Fraud is an unfortunate reality for every business, large or small. It is not always easy to detect and can be devastating to an organization’s reputation and finances. It can also lead to legal action against the perpetrators of the crime.
November 13th – 19th 2022 is Fraud Awareness Week and as cybersecurity professionals, we wanted to spend a little time highlighting and educating how you can spot it in your business or personal life. It’s all too easy to just hope/assume that it can’t happen to you, your company, a non-profit you support or volunteer with, or your family. It’s best to be educated and alert but not paranoid.
A simple way to think about fraud is when someone knowingly misrepresents facts to obtain money, sensitive information, or other assets from an individual, organization, or business.
What makes fraud… fraud??
The prevalence of fraud is difficult to measure because of likely underreporting. Many organizations do not report occurrences of internal fraud unless it is legally required or there is a public arrest. Why? Because sometimes the fear of reputational damage or loss of trust with consumers (for corporations) and donors/supporters (for non-profits) may be more concerning than the financial damage already incurred.
Beyond whether an organization would report fraud, what about employees? Many people do not report fraud for fear of retaliation or embarrassment. Since there are many types of fraud, it’s hard to know what the true extent is.
Understanding the Various Types of Fraud
Fraud likely has existed in various forms for as long as humans have existed. Much of today’s focus around cybercrime has shifted awareness as well as criminal methodologies from traditional means (paper, phone calls, live interactions) to digital form. Technology has made it much easier to achieve speed and scale of a variety of cons.
There are many different types of fraud, including corporate, tax, Ponzi schemes, cyber fraud, and consumer fraud.
Before the digital age, fraudsters used human-to-human tactics to concoct a plausible story with a sense of urgency for someone to take an action. In my writings, I came across an article called 10 Of History’s Greatest Con Artists which involves 10 infamous cases of fraud – none of which required a computer.
However, most of these setups likely took significant time and were not conducted on a broad scale.
So what is cyber fraud or internet fraud?
Cyber fraud, internet fraud, and cybercrime all kind of overlap because they involve cybercriminals with the intent to illegally acquire and leverage an individual’s or business’s sensitive information, credentials/access, or disruption of operations for monetary or other gains.
There are countless types, but some of the common themes include:
Whether it be traditional fraud or cyber fraud, there are some things that individuals and organizations can do to be aware, know the warning signs, detect what can be detected, and act when something happens.
Here are some simple warning signs and scenarios of fraud to help individuals spot it and not fall prey to the con.
For organizations, individuals can still be targeted by outside criminals, but often times fraud is committed by insiders (employees or other types of workforce members) .
Corporate security and finance teams have a number of types of monitoring tools at their disposal to detect instances of fraud:
Preventing fraud
Unfortunately, there is no 100% scenario to prevent fraud, but companies and individuals can push down their risk to more acceptable levels. Stopping it before it happens, or at least reducing the chances of it happening in your business, is the best approach to risk reduction.
Common sense and routine checks can help you to spot potential problems before they arise. If someone has access to information that could compromise your business or could allow them access to funds they shouldn’t have access to, then this needs addressing. Your employees will understand why certain measures are being taken if you explain them in a clear way, which helps keep any resentment down.
What should I do if I suspect that someone is stealing from my company?
If you suspect that someone within your team may be involved with fraud, report it immediately – don’t delay! Fraudsters often try and cover their tracks but if you act quickly enough then evidence might still exist so take photographs of any documents showing suspicious activity (and make sure these are dated), record details about how much money has gone missing and who exactly was responsible for handling those finances. In most large companies, employees should not conduct their own investigations so alerting legal or compliance to the issue is often the best solution.
Put things in writing: If there’s any doubt as to whether something is legitimate or not, err on the side of caution by getting advice from an expert before proceeding with anything suspicious seeming (or even non-suspicious).
Now that you know what the signs of fraud are, it’s important to take steps to protect yourself against it. The most effective way to avoid becoming a victim is by having strong internal controls in place (individual / family controls or company controls). The next best thing is to increase your awareness and keep an eye out for anything suspicious that might indicate fraudulent activity.
