Category: Insights

Expert opinion and insight from our experienced consultants.

Email spoofing

Posted on by Admin Admin

In this article, I’ll answer the questions:

  • What is email spoofing?
  • How do spammers spoof an email address?
  • What does a spoofed email look like?
  • How can you prevent email spoofing?

According to Proofpoint, 3.1 billion spoofed emails are sent every day, with attacks costing businesses $26 billion (about £18.8 billion) since 2016. The goal of email spoofing is like phishing, as fraudsters attempt to obtain sensitive information from the recipient or get them to download a malicious attachment. However, instead of simply imitating the email address of a trusted source, spoofed emails manipulate the way emails are delivered.

How do spammers spoof my email address?

Email spoofing is possible because of the way email providers send and deliver messages. When someone sends an email, it doesn’t simply go from the person who created the message to the intended recipient. Rather, it goes through an SMTP (Simple Mail Transfer Protocol) server configured in the client software.

You can think of this process like a sorting office for physical post. The SMTP takes an incoming message and routes it to the relevant email server, which then directs it to the relevant user inbox. This gives criminal hackers the opportunity to input a bogus address in the ‘Sent’ field, because the SMTP doesn’t have a process to authenticate this information. As such, attackers can make it look as though the email has been delivered from someone else.

What does a spoofed email look like?

Now we’ve answered the question ‘what is email spoofing?’, let’s examine what a spoofed email looks like. Below is a real-world example of a spoofed email received by multiple members of the ESA Risk team last week, purporting to be from ESA Risk’s Marketing Director. This email was caught by our spam filters, so it didn’t make it into anyone’s inbox, but it did arrive in their spam folder, so required manual intervention to fully eliminate the potential threat.

 

—–Original Message—–
From: xxxxxxx@staging.esarisk.com <rebeccasmith0900@gmail.com>
Sent: 20 October 2021 08:25
Subject: RAPID INTERVENTION

Good morning,

Hope you don’t have a lot of work to do? Well in case you do, peg it now because i have a task for you to carry out urgently.

Drop your number so i can brief you about it all.

Thanks.

Xxxx xxxxxxxxxxx @staging.esarisk.com

Sent from iphone

 

Spot the obvious issues with the above.

Here is another example of what someone might see when they receive a spoofed email:

what does a spoofed email look like

There is nothing here that reveals the true nature of this message. The ‘From’ field displays the address provided by the scammer, but, crucially, this is not necessarily the email address from which the message originated. Only by investigating the email header (sometimes known as the envelope) can you tell if the ‘From’ field has been manipulated. This information isn’t typically displayed on email clients and will require you to look in your settings.

In most versions of Outlook, you can do this by double-clicking the message to get it to open in a separate window, then selecting ‘File’ and ‘Properties’. You’ll be presented with a long string of information, but within that you should see something that looks like this:

email spoofing

You can see here that, although the message says it’s from the employee’s boss, there is a different address in the reply field. When the recipient responds, the message isn’t going to ‘boss@company.com’ but to ‘scammer@scammail.com’. This is a big clue that the original email address has either been forged or compromised. A bogus email address won’t always be as easy to spot, however. You may well encounter the same technique as standard phishing attacks, with the attacker replicating the email address of a genuine organisation.

In this example, the sender might register the email domain ‘conpamy.com’ – transposing the ‘n’ and the ‘m’. This can be tricky to spot, and it’s why organisations should adopt SPF (Sender Policy Framework). SPF is a security protocol that works alongside DMARC (Domain-based Message Authentication, Reporting and Conformance) to detect malware and phishing attacks. It does so by comparing the IP address from which the email was sent to the address in the ‘From’ field.

If you’ve implemented SPF, the email header will contain a string of text that looks like this:

prevent email spoofing

You can see that this message failed the test, because the client’s IP is not permitted to send messages from the company domain. Implementing SPF helps flag suspicious emails and reduces the burden on employees to spot scams. However, for it to work, the domain holder (which in most circumstances will be your organisation) must configure a DNS TXT entry specifying all IP addresses authorised to send email on behalf of the domain.

How to prevent email spoofing and what to do if your email has been spoofed

At this point, I’m sure you’re asking the question: ‘How can I stop spoofing emails coming from my email address?’ Technical solutions such as SPF can help protect organisations from email spoofing. They can be implemented alongside spam filters and anti-malware software to give you the best chance of flagging suspicious messages before they reach employees’ inboxes.

However, these tools are never foolproof, and scammers are always finding clever ways to bypass security mechanisms and they may ask you the recipient to confirm that the email is real and valid, so it’s down to the recipient to decide. As such, you must ensure that employees are trained to detect, and respond appropriately to, suspicious emails.

Phishing emails always contain clues that can help you spot their true nature and ESA Risk provide training for you and your teams on these issues and all things cyber security.

If your email has been spoofed, you want to prevent email spoofing or you have any other cyber security questions or concerns, please contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form for advice.

