated as most disruptive fraud
Q. What type of fraud and/or economic crime has your organisation experienced in your country within the last 24 months?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Conduct risk: the ‘hidden risk’behind many internal frauds
Two types of fraud – consumer fraud and businessmisconduct – have grown in prominence to suchan extent that this year’s survey is measuring
them as separate threats for the first time. Of the
respondents who indicated their companies had
experienced fraud in the last two years, 29% said
they had suffered from consumer fraud and 28%
said they had suffered from business misconduct(making these, respectively, the 3rd and 4th mostfrequently reported frauds this year, behind asset
misappropriation at 45% and cybercrime at 31%).
It should be noted that the significant decrease inreported incidents of asset misappropriation (downfrom 64% in 2016) is at least partly explained by the
inclusion of these new frauds in the survey.

These methodological changes reflect the growing
recognition of a broad category of internal fraud
risk: “conduct risk”. This is the risk that employee
actions will imperil the delivery of fair customer
outcomes or market integrity. And, unlike
operational breakdowns or external threats (which
can often be checked by internal controls), conduct
risk requires a more holistic response – and a shift in
attitude.
At present, many companies treat compliance,
ethics and enterprise risk management as
separate functions – sometimes they even exist in
separate siloes within an organisation. But, likeall organisational silos, this means these functions
rarely add up to a strategic whole. The parts of anorganisation that investigate fraud, the parts thatmanage the risk of fraud, and the parts that reportfraud to the board or regulators become disjointed.

9 PwC’s Global Economic Crime and Fraud Survey 2018

When that happens, operational gaps can emerge
and fraud can too easily be brushed under the
carpet or seen as someone else’s problem – to thedetriment of the overall effectiveness of fraud
prevention, financial performance and regulatory
outcomes.
A more innovative approach is to reframethese functions as components of conduct risk.
It enables a company to better measure andmanage compliance, ethics and risk management
horizontally and embed them in its strategic
decision-making process. It also means fraud
and ethical breaches can be approached moredispassionately, with less emotion, as a fact oflife that every organisation has to deal with.
Moreover, adopting this more systemic – andrealistic – stance towards conduct risk canenable cost efficiencies between ethics, fraud
and anti-corruption compliance programmes.
It is an important step in breaking down the silos
between key anti-fraud functions – and pulling
fraud out of the shadows.

24%of reported internal
frauds were committed
by senior management

Looking for fraud in theright places
Our survey revealed a significant increase in theshare of economic crime committed by internal
actors (from 46% in 2016 to 52% in 2018)
and a dramatic increase in the proportion of
those crimes attributed to senior management(from 16% in 2016 to 24% in 2018). Indeed,internal actors were a third more likely than
external actors to be the perpetrators of the mostdisruptive frauds.
However, one of a company’s biggest fraud blind
spots – and biggest threats – is often not to dowith its employees, but rather the people it does
business with. These are the third parties withwhom companies have regular and profitable
relationships: agents, vendors, shared service
providers and customers. In other words, thepeople and organisations with whom a certain
degree of mutual trust is expected, but who may
actually be stealing from the company.

Exhibit 6: Internal actors are the main perpetrators of fraud
52%
46%
40%

41%

68%

*

Internal actor

External actor*

n 2018 n 2016
Q. Who was the main perpetrator of the most disruptive fraud?
Source: PwC’s 2018 Global Economic Crime and Fraud Surveyof external actors
committing the fraud
are ‘frenemies’ of theorganisation – agents,
vendors, shared service
providers and customers

10 PwC’s Global Economic Crime and Fraud Survey 2018

Take a dynamic
approach11 PwC’s Global Economic Crime and Fraud Survey 2018

Chief executives are accountable
Our survey underscores that the direct monetary
cost of fraud and its aftermath can be substantial.
But when secondary costs (such as investigations
and other interventions) are included, the true
picture of overall cost can be much higher.

46%

of respondents said
their organisation spent
the same or more on
investigations and otherinterventions than was
directly lost to fraud
itselfExhibit 7: Direct monetary losses due to fraud can be substantial

When the financial costs of fraud hit the bottom lineof a business, it is only natural for the board andshareholders to require explanations from senior
management. In today’s world, however, a leader’s
responsibility doesn’t stop there. In fact, that’s justthe beginning.

