NAFCU Compliance Blog

What Made Consumers Complain to the FTC in 2017?; ICYMI – Amended 1098 Forms Due Tomorrow

Written by Shari R. Pogach, Regulatory Paralegal

Earlier this month, the Federal Trade Commission (FTC) published the 2017 Consumer Sentinel Network Data Book, a database compilation of the nearly 2.7 million reports it received by the Consumer Sentinel Network from consumers on problems experienced in the marketplace.   Although the number of consumer complaints decreased from 2.98 million in 2016 to 2.68 million in 2017, reported losses to fraud were $905 million in 2017, $63 million more than in 2016.  The top three categories reported were: 1) debt collection at 23 percent; 2) identity theft at 14 percent; and 3) imposter scams at 13 percent.

Credit card and tax fraud were the most common type of identity theft reported.  As to imposter scam complaints, consumers reported losing $328 million.  Nearly one in five people lost money at a $500 median loss.  Examples of imposter scams involved someone pretending to be a government official, a technical support expert, a relative in distress or a well-known business to get the consumers to give up their money. Wire transfer continues to be the most widely used form of payment with 70 percent of consumers reporting the scammers contacted them by phone.

New this year, the FTC's data book provides details on fraud losses by age groups.  Interestingly enough, more people in their twenties than those over age 70 reported losing money to fraud.  Those aged 20-29 reported money fraud losses in 40 percent of reports versus people aged 70 and older in 18 percent of their complaints.  However, when older adults lost money the median dollar amount lost was higher than any other age group.  For example, the median reported loss for people age 80 and older was $1,092 compared to $400 for those aged 20-29.

The median dollar loss from all reported types of fraud in 2017 was $429.  The highest losses were in these fraud categories:  travel, vacations and timeshare plans at $1,710; mortgage foreclosure relief and debt management at $1,200; and business and job opportunities at $1,063.  Military consumers reported losing the most money to imposter scams costing them nearly $26 million.  Identity theft was the largest category reported by military consumers and their median fraud loss of $619 was more than 44 percent higher than the general population.

The FTC data book provides national statistics, a state-by-state listing of the top report categories in each state and a listing of the metropolitan areas that generated the most complaints per individual.  Florida, Georgia and Nevada were the top states reporting fraud in 2017.  Michigan, Florida and California had the most identity theft reports per individual.  The FTC has also developed a mini site to make the information in the data book more accessible for the public, for example there is a webpage provided for each state. 

Take a look at what folks in your area were complaining about in 2017.  The more you know, the better you are able to help them hang on to their hard earned money.

***

ICYMI – Amended 1098 Forms Due Tomorrow. Back in January, we blogged on a few tax items including that a bill was pending that might extend certain income tax deductions that had expired for 2017 such as the private mortgage insurance (PMI) deduction. As we blogged a few weeks ago, on February 22, 2018, the IRS issued guidance clarifying that lenders are required to amend their Form 1098 and send amended forms by March 15, 2018. Specifically, Form 1098 must now reflect PMI paid in 2017:

https://www.irs.gov/forms-pubs/reporting-mortgage-insurance-premiums-mip-treated-as-qualified-residence-interest-through-december-31-2017

The Instructions for Form 1098 and General Instructions provide guidance on amending Form 1098. 

Because We Will All Age...... A Primer on the Prevention of Elder Financial Exploitation and Abuse

Written by Shari R. Pogach, Regulatory Paralegal

Did you know that June 15 has been designated World Elder Abuse Awareness Day?  I didn't, that is, not until I attended the third global summit conference held here in Washington, DC, on the 15th.   While it seems as though the "Millennials" get all the attention these days, it's also important to remember that a significant portion of our population is getting older.  Some statistics shared by some of the summit speakers:  one in six of the population in Pennsylvania is over the age of 65; by 2019 there will be more people over the age of 60 than under the age of 18 in North Carolina; and over 80 million of the U.S. population will be over 60 by 2050. 