Asset tracing: A guide

Posted on by Admin Admin

What is asset tracing?

Asset tracing is the process of locating financial assets, property or valuables through formal investigations. Investigators undertake detailed research to determine a subject’s asset profile and whether that profile is sufficient to meet their outstanding debts or potential claims. Asset tracing can spearhead investigations in finding additional evidence such as unknown associates and lifestyles which can lead to a greater understanding of the target’s activities. Once the research has been conducted, the investigators then identify assets and can assist in asset recovery litigation and collections processes.

Asset tracing services can be extremely useful if a client is wondering whether a claim is worth pursuing. There is no point in a client spending good money after bad only to get a pyrrhic victory; therefore, conducting asset tracing prior to the commencement of any litigation is a worthwhile practice.

Tracing assets before escalating a case to litigation can also save clients’ money. Possessing a clear understanding of the subject’s asset position can provide leverage in early-stage negotiations and may negate the need for expensive litigation.

When further expertise are required, forensic accountants can be utilised to follow the paper trail; forensically analysing bank statements and transactions to pinpoint where money has flowed and, ultimately, how the layering and laundering process has taken place.

Both investigators and forensic accountants use digital forensics and numerous software tools to assist with the processes. Together with open-source intelligence (OSINT) and human intelligence (HUMINT) sources, a full picture can be obtained.

Tracing assets is not easy and requires the most skilled investigative professionals in the field. ESA Risk’s investigators have great experience and knowledge of asset tracing, understanding the way assets are identified through both covert and overt means. People may try to hide from insolvency and debt but usually there is an audit trail which we can find. Cash assets, however, can be moved around the world in seconds, and each country operates their privacy laws differently, making assets a lot more difficult to identify and recover, but by no means impossible.

The process is even further complicated by the constant movement of fraudsters and debtors themselves, in evading payments or concealing assets. Money could either be converted into other assets or hidden in fictitious companies and trusts. The dissipated assets may then be sold, used or transferred into offshore accounts across borders via online platforms, making asset tracing a task that heavily relies on technology, resources and investigative experience. The initial intelligence-gathering phases are usually undertaken electronically, but having a global network of intelligence agents who can undertake in-country investigations is a must.

Asset tracers have access to confidential global databases and deep web tools, where they can build out the asset puzzle, identifying the lifestyles and behaviours of the individuals they are looking for. Whether it’s checking if they’ve been on holiday to their villa recently or purchased a new boat, investigators can access intelligence and trace the assets required.

Download the ESA Risk Asset Tracing brochure

A guide to how asset tracing works

1. Identification

Asset tracing commences with full background intelligence research undertaken through online data sources. Investigators examine financial information and digital records, such as emails of the targets. Then by forensically analysing commercial databases and social media platforms, investigators obtain intelligence. Intelligence agents, who are in the field, can then further conduct covert enquiries to help build the intelligence profile.

Researchers constantly examine open-source public records, including those of real estate, licensing, criminal court proceedings and the civil court. Certain data sets are restricted, however, with the correct strategic legal approach and understanding of data protection laws, in many circumstances restricted data can be legally obtained.

2. Conversion

Investigators must turn intelligence gathered into meaningful information and obtain proof that traced assets are connected to the targets and are ultimately recoverable. This process can require speed. However, in certain cases – especially complex cross-border cases – it can take time to convert the intelligence into evidence. Access to information and data in certain countries can be challenging, as systems aren’t digitised. In addition, careful planning of surveillance teams and systems can take time, as understanding the lifestyle of individuals can be time-consuming, especially when ethical social engineering is a strategy.

Sophisticated fraudsters also use tools and techniques to stay one step ahead of their pursuers, and that is where expeditious investigations are required. Working with on-the-ground, in-country resources and local authorities assists the pace of investigations and ensures that asset tracing is a process that is swift, personalised and confidential. They can assert disclosure or search orders, as well as freezing onshore accounts, if necessary.

3. Recovery

A good litigation strategy should be in place from the outset to allow the investigators to understand which assets the lawyers would like to go after. It is also important to understand how the litigation and investigations are being funded and whether litigation funders are required. While investigators identify the assets, expert lawyers in litigation, debt recovery or insolvency are required for clients to obtain the most likely chance of successful recoveries. At ESA Risk, we have access to both experienced lawyers and litigation funders who will be able to assist in such recoveries.

Asset tracing services from ESA Risk

When it comes to tracing assets, we are the experts. ESA Risk’s team will deliver concise but comprehensive results which will enable you to make the decision on which way to proceed. With a network of trusted partners covering every part of the world, our investigation capability – and therefore yours – is truly international.

To instruct us on an investigation or for more information on our asset tracing services, contact Mike Wright, Risk Management & Investigations Consultant at mike.wright@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

 

Download the ESA Risk Asset Tracing brochure

Charities: What to do if you suspect fraud

Posted on by Admin Admin

Before getting into practical advice on what to do if you suspect fraud, how to report charity fraud and the investigation of suspected fraud, I think it’s important to mention the current state of affairs in the charity sector. Statistics from the Fraud Advisory Panel show that fraud within the charity sector is significantly underreported.