Exhibit 8: The amount spent on investigations
and other interventions as a result of fraud issignificant

45%

43%

30%

29%

17%
11%

11%
6%

Less than$100,000
USD$100,000
USD to lessthan $5
million USD$5 million
USD to $50
million USD

5%3%$50 million
USD or more

Don’t know

Solely nonmonetaryloss

Q. In financial terms, approximately, how much do you think your organisation may havedirectly lost through the most disruptive crime over the last 24 months?
Source: PwC’s 2018 Global Economic Crime and Fraud SurveyLess

The same

More

Don’t know

Q. As a result of the most disruptive crime experienced in thelast 24 months, was the amount spent by your organisation
on investigations and/or other interventions, more, less or
the same as that which was lost through this crime?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

12 PwC’s Global Economic Crime and Fraud Survey 2018

A chief executive is increasingly seen as the
personal embodiment of an organisation – with
their finger on the pulse of every facet of its culture
and operations at all times. So, when ethical orcompliance breakdowns happen, these individuals
are often held personally responsible – both by the
public and, increasingly, by regulators. Whether
merited or not, one thing is clear: the C-suite can nolonger claim ignorance as an excuse.

Our survey shows that in nine in every ten cases, themost serious incidents of fraud have been brought
to the attention of senior management. In addition,
17% of respondents indicated that the CEO has
primary responsibility for their organisation’s ethics
and compliance programme. This puts a sharp
spotlight on how the front office is managing thecrisis – and the extent to which they are (or are not)adjusting their risk profiles accordingly.

Exhibit 9: Organisations are reporting serious
frauds to senior management

Exhibit 10: Primary accountability for ethics andcompliance programmes resides with the C-suite

5%

Chief Compliance
Officer

4%

30%
38%

Chief Executive
Officer*17%

Human Resources
Director
91%

11%
18%
10%
13%

General Counsel

7%

Chief Risk Officer*n Yes n No n Don’t know
Q. Was the most disruptive incident you indicated brought
to the attention of your board level executives or to seniorleaders charged with governance?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Chief Financial
Officer6%8%

Chief Audit
Executive

5%
7%

Chief Operating
Officer*

3%
7%

Other
Don’t know

16%
4%

n 2018 n 2016
* New option in 2018.
Q. Who has primary responsibility for the business ethics
and compliance programme in your organisation?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

13 PwC’s Global Economic Crime and Fraud Survey 2018

Whereas traditionally fraud prevention anddetection would have been the domain of theorganisation’s second line of defence – risk
management, legal, compliance, etc. – today’senterprises are increasingly embedding their newly
reinforced fraud prevention measures into the fabricof their first line of defence.
This is likely to be just the beginning of a significant
shift, where first-line fraud prevention and detection
capabilities continue to mature and strengthen.
As they do so, they will enable the second line ofdefence to shift to a more traditional second-line
approach: governance and oversight and setting risk
tolerance, frameworks and policies.
In a world where the boundaries between industries,
technologies and regulatory bodies continue to blur
– and where fraudsters are looking for soft spots to
attack beyond their traditional, highly protectedfinancial services targets – this is an importantdevelopment.

Bad news travels fast: reputationalrisk now outstrips regulatory risk
A pronounced shift in the way the world looks at
fraud and corruption has taken place over the past
few years. And our survey data reflects this now
deep-seated demand for accountability, from boththe public and from regulators, across the private
and public sectors.
This is not a phenomenon limited to developed
markets, either. Across vastly different cultures,in every region of the world, there are signs ofconvergence around standards of transparency andexpectations of conduct. Nation states in which
the rule of law and levels of transparency havetraditionally been weak have seen public outrage inthe streets, politicians and business leaders jailed,
and in some cases even governments toppled.
For an organisation on the receiving end, perhaps
with only fragmented information about what has
happened, this represents a serious reputationalrisk. It can find itself punished from all quarters for
its perceived inability to respond appropriately –well before the board has a plan for what to do.

Exhibit 11: Fraud detection moves up to the first line of defence

1
Executive
management
The CEO and executives
are responsible formanagement of risk andare held accountable by
the Board.

2

3

Risk functions

Internal audit

The CRO and the riskfunction are not responsible
for managing risk; that is
management’s job.

The Internal Auditor is
responsible for independent
assurance and isaccountable to the Audit
and Risk Committee.

Your reputation
is subject to no
jurisdiction, law or
due process

14 PwC’s Global Economic Crime and Fraud Survey 2018

Regulatory compliance remains as critical as ever– if not more so. Across the board, regulations andreporting requirements, touching both legal andethical behaviour, continue to expand. Scrutiny
and enforcement are also on the rise globally, andcross-border regulatory cooperation is becoming
increasingly routine.

That’s because, in this era of radical transparency,
companies often don’t get to decide when an issue
becomes a crisis. Rather, that’s down to the juryof public opinion. Moreover, society’s rules canchange much faster than regulators’ – and there islittle public tolerance for those who break them.
Regulators, by definition, operate within a limited
jurisdiction and in accordance with well-definedrules. A company’s brand reputation, on the other
hand, is subject to no fixed jurisdiction, law or due
process.
The executives we surveyed consistently ranked
reputational harm at or near the top of negative
impacts from various forms of economic crime,with public perception (reputation/brand strength,
business relations and share price) taking thehardest hit – a level of impact that has increased
since 2016.

In our survey, 54% of respondents involved inmoney movement (and/or any of the following
lines of business: financial institutions, mutual
funds, money service businesses, broker dealers,insurance companies, or dealers in precious metals,
stones or jewels) indicated they had experienced
an Anti-Money Laundering (AML) regulatory
enforcement or inspection in the last two years(up by 4 percentage points from 2016). And an
identical proportion (54%) expect recent changes
in the geopolitical regulatory environment to have agreater impact on their organisations over the next
two years.

Exhibit 12: Fraud and economic crime impact all elements of the business

16%

30%
36%

38%
48%
EmployeemoraleBusinessrelations

Reputation/ brandstrength

Relations withregulators

Share
price

n High to medium
Q. What was the level of impact of the most disruptive fraud/economic crime experienced on the following aspects of your business operations?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Exhibit 13: The number of regulatory enforcements and inspections continues to rise
Yes, we were/are currently under anenforced remediation programmeYes, we had a regulatory inspection andreceived major feedback to address

17%
5%
15%
13%
23%

Yes, we had a regulatory inspection with nomajor feedback/consequences

32%
31%
32%

No, we have not had a regulatory
inspection in the last 24 months
Don’t know

14%
18%

n 2018 n 2016
*Organisations involved in money movement and/or any of these lines of business are: Financial
Institution, Mutual Funds, Money Service Business, Broker Dealer, Insurance Company, Dealersin Precious Metals, Stones or Jewels.
Q. Has your organisation experienced any regulatory enforcement/inspection in relation to
AML in the last 24 months?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

54%

said they expect changes
in the regulatoryenvironment to havean increased impact on
their organisation in thenext 2 years

15 PwC’s Global Economic Crime and Fraud Survey 2018

Is there a correlation between economic development and fraud?*
Our survey reveals some interesting nuances about global approaches to fraud, which could offer
valuable pointers for nation states as they continue on the path of economic development.
In developing territories, 58% of companies involved in money movement (and/or any of the following
lines of business: financial institutions, mutual funds, money service businesses, broker dealers,insurance companies, or dealers in precious metals, stones or jewels) told us they had experienced
anti-money laundering (AML) regulatory enforcement or inspection in the last two years. The equivalent
figure in developed territories was just 48%.
In developing territories, 15% of companies told us they expect to significantly increase funding foranti-fraud investments in the next 24 months. The equivalent figure in developed territories was just 9%.
In developing territories, respondents told us that economic crime is more often committed by internal
actors (59%). The equivalent figure in developed territories was just 39%.
* Our grouping of developed and developing territories was based on the United Nations Conference on Trade and Developmentclassifications. For the purposes of this survey, transitioning territories were treated as developing territories.

Exhibit 14: Developing territories continue to be challenged by corruption risk

Reported
incidents ofbribery andcorruption

83%

of CEOs reportexperiencing no
negative impact onrevenue growth after awell-managed crisis

Anti-bribery
and corruption
risk assessments
performed inpast 12months

Source: PwC’s CEO Pulse
on Crisis
13% 32%

31% 34%n Developed territories n Developing territories
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Organisations in developing territories are almost
three times as likely to experience corruption as
those in developed territories. However, only one
third perform risk assessments on anti-bribery
and corruption measures, nearly equal to those
performed by those in developed territories.

“Instead oftone at the top,organisations should
be focused on action
at the top”
Tania Fabiani, Partner,
PwC US

Learn to leverage the small shocks…
and emerge stronger
In any organisation, the occasional breakdown ormishap is unavoidable. And our data suggests that
there is plenty of upside to learning how to leverage
the small shocks. In fact, they can be a blessing in
disguise – an opportunity to test systems and make
improvements.
The maturation of a process – for companies as wellas countries – happens in part by weathering storms.
When a crisis or unplanned event is well managed,
83% of CEOs report experiencing no negative

impact on revenue growth. Beyond revenue, how
the C-Suite deals with what can become a crisis has
a high likelihood of becoming the measure by which
it will be judged.
It is natural for a relatively inexperienced
company to have a knee-jerk response to a crisis
that blindsides it. However, the more a company
learns to react to micro-disruptions effectively, thebetter prepared it is for responding to mega-crises.
It acquires a form of ‘muscle memory’ enabling it tobe more proactive in its approach, leveraging mature
ethics and compliance programmes and a battletested front office.

16 PwC’s Global Economic Crime and Fraud Survey 2018

Harness the protective
power of technology

17 PwC’s Global Economic Crime and Fraud Survey 2018

Finding the technology sweet spot
When it comes to fraud, technology is a doubleedged sword. It is both a potential threat and apotential protector. Thus, as companies come toview fraud as first and foremost a business problem
which could seriously hamper growth, many
have made a strategic shift in their approach totechnology. These companies are making a businesscase for robust new investments in areas such asdetection, authentication and the reduction ofcustomer friction.