Charities appear to be concerned – maybe even scared – about the reputational damage fraud reporting could do to their organisation. A fraud-related prosecution or a case involving a charity with a high-profile may well enter the public domain through the media, and charities are concerned that might have a negative impact on public confidence in their organisation and their work.

This may well be as a result of recent high-profile scandals involving UK charities. While those cases didn’t involve fraud, the potential impact of bad press has been felt by the sector.

Most often, when people give their money to a charity, it’s because they believe in the work that charity does and believe that their money will be put to good use. Charities worry that anything that could dispel that idea in people’s minds could, in turn, lead to a reduction in support and donations received.

This is especially true when fraud is on the inside of a charity.

Fraud could be external to an organisation – for example, someone creating a fake website or page on a site such as Just Giving, pretending to be a charity / collecting on behalf of a charity, then syphoning the funds raised – but the potential for reputational damage in these situations isn’t as high.

The reluctance of charities to report fraud is a huge source of concern. And it should be a source of concern for the Charity Commission and other bodies involved in the charity sector and in fraud prevention.

What should a charity do if it identifies fraud within its organisation?

For me, I think it’s most important for charities to focus on insider fraud – the fraud that occurs within charities.

I think the first thing that charities should do is, as quickly as possible, to lock down all systems and controls. Whoever is responsible for governance and fraud prevention in the charity should press the brakes on everything as soon as possible, especially if fairly large amounts of money are involved.

It’s important to stem the flow quickly, as we know that the longer a fraud goes on for within an organisation, the bigger that fraud becomes. Fraudsters often test the waters. They may start off by syphoning off maybe only a few pounds or a few hundred pounds. Once they realise that there are gaps and weaknesses in the system that they can take advantage of, it emboldens them to think bigger. Stealing £100 then becomes £200 the next time, then £1,000, then £5,000 and so on. Unchecked frauds then grow exponentially.

I’m not suggesting that whole organisations should lock down as soon as they see £100 missing from their accounts. For smaller amounts of money, there may be a very simple explanation – a misunderstanding or an accounting error, for example. But, as soon as you think money may have been defrauded or stolen, that is when you need to quickly review what may be going on.

In the first instance, that means speaking to the responsible people in the organisation. That could be the head of finance, or the bookkeeper or treasurer. At the same time, the systems and controls in place should be checked to ensure they’re working properly. If there’s no clear explanation for missing money, that’s the time to take further decisive action.

Your response should be proportionate to the amount of money involved and to the size of your organisation. The tipping point will likely be different for different charities.

As a charity, the action you’re able to take may depend on the type of charity you are, too. If you’re dispersing funds, you may not be able to put the brakes on everything, because you have people and organisations that depend on you.

What does ‘locking down’ systems and controls involve?

When you suspect a fraud, the key objectives of your response are to identify and close any gaps, bolster any weak areas and mitigate the risk of more money disappearing. Typically, this is about access and authorisation. Access to systems and to finances should be limited to those people who absolutely need it. Authorisation processes can be strengthened simply by adding another level. For example, especially in smaller organisations, moving money might need to be authorised by only 1 person. Adding a second signatory to that process immediately adds another layer of security.

Once the potential risks have been mitigated, an organisation can start putting in place the next part of their response.

Investigation of suspected fraud

To ascertain exactly what has gone on in the case of a suspected charity fraud, you need to carry out a thorough investigation.

Whether you choose to undertake an internal investigation of suspected fraud or bring in external investigators, it’s important to involve people with the right expertise early on. Think about who needs to be involved in the investigation, and what skillsets you need to bring in from external parties. Do you need to bring in forensic accountants? Do you need to bring in economic crime investigators? Do you need to bring in auditors? External experts might be needed only for advice and can help guide the charity to make its determination about how it goes about its own investigation. Alternatively, the whole investigation can be outsourced to an independent external organisation.

The investigation needs to be quick and it needs to be addressed in depth. One reason for this is the obligation to report serious incidents to the Charity Commission. As soon as you’re able to ascertain a 60 or 70% likelihood that the case is fraud, it should be reported to the Charity Commission.

Internally, the investigation team needs to report into someone. In charities, the governance committee is the most likely candidate for this role. Even if there’s suspected involvement in a fraud by the charity’s trustees, the governance committee usually works independently of the charity’s management structure.

The investigation itself is the same for charities as any other organisation. Once the investigation team is in place, the next stage is to determine where the material is that can assist with uncovering what has happened. In a fraud investigation, that means working closely with members of the finance and audit functions within the organisation. Crucially, at this stage, you want to make sure that any information that could assist in the investigation is secured. Ensure that no material is destroyed or deleted (although digital forensics can help with recovering deleted digital files and emails).