29%of companies said theyspent at least twice asmuch on investigating
and preventing fraud
as was lost throughthe most disruptive
economic crimes

42%of companies said they
have increased funds
used to combat fraud
and/or economic crime

Today, organisations have access to a wealth ofinnovative and sophisticated technologies withwhich to defend themselves against fraud, aimed
at monitoring, analysing, learning and predicting
human behaviour. These include machine learning,
predictive analytics and other artificial intelligence
techniques. And our survey shows companies
are using these technologies, to varying degrees,
depending on the industry sector. Technology
is expensive to buy and to adopt across a largeorganisation – prohibitively so, for some. And thedecision about what to purchase, and when, is adelicate one. Some invest in emerging or disruptive
technologies that they don’t use optimally, forinstance. Others adopt technology too late and findthemselves behind the curve.

18 PwC’s Global Economic Crime and Fraud Survey 2018

Exhibit 15: The Financial Services and Technology industries are finding the most value in Artificial Intelligence (AI) and
Advanced Analytics
7

4

10

9

7
Machinelearning

19

19

11
14

5

7

NaturalLanguage
Processing
(NLP)

4

6

NaturalLanguage
Generation
(NLG)
10

11

5

Voice
Recognition

10

10

8
Predictive
Analytics

12

18

18

11

8

8

8

7

5

7

13

n Industrial products n Financial services n Consumer n Technology n Professional services n Other
Q. To what degree is your organisation using and finding value from Artificial Intelligence or Advanced Analytics to combat/monitor for fraud and othereconomic crimes? (% of respondents who said their organisation uses and derives value)
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Exhibit 16: Organisations are beginning to derive value from alternative and disruptive technologies in combatting fraud
40%

40%

38%
33%

31%

31%

30%

28%

28%

25%

22%

21%
17%

Q. To what degree is your organisation using and finding value from the following alternative/disruptive technologies and techniques in your control
environment to help combat fraud and/or economic crime? (% of respondents who said their organisation uses and derives value)
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Artificial Intelligence (AI)

Employing data scientists

Leveraging big data

Pattern recognition

Contract or other unstructured
data review

Government Risk andCompliance (GRC) solutions

Data visualisation/
dashboards

Anomaly detection

Communications monitoring

Proactive detection

Transaction testing

Periodic analysis

E-mail monitoring

Continuous monitoring11%

19 PwC’s Global Economic Crime and Fraud Survey 2018

The use of innovative technologies to combat
fraud is now a worldwide phenomenon. Indeed,
our survey shows that companies in developing
territories are actually investing in advanced
technologies at a faster rate than those in developed
territories. We found 27% of companies indeveloping territories said they currently use or plan
to implement artificial intelligence to combat fraud,
while just 22% of companies in developed territories
said the same. For those developing territories, thisapproach could represent an effective means ofcatching up in an area in which other nations havealready sunk considerable infrastructure costs.
In the end, the ubiquity of technology creates adouble challenge for all organisations: how to findthe sweet spot between a technology’s effectivenessand its cost while remaining ahead of the fraudsters.

What is customer friction?
As a customer, it can be reassuring – at first – toknow a company is continuously monitoring fraud inthe services it provides. But if that monitoring leads
to frequent or repetitive alerts, that reassurance canquickly turn to irritation.
This is known as customer friction. And it is a
growing challenge for organisations as they seek tostrike the right balance between acting appropriately
to fraud red flags and being overzealous in alerting
their customers.
That is not an easy balance to strike – and themargin for error is small. Be too passive and theorganisation risks missing a fraudulent transaction,with all the financial and reputational falloutthat follows. But be too proactive, and they risk
alienating, or even losing, their customer base.

When it comes to new technology adoption,
the developing world is now accelerating
ahead of the developed world.’
Philip Upton, Partner, PwC US

34%of respondents said they thought their organisation’s
use of technology to combat fraud and/or economic
crime was producing too many false positives