When the potential evidence has been secured, you start your process of understanding what’s happened by virtue of interviews, reviewing the material and interrogating the accounts (which is where forensic accountants can add real value).

Prevention is better than the cure

Many UK charities are small bodies with limited resources, which can result in them having few fraud prevention controls in place and a mindset of ‘we haven’t got the money for this’. But it’s often the case that charities really can’t afford not to invest in fraud prevention. The fallout of a fraud case or another type of scandal could spell the end for smaller charities, whereas investing, say, a few thousand pounds in prevention tools could avoid the loss of tens of thousands to fraud down the line.

An area I always look at when conducting investigations is what controls were in place pre-incident and how can those controls and processes be improved to avoid future issues? One side of the investigation is, of course, discovering the truth about the case at hand, but the other side is analysing the preventative risk management elements within an organisation. Whether or not a crime is identified during an investigation, the organisation’s risk controls are left in a stronger position for the future.

Relentless risk management is the best chance an organisation has for preventing fraud.

That means continually undertaking risk reviews, looking at systems and processes. Transparency and accountability at all levels are really, really important.

How to report charity fraud

In relation to reporting charity fraud, trustees should be mindful of their obligations to the Charity Commission. Once it becomes clear that a fraud has been committed, it must be reported.

Another body charities may want to report suspected fraud cases to is Action Fraud, which gathers data about fraud across all sectors.

Finally, if you think a crime has been committed, there’s a decision to be made on whether (and when) to bring in the police.

The bottom line is that charities shouldn’t bury their heads in the sand. Each situation should be considered carefully and a quick decision should be taken on the most effective and proportional way to manage that particular (potential) problem.

Charity fraud: How ESA Risk can help

At ESA Risk, our team includes experienced fraud investigators and risk management experts, meaning we can support charities at every step – from offering advice on fraud prevention to conducting full investigations of suspected frauds.

If you suspect a fraud has been committed in your organisation or you want help to secure your charity against fraud, contact Lloydette Bai-Marrow, Serious Fraud and Economic Crime Consultant at lloydette.bai-marrow@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

This article was published as part of Charity Fraud Awareness Week 2021.

Money laundering and the charity sector

Posted on by Admin Admin

Arguably, the effects of money laundering and financial crimes are even more devastating for charities, as their funds have been raised to help the most vulnerable in society. This makes the prevention and investigation of all financial crimes against charities extremely important.

The reality for most of the 169,000 registered charities in England and Wales, along with the millions worldwide, is that they often have low levels of security to all the funds they hold and little awareness of good money laundering and financial crime prevention controls. This is demonstrated in the distressing statistic from the Charity Commission, the UK charities regulator, that an estimated £8.6 million was lost in 2020. And that’s only what has been reported.

There’s no getting away from it, financial crime in the charity sector is a serious problem and it is only getting worse.

Money laundering is defined in the Proceeds of Crime Act as “the process by which the proceeds of crime are converted into assets which appear to have a legitimate origin, so that they can be retained permanently or recycled into further criminal enterprises” and the three main stages are Placement, Layering and Integration.

How are charities used to launder money?

In a charity sector context, a really simple example could be a large donation to a charity of ‘dirty money’ or proceeds of crime which is then layered in with legitimate funds that the charity holds. A fake beneficiary is then set up as a front which will receive the freshly laundered funds from the charity, all clean and appearing legitimate. Sadly, there are many more examples of how charities have been used and abused by criminals.

A bona fide charity may have criminal employees, funnelling off hard-won monies.

As well as the charities being victims of financial crimes themselves, the actual charity entity could be a sham. In the most shocking examples, fraudsters have taken to brazenly setting up fake charities and fundraising for donations which are then simply pocketed or used for other illegitimate activities.

Critically for non-criminal (i.e. most) charity employees and trustees: if they fail to report any suspicions of money laundering, then they could be liable to prosecution or a hefty fine.

Not only is the financial loss devastating for charities, but the next biggest impact is reputational damage. Imagine hearing that a major charity had been involved, or had been used, in vast amounts of money laundering of funds… You would probably think twice about donating to that charity – if they’ve lost money previously, what’s to say it won’t happen again? Charities hugely depend on funding from donors so if those sources of income diminish or dry up, it could signal the end of that organisation.

How ESA Risk can help fight money laundering in the charity sector

At ESA Risk, we have an experienced team of risk, investigations and consulting experts that are here to help any organisations in the charity sector with carrying out due diligence checks on donors, beneficiaries and local partners, and monitoring the end use of funds.

We can undertake financial crime risk assessments, advise on Know Your Donor and Know Your Partner procedures and help you set up and maintain a Suspicious Donations Log. If you’re a trustee who’s signing up to the new Stop Fraud Pledge, we can support you with all 6 of the pledge’s steps: Appoint, Ensure, Consult, Create, Perform and Assess.

Equally, we can carry out enhanced due diligence before you make a donation to an organisation (to avoid fake charities, for example).