Customers aren’t just one consideration of yourbusiness – they are your business
Customers are the lifeblood of any business. But, as business models
continue to evolve through the digital revolution, many of those customers
are being exposed to payment fraud for the first time. How an organisation
handles that fraud will profoundly affect its outcomes. Here are some of thecharacteristics and challenges of today’s digital fraud:
New digital products are creating new attack surfaces
To bring products to market, companies once followed an established B2B
process involving resellers, distributors and retailers. On today’s innovative
B2C digital platforms, there is a much wider attack surface – and much moreroom for fraud to break through.
Industry lines are blurring
Non-financial services companies are venturing into payment systems.
These relative newcomers sometimes lack the anti-fraud and anti-money
laundering experience and know-how of traditional financial services
companies, making them, and their third-party ecosystems, susceptible toboth fraud and regulatory risk.
The technical sophistication of external fraudsters continues
to grow
Digital fraud attacks are becoming more and more sophisticated, thoroughand devastating. Single ransomware attacks can cripple organisations
and fraudsters manage to move billions of dollars between bank accounts
every day.
You can change your credit card number, but you can’t change
your date of birth
The knowledge-based authentication tools long used to control fraud are
outdated and new techniques – such as digital device ID and voice biometrics– are now necessary to protect customers’ assets. But most companies are yet
to adopt them. This is important because a major data theft is nothing likethe loss of a replaceable asset like cash. Rather, what is lost is an individual’s
unique, deeply personal, permanent identity markers (such as date of birthor social security number). Because this is the very data that knowledgebased authentication tools use to verify identity and prevent fraud, its theft
opens the door for fraudsters to take over a person’s identity.

20 PwC’s Global Economic Crime and Fraud Survey 2018

Cybercrime: a disconnect between
ends and means
Cybercrime has long passed beyond infancy
and adolescence. Today’s cybercriminals are as
savvy and professional as the businesses they
attack. This maturity calls for a new perspectiveon the multifaceted nature of cyber threats andaccompanying frauds.
Often, the first sign an organisation gets thatsomething systemic is amiss is the detection of acyber-enabled attack, such as phishing, malware
or a traditional brute force attack. The increasing
frequency, sophistication and lethality of these
attacks are spurring companies to look for ways topre-empt them. This approach has the added benefit
of enabling a deeper focus on fraud prevention.

41%

of executives surveyed
said they spent atleast twice as muchon investigations andrelated interventions as
was lost to cybercrime

Although it can be difficult for companies toaccurately measure the financial impact of cyberattacks, 14% of survey respondents who said
cybercrime was the most disruptive fraud told us
they lost over $US1 million as a result, with 1%
indicating they lost over $US100 million.
Cybercrime was more than twice as likely than any
other fraud to be identified as the most disruptive
and serious economic crime expected to impact
organisations in the next two years (26% ofrespondents said they expected a cyber-attack in
the next two years and that it would be the mostdisruptive; 12% said they expected bribery andcorruption to be most disruptive; while 11% said thesame about asset misappropriation). In fact, cyberattacks have become so pervasive that measuring
their occurrences and impacts is becoming lessstrategically useful than focusing on the mechanismthat the fraudsters used in each case.

Exhibit 17: Types of fraud that organisations were a victim of through a cyber-attack

Intellectual property (IP) theft

12%

11%

Procurement fraud

Extortion

21%

10%

Asset misappropriation

24%

5%

Disruption of business processes

30%

8%

Insider trading

Politically motivatedor state sponsoredattacks

Other

Q. Which of the following types of fraud and/or economic crime was your organisation victim of through a cyber-attack?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

21 PwC’s Global Economic Crime and Fraud Survey 2018

While all digital fraud is fraud, not all fraud isdigital. It can therefore be helpful to distinguish twoforms of cybercrime:(1) As digital theft (the stolen goods, not thesmashed door). This type of attack could
include stealing cash, personal information,and intellectual property, and could involve
extortion, ransomware, or a host of othercrimes.

(2) As digital fraud. This type of attack is in many
ways the more long-lasting and disruptive,
because the fraudster penetrates an open
door (typically, but not always, a customer- or
employee-facing access point) and uses thecompany’s own business processes to attack it.
To combat this type of fraud, the organisationmust use digital methods – both as a vaccine
and as a remedy.

Exhibit 18: Cyber-attack techniques used against organisations

36% Malware
33% Phishing
13% Network scanning
10% Yes, but unsure oftechnique

7% Man in the middle

8% Brute force attack

3% Other technique

Q. In the last 24 months, has your organisation been targeted by cyber-attacks using any of
the following techniques?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Over a third of all
respondents have beentargeted by cyberattacks, through both
malware and phishing.
Most of these attacks,
which can severely
disrupt businessprocesses, also leadto substantive losses
to companies: 24% of
respondents who wereattacked suffered asset
misappropriation and
21% were digitally
extorted.

22 PwC’s Global Economic Crime and Fraud Survey 2018

Beyond compensating customers…
where’d the money go?
While keeping customers happy is the first orderof business, there are deeper dimensions to fraud
prevention. These involve the fraud underworld,
and the regulation and enforcement regimes
whose mission is to control it.
In the case of identity theft, for instance, a bankor merchant will cover the loss to the customer
and absolve them of further responsibility if, say, afraudster opens a credit card in her name and runs
up a significant balance. Until now, the system ofremedying such external frauds has worked in thisway, and all parties – banks, merchants, consumers
and regulators – have accepted it as part of the costof doing business together.
While these fraudulent activities can be detectedby the transaction monitoring systems built in
response to the United States’ Bank Secrecy
Act (BSA) and similar rules in other countries,
it is likely that both banks and money services
businesses (MSBs) are missing the manner inwhich these transactions manifest themselvesin the system. This has been shown in recent
regulatory enforcement around lack of detection
by businesses in the context of human trafficking,for example.