Please get in touch for an initial chat with our experienced consultants. You can contact Ali Twidale, Banking & Financial Fraud Consultant at ali.twidale@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

This article was published as part of Charity Fraud Awareness Week 2021.

Cyber fraud and cyber crime in the charity sector

Posted on by Admin Admin

The Cyber Security Breaches Survey 2021, published by DCMS, found that 26% of almost 500 voluntary sector organisations surveyed had reported cyber fraud over the previous year. The report shows that while charities generally compare favourably with private sector businesses – 39% of which said they had suffered cyber security breaches or attacks – the number rises to 51% among charities with annual incomes of £500,000 or more. A quarter of those organisations that had suffered attacks said they had to deal with them on a weekly basis.

The survey, which took place between October 2020 and January 2021, found that the most common type of cyber attack for charities was phishing, identified by 79% of respondents. Phishing often involves trying to con recipients into giving away personal details or passwords. This was followed some way behind by impersonation attacks, suffered by 23% of respondents, where emails are sent out impersonating the charity. Among the charities that identified breaches or attacks, the survey found that 18% ended up losing money, data or other assets.

And even if money, data, or assets were not lost, 4 in 10 charities were still negatively affected for reasons such as requiring new, post-breach measures or having staff time diverted to deal with the problem, the report found – a reputational risk for any charity.

The fallout of such attacks was highlighted last year when more than 100 UK charities reported being caught up in the Blackbaud cyber attack, which targeted commonly used financial software.

While the DCMS report makes it clear that cyber security is still a major issue for many charities, the proportions reporting negative effects of breaches or attacks in 2021 are significantly lower than in previous years. This is not because attacks are any less frequent, the report says, but it could be due to more organisations implementing basic cyber security measures following the introduction of the General Data Protection Regulation (GDPR) in 2018.

Cyber security is also higher on the agenda of trustees, researchers found; 68% of charities said it was a high priority for them, compared with 53% who said the same in a previous study in 2018.

Charities are bigger cyber attack targets than they realise

Many charities, especially the smaller ones, fail to realise the value of the data they possess, according to a report by the National Cyber Security Centre (NCSC). Unfortunately, cyber criminals do realise the value of this data, making charities vulnerable targets to a cyber attack.

While the average person may find it unconscionable to steal from a charity, there are a number of perpetrators looking for some financial gain, besides the typical cyber criminal. This may include:

  • Suppliers and third parties – it’s common for charities to outsource the responsibilities of running, maintaining, and securing their data.
  • Terrorists – terrorist groups are likely to deface websites and publish victims’ personal details online, which is a process known as doxing.
  • Nation states – nation states use cyber crime to further their agendas.
  • Insiders – one of the biggest threats, and disgruntled staff with access to employer’s data may commit cyber crimes seeking money or simply for revenge.
  • Hacktivists – hackers will target charities if they disagree with the charity’s purpose or are motivated by a specific cause.

In order to prevent cyber-criminals from accessing your charity’s valuable data, the NCSC Small Charity Guide recommends taking these precautions:

  • Back up your data and protect it with strong passwords
  • Protect your organisation from malware
  • Keep your smartphones and tablets safe.

Simple advice and a sobering but easy way to protect against cyber threats

Here is an example of how small differences in passwords can make a huge difference to would-be cyber attackers.

Password Time to crack
charity 22 milliseconds
Charity 18 hours,

58 minutes,

27 seconds
Charity1 5 months,

2 weeks,

3 days
CharityNo1 1 millennium,

7 centuries,

6 decades

How ESA Risk can help charities become cyber-secure

At ESA Risk, our Cyber Security consultants have years of experience in the industry that equip them to protect your confidential data and your money from cyber criminals. Get in touch with us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form, to find out how we can help make your charity cyber-secure.

This article was published as part of Charity Fraud Awareness Week 2021.

Charity Fraud Awareness Week 2021

Posted on by Admin Admin

Charity Fraud Awareness Week 2021 is a joint-initiative from the Fraud Advisory Panel (“the voice of the counter-fraud profession”) and the Charity Commission for England and Wales (“an independent, non-ministerial government department” that “registers and regulates charities”), who launched a related website – Preventing Charity Fraud – which provides resources “on how to prevent, detect and respond to fraud committed against charities and not-for-profits.”

We’ll be publishing content in support of the cause all week on our website and our social media accounts using the campaign’s hashtag: #StopCharityFraud. In tomorrow’s article, ESA Risk’s Cyber Risk & Security Consultant, Graeme McGowan, will be covering cyber fraud and other cyber risks in the charity sector. Later in the week, Ali Twidale, Banking & Financial Fraud Consultant will look at money laundering and financial crime in charities. And Serious Fraud and Economic Crime Consultant, Lloydette Bai-Marrow, will round off the week by discussing what charities should do if they suspect a fraud has been committed.