Non-financial companies may not have thesame regulatory obligations as their financial
counterparts, but they could still find themselves
falling foul of the law. Regulators and law
enforcement are now looking beyond the primary
impact of a crime – for example, trafficking incounterfeit goods – to examine which illicit
activities the stolen assets went to finance. As partof their remit, they are scrutinising non-financial
services companies’ compliance and anti-fraudmeasures for signs that they may be, consciously ornot, aiding and abetting criminal activities.

The business case
The business case for investment in antifraud technology goes beyond protecting theorganisation from reputational, regulatory and/or financial damage. It also includes reducing thecost of fraud prevention through efficiencies andenabling an organisation to safely build and sell
new products and services on a digital platform.
Furthermore, it enables a business to fine-tune afraud programme to reduce customer friction –allowing customers to interact more freely with its
platform and its product.

23 PwC’s Global Economic Crime and Fraud Survey 2018

Invest in people, not justmachines

24 PwC’s Global Economic Crime and Fraud Survey 2018

A small investment in people can pay
huge dividends

Exhibit 19: The fraud triangle: what makes an employee commit fraud?

Confronted with the seeming intractability ofdealing with fraud, many organisations decide topour ever more resources into technology. Yet theseinvestments invariably reach a point of diminishingreturns, particularly in combatting internal fraud.
So, while technology is clearly a vital tool in the fightagainst fraud, it can only ever be part of the solution.
This is because fraud is the result of a complex
mix of conditions and human motivations. The
most critical factor in a decision to commit fraud
is ultimately human behaviour – and this offers
the best opportunity for combatting it. There is a
powerful method for understanding and preventing
the three principal drivers of internal fraud – thefraud triangle.
The fraud triangle starts with an incentive (generally
a pressure to perform from within the organisation)
followed by an opportunity, and finally a processof internal rationalisation. Since all three of thesedrivers must be present for an act of fraud to occur,
each of them should be addressed individually.

21%

Incentive/
pressure to perform

59%

Fraud Risk

Opportunity

11%

Rationalisation

Q. To what extent did each of the following factors contribute to the incident of fraud and/or
economic crime committed by internal actors? (% of respondents who ranked the factor as
the leading contributing factor to internal fraud)
Source: Global Economic Crime and Fraud Survey 2018.

25 PwC’s Global Economic Crime and Fraud Survey 2018

Exhibit 20: The level of organisational effort required to combat internal fraud
Promotion and verification of individual
employee ethical decision-making
34%
38%

38%

Incentive/
pressure to perform

Fraud Risk

Opportunity
Business processes

Rationalisation
Organisational and external influences

50%

34%

33%

37%

n High n Medium
Q. What level of effort does your organisation apply to the following categories in order to combat fraud and/or economic
crime internally?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Preventing the opportunity: controls
Most organisations’ anti-fraud efforts in recent years
have been focused on reducing the opportunities
for fraudulent acts: 50% of survey respondents said
they expend a high degree of effort in building up
business processes, such as internal controls, thattarget opportunities to commit fraud. And, while
59% of respondents ranked opportunity as theleading contributor to the most disruptive frauds
committed by internal actors, this was 10 percentage
points lower than the equivalent figure in 2016(69%). This is evidence that technology has a keyrole to play – and, more to the point, that companies
are generally employing it effectively.

Unfortunately, companies are putting significantly
less effort into measures to counteract incentives
and rationalisation, with only 34% indicating
they spent a high level of effort targeting thesefactors. Our survey highlights the result of thesechoices: 21% of respondents ranked incentives/pressure as the leading contributing factor of themost disruptive fraud committed by internal actors,
twice the amount reported in 2016 (11% identified
rationalisation as the leading motivating factor – thesame proportion as in 2016).
This under-emphasis on cultural/ethical measurespoints to a potential blind spot, and indeed may
be one reason why internal fraud is so resilient.
Because fraud is the result of the intersection ofhuman choices with system failures, it is important
to be wary of the false sense of security that internal
controls, even well-designed ones, can bring.

26 PwC’s Global Economic Crime and Fraud Survey 2018

Indeed, there is a fundamental flaw with the belief
that internal technology-driven controls alone cancatch fraud: it assumes that management will always
behave ethically. In fact, experience shows that
virtually every significant internal fraud is a resultof management circumventing or overriding thosecontrols. Our survey backs this up: it reveals that theshare of reported serious internal fraud committed
by senior management has risen dramatically –by 50% – over the past two years (from 16% ofrespondents in 2016 to 24% in 2018). To overcome
this structural problem, organisations need to create
controls that actually account for management
override or collusion in targeted areas.

Exhibit 21: Just over half of the most disruptive frauds were detected bycorporate controls

Corporate
controls

Corporate
culture52%

Beyond theinfluence ofmanagement27%

14% (-3%)

(+5%)

(+4%)

Preventing the incentive: openness
Corporate-sized frauds are generally connected tocorporate pressures – and the pressure to commit
fraud can arise at any level of the organisation.
Our survey shows that 28% of organisations thatexperienced fraud in the last two years sufferedbusiness conduct/misconduct fraud (incentive
abuse), and 16% of global organisations with
offices in other territories experienced businessconduct/misconduct fraud in those other territories.
Meanwhile, 24% of respondents indicated that
senior management was responsible for the mostdisruptive crime experienced.
It is important not to over-emphasise financial
incentives when considering what drives a person
to commit fraud. Fear and embarrassment about
having made a mistake may be equally important.
Thus, the incentives coming from the top of theorganisation must be examined: to what extent
do they align with regulations and with ‘doing theright thing’?
In addition, short-term bespoke controls canserve as useful checks on whether aggressive sales
programmes are leading to fraudulent behaviour.
A well-publicised open-door or hotline policy canalso provide a valuable early-warning system ofpotential problems in an organisation.

IncludesIncludesIncludesInternal audit (routine)

14%

Tip off (internal)

13%

By accident

8%

Fraud risk

13%

Tip off (external)

7%

Suspicious activity monitoring

13%

Whistleblowing
hotlineBy law
enforcement

4%7%

Investigative
media

2%

Corporate security

5%

Data analytics

4%

Rotation of personnel

1%

Q. How was the most disruptive fraud and/or economic crime initially detected?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Fraud can occur with the best of intentions
Fraud needn’t necessarily be a malicious or selfish act. From a legal pointof view, there are actually two kinds of fraud – fraud committed for
personal gain (such as embezzlement, or false reporting intended to boost
compensation) and fraud committed for “corporate motives” (such as thesurvival of the company, or the protection of the workforce). The latter could
occur with the best of intentions set on increasing the company’s success.
For example, what might start as a sales strategy designed to increase market
share and profitability (to the benefit of employees) might ultimately morph
into fraudulent sales tactics. Either way, the result is the same: the executive
suite will be held responsible.

27 PwC’s Global Economic Crime and Fraud Survey 2018

Exhibit 22: Fewer companies report having ethics and complianceprogrammes

82%
77%

17%

Yes

14%

No

5%

4%

Don’t know

n 2018 n 2016
Q. Do you have a formal business ethics and compliance programme in your organisation?
Source: PwC’s 2018 Global Economic Crime and Fraud Survey

Preventing rationalisation: culture
While incentives and opportunities can be
influenced and managed, preventing therationalisation of a fraudulent act is more of achallenge. This is a process that occurs entirely
within the human mind and is thus far harder
to influence.
One of the peculiarities of internal fraud is thatthose who commit it often see it as a victimlesscrime and cannot visualise any person who will
be directly harmed by their actions. This helps
explain why nearly three-quarters of survey
respondents told us that an internal actor was
the main perpetrator of the following mostdisruptive economic crimes, including humanresources fraud (81%), asset misappropriation(75%), insider trading (75%), accounting fraud(74%) and procurement fraud (73%).
The first step in preventing rationalisation is tofocus on the environment that governs employee
behaviour – the organisational culture. Surveys,
focus groups and in-depth interviews should
therefore be used to assess the strengths andweaknesses of that culture. Consistent trainingis also key. If people clearly understand what
constitutes an unacceptable action – and why –rationalising fraudulent activity will be harder.

However, our survey found a decreasing number oforganisations investing in the kind of training thatcan make a material difference to fraud prevention.
The percentage of respondents who indicatedthey have a formal business ethics and complianceprogramme has dropped from 82% to 77% since our2016 survey. And only 58% of companies with sucha programme indicated that programme has specificpolicies targeting general fraud.
The task of detecting and preventing economic
crime or fraud is undoubtedly a complex one.
It means finding the right blend of technologicaland people-focused measures, guided by a clear
understanding of the motivations behind fraudulent
acts and the circumstances in which they occur.
Organisations need not resign themselves to thebelief that technology is the only solution, or thata certain amount of fraud is simply part of the costof doing business. Rather, by establishing a cultureof honesty and openness from the top down, they
can imbue their organisations with a spirit of open
accountability – and pull fraud out of the shadows.