Fraud prevention and fraud investigations is a topic we publish on regularly. We expect that much of this existing content (while created for a wider audience) will be of use to those in the charity sector looking to fight fraud:

Preventing Charity Fraud

As the Preventing Charity Fraud website states, “charities can be susceptible to fraud.” And it’s easy to see why. In a 2019 survey of more than 3,000 registered charities, the Charity Commission and the Fraud Advisory Panel found that only 9% of charities “have a fraud awareness training programme”, “almost half don’t actually have any good-practice protections in place” and “26% of charities believe they’re vulnerable to fraud because of an over-reliance on goodwill and trust”.

There’s been an increase in the number of cases of fraud in all sectors since the start of the Covid-19 pandemic. It’s likely that the situation in the charity sector is no better than it was 2 years ago, which is why initiatives such as this one are needed.

Charity Fraud Awareness Week comprises a number of online and in-person events aimed at those working in the charity sector.

Outside of Charity Fraud Awareness Week, the Preventing Charity Fraud website contains a host of practical information for those working in or with not-for-profits and charities, including downloadable helpsheets on topics such as whistleblowing, financial crime risks, volunteer fundraising fraud and charity retail fraud.

The Charity Commission and Fraud Advisory Panel’s 8 principles of good counter-fraud practice

Also on the website is the “8 principles of good counter-fraud practice” which was published in response to the findings of the 2019 survey of the sector.

The principles in full are:

“1. Fraud will always happen – being a charity is no defence. Even the best-prepared organisations cannot prevent all fraud. Charities are no less likely to be targeted than organisations in the private or public sector. Fraudsters don’t give a free pass to charitable activities.

“2. Fraud threats change constantly. Fraud evolves continually, and faster, thanks to digital technology. Charities need to be alert, agile and able to adapt their defences quickly and appropriately.

“3. Prevention is (far) better than cure. Financial loss and reputational damage can be reduced by effective prevention. It’s far more cost-effective to prevent fraud than to investigate it and remedy the damage done.

“4. Trust is exploited by fraudsters. Charities rely on trust and goodwill, which fraudsters try to exploit. A strong counter-fraud culture should be developed to encourage the robust use of fraud prevention controls and a willingness to challenge unusual activities and behaviour.

“5. Discovering fraud is a good thing. The first step in fighting fraud is to find it. This requires charities to talk openly and honestly about fraud. When charities don’t do this the only people who benefit are the fraudsters themselves.

“6. Report every individual fraud. The timely reporting of fraud to police, regulators and other agencies is fundamental to strengthening the resilience of individual charities and the sector as a whole.

“7. Anti-fraud responses should be proportionate to the charity’s size, activities and fraud risks. The vital first step in fighting fraud is to implement robust financial controls and get everyone in the charity to sign up to them.

“8. Fighting fraud is a job for everyone. Everybody involved – trustees, managers, employees, volunteers, beneficiaries – has a part to play in fighting fraud. Trustees in particular should manage fraud risks actively to satisfy themselves that the necessary counter-fraud arrangements are in place and working properly.”

Fraud-related advice and support from ESA Risk

Whatever sector you’re in, if you need advice or support on fraud prevention, we’re here to help. We’ll work with you to put in place preventative measures as part of your wider risk management strategy, covering areas including cyber security and due diligence.

If you suspect a fraud has been committed against your organisation, our experienced Investigations team – including a former principal investigative lawyer with the UK government’s Serious Fraud Office (SFO) – can help you discover the truth.

Contact Mike Wright, Risk Management & Investigations Consultant at mike.wright@esarisk.com, +44 (0)343 515 8686 or via our contact form, to find out more.

5G and cyber security

Posted on by Admin Admin

5G works with lower power usage and latency on devices, proposing a more nimble and agile use of technology once it becomes commonplace, such as loading online content faster and making many devices more efficient.

5G will also make use of network virtualisation (NV) which uses software and hardware resources on one virtual network, to optimise network services and enable remote resolutions to any issues. The accelerated speed of 5G in comparison to its forerunners can also contribute to cyber security packages, offering new ways to increase security measures. This could include the Internet of Things (IoT) and an increased use of cloud computing, to aid business networks, in particular, with gaining control over cyber security.

However, 5G comes with potential threats and risks. The network uses an upgraded routing of software rather than hardware-based switching, and this new digital routing contains various vulnerabilities that present risks to users.

Vulnerabilities of 5G cyber security

  • Hackers could potentially gain control of the software that manages the entire network, putting millions of devices at risk. Even if the software is initially managed by advanced computer technology this too can be vulnerable.
  • 5G being used by the Internet of Medical Things (IoMT) can put client medical information at risk, as, if the network is hacked, information can be manipulated or altered.
  • Higher frequency coverage of 5G means that the transmitters cover less area so the number of cell towers will have to increase, otherwise network coverage will be poorer.
  • IoT networks involve a connection between many devices, giving hackers more options to target. Since these devices can individually be hacked, it puts the entire connected network at risk. This includes city infrastructure and drones that will all transmit personal data.
  • Huge amounts of data will be stored together on the cloud (rather than on secure local servers) so masses of information could be accessed by infiltrators.