28 PwC’s Global Economic Crime and Fraud Survey 2018

Conclusion
Be prepared. Face the fraud.
Emerge stronger.
Our survey shows that many companies are underprepared to face fraud, for both internal andexternal reasons. This is why shining a light on anorganisation’s fraud blind spots, and sharing a clear
understanding of what constitutes fraud – and whatneeds to be done to prevent it – is so important.
Doing so can also unlock significant opportunities.
It can help make positive structural improvements
across the organisation – which can make thebusiness stronger and more strategic in both goodtimes and bad. That includes removing siloes infunctions like compliance, ethics, risk management
and legal – and enabling a culture that is morepositive, cohesive and resilient.
It’s true that the value proposition of an up-to-datefraud programme can be hard to quantify, making
it sometimes difficult to secure the investments
needed. But the opportunity cost – financial, legal,
regulatory and reputational – of failing to establish
a culture of compliance and transparency can be
far greater.
Not only has the threat of economic crime intensified
in recent years, the rules and expectations of all
stakeholders – from regulators and the public tosocial media and employees – have also changed,
irrevocably. Today, transparency and adherence
to the rule of law are more critical than they haveever been.

And that’s a good thing, because in the court ofpublic opinion, where reputations can be won andlost overnight, a business will be held accountable
tomorrow for what happens today. Therefore, how
it responds when a fraudulent event or complianceissue arises will be as important for the company as
the event itself.
Understanding this principle gives a business theopportunity to get ahead of fast-moving events,
and to demonstrate to both internal and external
stakeholders that it is on top of the issues. Not only
are there considerable reputational benefits to‘owning’ transparency, in an atmosphere of zerotolerance, doing so can actually enhance the job
security of senior management – while attracting thenext generation of leaders to the organisation.
An unplanned event can quickly spiral into a crisis
if not well managed. But with the right mechanisms
in place – a culture of cohesion and openness anda sophisticated control environment – a company
will be well positioned to absorb the shocks,
build ‘muscle memory’, and emerge stronger.
The imperatives are clear: place transparency at
the heart of corporate purpose, use it to unite
strategy, governance, risk management andcompliance, and find yourself better positioned totransform a potentially serious business problem
into an opportunity to come out ahead.

29 PwC’s Global Economic Crime and Fraud Survey 2018

Contacts
Want to know more about what you can do in the fight against fraud?
Contact one of our subject matter experts
Survey Leadership
Didier Lavion
Principal
PwC US+1 (646) 818 7263
didier.lavion@pwc.com

Forensic Services Leaders
Kristin Rivera
Global Forensics Leader
PwC US+1 (415) 498 6566
kristin.d.rivera@pwc.com

Richard Major
Partner
PwC Singapore+65 6236 3058
richard.j.major@sg.pwc.com

Dinesh Anand
PartnerPwC India+91 (124) 330 6005
dinesh.anand@pwc.com

Domenic Marino
Partner
PwC Canada+1 (416) 941 8265
domenic.marino@pwc.com

Dyan Decker
Partner
PwC US+1 (646) 313 3636
dyan.a.decker@pwc.com

Claudia Nestler
Partner
PwC Germany+49 (69) 9585 5552
claudia.nestler@pwc.com

John Donker
PartnerPwC Hong Kong+852 2289 2411
john.donker@hk.pwc.com

Sirshar Qureshi
Partner
PwC Czech Republic+420 251 151 235
sirshar.qureshi@pwc.com

Ian Elliott
Partner
PwC UK+44 (0) 771 191 2415
ian.elliott@pwc.com

Nick Robinson
Partner
PwC United Arab Emirates+971 4304 3974
nick.e.robinson@pwc.com

Trevor Hills
Partner
PwC South Africa+27 (11) 797 5526
trevor.hills@pwc.com

Malcolm Shackell
Partner
PwC Australia+61 (2) 8266 2993
malcolm.shackell@pwc.com

Leonardo Lopes
Partner
PwC Brazil+55 (11) 3674 2562
leonardo.lopes@pwc.com

About the survey
PwC’s 2018 Global Economic Crime and Fraud
Survey was completed by 7,228 respondents from
123 territories. Of the total number of respondents,
52% were senior executives of their respective
organisations, 42% represented publicly-listedcompanies and 55% represented organisations withmore than 1,000 employees.

www.pwc.com/fraudsurvey
At PwC, our purpose is to build trust in society and solve important problems. We’re a network of firms in 158 countries with more than 236,000 people who are committed
to delivering quality in assurance, advisory and tax services. Find out more and tell us what matters to you by visiting us at www.pwc.com.
This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information
contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completenessof the information contained in this publication, and, to the extent permitted by law, PwC does not accept or assume any liability, responsibility or duty of care for any
consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it.
© 2018 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity.
Please see www.pwc.com/structure for further details.