Implementing safeguards

It is important to implement regulations and security measures to avoid breaches and data being leaked. Network operations must make sure to secure IoT devices and protect the network to ensure privacy policies are upheld. Software updates can have patches installed to ensure security, alongside password protection for various devices and applications.

The reliance of 5G on digital networks makes it more difficult for IT teams to control risks and attacks, so the network structure must have solid inbuilt defences such as firmware and security operating systems. Mitigation techniques and patching can help to protect IoT devices that will be using 5G. IT employees should also be educated on the security threats that 5G brings so they can be equipped to manage them and human error-based attacks can be avoided. SaaS (Software as a Service) providers will require the means to protect against attacks and individual devices may require installation of a virtual private network (VPN). Conducting regular malware scans and installing firewalls is also a way to secure devices.

5G will certainly bring many positives, such as increased speeds and reliability, so it is paramount that there is a strong understanding of how to protect the interconnected network of devices. 5G particularly protects privacy on devices, as it is cloud-based and rooted in digital software, so more data can be encrypted and safely stored. It will offer a broadening of IoT and be a powerful, faster network and asset to many. And with its development will come a fashioning of artificial intelligence systems that will be able to target and mitigate threats and secure sensitive data at the same time.

Cyber security support from ESA Risk

If you need advice or support on anything cyber security-related, contact us at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

Upgrading your security systems

Posted on by Admin Admin

Security professionals will be called on to upgrade security systems in order to protect companies’ assets, properties and people, whether with security personnel or a range of security technologies (such as security alarm systems) or a mix of the 2.

While security will be enforced to protect employees, it will also be required for out-of-use office spaces and vacant buildings. Many businesses have had to close down due to insolvency and this trend will continue, particularly once the government support is withdrawn. This leaves office premises to be vacated and will therefore require security to protect properties and comply with insurance requirements. Companies might invest in security guards or CCTV camera installation to ensure their property remains undamaged and safe from forced entry, burglary, water leaks or breakages, and that health and safety checks are being made.

Security systems are not just important to ward off intruders. For businesses that are still open, security systems can also monitor employee attendance and drive productivity, or enable managers to observe customer traffic and their staff’s customer service in sectors such as hospitality and retail.

As the season is changing and the nights are drawing in, employees being asked to open or lock up their place of work are being put at risk. To avoid breaching the duty of care, open and lock security services are available, as well as licensed security operatives 365 days a year, taking the risk away from employees as well as ensuring intruders can’t access the building.

How can I ensure my business is secure?

There are some relatively simple steps you can follow to start ensuring your business is secure:

  • Regular physical security reviews can ensure that sensitive materials are locked away and that equipment is safely stored.
  • Security teams can ensure clean desk policies to mitigate risks of company information being stolen in a break-in.
  • Protective measures can include high-security locks, video surveillance cameras and security alarm systems, as well as overnight security guards. Having a trustworthy security team not only ensures your offices are highly guarded, but also that your security can recognise intruders and adapt their security plans for your business.
  • By conducting regular risk assessments, the correct security systems can be installed, and fit-for-purpose policies and procedures to ensure compliance by everyone in the company can be put in place.
  • Things like visitor access should be closely monitored, especially as workers start returning to the office, to ensure unauthorised individuals cannot gain entry to company buildings. This can be ensured through card-only access and intruder alarms or easy-install wireless systems for buildings that remain unoccupied.

When implementing new security systems, make sure they are adaptable and can be installed with agility, in correspondence to the current government rules and regulations. Security plans will have to be updated and redesigned, so must be implemented in a cost-effective and diligent manner. Technology continues to improve and security measures like cameras become cheaper, allowing for a tightening of security for your business.

At ESA Risk, we install robust security systems to protect you and your business. Whether you need to protect people, property or assets (or all 3), we’ll work with you to create a security setup that meets your needs through the use of technology (e.g. CCTV and alarm installation and monitoring) and manned services (e.g. close protection, manned guarding).

Contact our Security Consultant, Liam Doherty, to arrange your security risk assessment and consultation today.

Data Management in Banking

Posted on by Admin Admin

Effective data management in banking is paramount in protecting your information, to avoid data leaks and maintain customer privacy. When handling confidential client information, there are various safety measures and precautions that banks take to ensure it remains secure.

First of all, data management involves a structured process of collecting the data, ensuring each client’s information is efficiently processed and organised. The storage of data is paramount in maintaining successful data management in accordance with the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR) and this often involves the cloud or on-site servers that are equipped to store and segment data appropriately.

The digitalisation of information has made it much easier to manage client records, especially when it comes to monitoring online behaviour and keeping records of money going in and out. Through IT infrastructure, analytical models can be made to provide insight into market trends and customer behaviour. They can detect patterns of behaviour to predict future events, also, such as the likelihood of a customer to become overdrawn.

This aspect of data management takes on a practical approach and enhances customer service, as well as giving the bank more information on how best to allocate funds. Alongside data analytics, online reports and dashboards can also track the bank’s performance.

 ‘The secure management of all types of data remains one of the highest priorities for the UK banking industry, especially with the added pressures of exponentially increasing fraudulent activity and targeted scams that have been born out of the Covid-19 pandemic.”

Is your data safe?

Many people in the UK have concerns about their data being at risk due to hackers and fraudsters. Banks have a large task to avoid cyber attacks and fraud, create financial products and services tailored to customers, and pre-empt customers’ needs, all while storing and protecting vast amounts of data.

Data stores and legacy systems, although being hard to access, can be infiltrated, so banks ensure regular assessments and analysis of systems. Risk models can also be drawn up to create security plans in case something goes wrong, and banks can opt for more secure storage systems such as Apache Cassandra, which is a scalable, open-source database that enables lots of secure data to be stored at once.

“Data breaches create high-profile activity in the media and so the banks need to constantly invest and work even harder to protect their assets and reputations, which will ensure customer confidence is kept high.”

Customers are now able to request a copy of what personal information of theirs is stored by banks, although this can take up to 6 weeks. This is called a subject access request (SAR) and originates from the EU General Data Protection Regulation (GDPR), but it has remained in UK law under the Data Protection Act despite Brexit.

Banks work to provide trustworthy storage of customer funds alongside optimising their own revenue. By offering a positive customer experience and maximising the value gained from customer data, banks fulfil their role as an institution. Managing your data effectively is therefore in their best interest, not only to magnify their own revenue but also to maintain reliability as a business. But it is also important for us as customers to be diligent when it comes to storing our money and be aware of the risks that come with entrusting capital to a separate institution.

7 Steps to Data Security

Posted on by Admin Admin

For an organisation, it is of paramount importance to identify areas of exposure and develop adequate risk management programmes that address data privacy and security. To help you get started, here are 7 questions to frame your thinking. If you can confidently meet the requirements in the 7 questions, then you are on your way to better data security.

1. Is the corporation aware of all applicable legislation pertaining to customer data?

For UK businesses, the main legislation is the Data Protection Act (DPA) 2018, but there may be laws in other jurisdictions which you also need to comply with if you do business or have customers outside of the UK. For example, the EU’s General Data Protection Regulation (GDPR) applies to all EU citizens and therefore any company processing the data of EU citizens. While most of the GDPR is currently enshrined in UK law (in the DPA 2018), this isn’t the case for all data laws worldwide, and the UK’s implementation of the GDPR is under consultation. 

2. Is any personal identifiable information (PII) or client confidential information stored on computers or in paper files on premises?

If so, where specifically is the data stored, how is it secured, who has access and how many PII data files are there? Track personal data throughout your entire information infrastructure and identify all parties that have access to this data. Conduct an audit to inspect employee access to and use of personal data.

3. Are all of the company’s laptops encrypted? Are portable media devices like thumb drives prohibited or at least encrypted?

Devices such as laptops, smartphones, external hard drives and flash drives all present possible data security threats if lost, stolen, or hacked. While most people assume that system hackers are the greatest threat, recent studies show that lost or stolen portable devices are the most common cause of data breaches.

4. Has the company implemented strong internal password controls and information security training for all employees?

Make sure passwords are strong. It is also a good practice to reset passwords periodically – 30-45 days is a good timeline – and never duplicate passwords. It’s also imperative to reset default passwords.

5. Are the company’s firewalls current and all security patches regularly updated?

A firewall can be the best defence when trying to isolate and contain breaches. Despite the expense, it is beneficial to invest in a robust set of firewalls that require user authentication.

6. Does the company outsource any services to third-party vendors that may involve a client’s information?

If so, does the third party have the right processes and procedures in place to protect the integrity of the data, as well as security measures governing those processes? If you outsource services to a processor, as the data controller you remain responsible for ensuring that any data processing complies with the DPA. Any contractual agreement should be supported by an indemnity from the third-party processor in favour of the data controller in the event of any breach. That means making sure suitable security arrangements are in place to meet the 7th data protection principle- that ‘appropriate technical and organisational measures are taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of such data’.

7. Does the company have in force a detailed plan in case of a data breach?

In addition to developing and implementing a risk management programme for data breach, risk transfer via insurance can be a cost-effective risk management mechanism.

Need further support?

If you require expert assistance with compliance or risk management strategies, get in touch with our team. We’ll work with you to manage risk and keep your business cybersafe.

Contact Mike Wright (Risk Management & Investigations Consultant) for further advice.

Deep dive for the answers you need
TAKE A DEEP DIVE
Or contact us on +44 (0)343 515 8686 or at advice@esarisk.com.

Deep dive for the
answers you need

Lawyers, accountants, advisors, investors, senior
management. You name them, we help them find the answers
they need. Ready to discover how we can help you?

Take a deep dive
Continue browsing