According to an article in the Federal Reserve System's Consumer Compliance Outlook: First Issue 2017, "roughly one in 10 seniors have suffered financial, emotional, physical, or sexual abuse or neglect in the past year, according to one study, with financial abuse occurring the most."  And as people get older, they may develop cognitive impairments, making them prime targets for financial exploitation.  Banks and credit unions are considered key players in helping to prevent and respond to elder financial abuse due to:

• Knowing their customers and members;
• Personal or face-to-face interaction with older consumers making transactions;
• The ability to detect suspicious account activity;
• Mandated to report suspected elder financial exploitation under many states' laws;
• BSA reporting.

In some cases financial institutions have raised concerns about state and/or privacy laws prohibiting them from disclosing a consumer's financial records to authorities and uncertainty as to the best way to proceed.  The article, Combating Elder Financial Abuse, looks to address these types of issues with a review of federal privacy laws, regulatory guidance and sound practices that can be adopted to help protect elderly customers and members from financial abuse.

Some community banks and credit unions are developing special programs oriented to providing age-friendly or safe banking products and services to their older clientele.  The National Community Reinvestment Coalition (NCRC) has a dedicated section on its website with information and recommendations on providing age-friendly or safe banking to protect older adults.  During the summit, a panel from the North Carolina State Employees' Credit Union (SECU) discussed their credit union's impressive program to protect and educate its senior members.  As it is mandatory in North Carolina to report any witnessed senior exploitation, SECU (North Carolina) has worked to educate its staffers on spotting and reporting potential abuse, as well as developing an estate planning and essentials program to help older members establish an affordable estate plan to help protect their economic future. SECU (North Carolina) is willing to share its expertise with other institutions, simply send an email to: [email protected].

As a reminder, here are some additional resources on developing best practices and responses to elder financial exploitation:

• The Consumer Financial Protection Bureau's Recommendations and Report for Financial Institutions on Preventing and Responding to Elder Financial Exploitation.
• Interagency Guidance on Privacy Laws and Reporting Financial Abuse of Older Adults.
• The Federal Trade Commission's Pass It On website page on scams.
• The National Credit Union Administration's The NCUA Report - NCUA's Resources Can Help Credit Unions Detect, Prevent and Report Elder Financial Abuse.

During the summit, a speaker who was a former New York prosecutor talked about a former case of elder financial exploitation.  The case was never brought to trial and sadly the victim died within a year of the abuse coming to light.  The speaker noted that in most instances older victims are extremely embarrassed about being victimized and although it can't be proven to be a direct cause, in most cases the victims die shortly thereafter. 

And, remember folks, we are all aging as you read this.

Imposter Scams Surpass Identity Theft Consumer Complaints

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

Imposter scams are a serious and growing problem, being the second most reported by consumers in 2016 as reported by the Federal Trade Commission's (FTC) annual data book summary, Consumer Sentinel Network Data Book for January - December 2016.  What exactly is an imposter scam?  When a person pretending to be a friend, family, romantic interest, computer technician, a representative of a company or government agency persuades the victim to send money or reveal personal information.  According to the FTC report, complaints included: scammers posing as friends or relatives stranded in foreign countries without money; scammers claiming to be working for or affiliated with a government agency; scammers claiming to be a computer technician offering unnecessary software services; and scammers claiming to be affiliated with a private entity (e.g. a charity or company).  Imposter scams also topped the list of complaints from military consumers followed by identity theft complaints.  The most widely reported method of payment for money lost to fraud was by wire transfer. Of those who noted in their fraud complaint how they were first contacted, 77 percent said it was by phone. 

Although debt collection complaints declined slightly between 2015 and 2016, it still was the top consumer complaint category.   The top ten complaint categories for 2016:

1. Debt Collection   
2. Impostor Scams
3. Identity Theft
4. Telephone and Mobile Services
5. Banks and Lenders
6. Prizes, Sweepstakes and Lotteries
7. Shop-at-Home and Catalog Sales
8. Auto-Related Complaints
9. Credit Bureaus, Information Furnishers and Report Users
10. Television and Electronic Media

Ranking as the fifth consumer complaint category, complaints against financial institutions made up 5 percent of the more than 3.1 million complaints collected in 2016. The FTC report identifies this type of complaint as ranging from: deceptive or predatory mortgage lending practices; problems with modification of mortgage terms; miscellaneous customer service and account issues with bank or credit union products, including payday loans, student loans, auto title loans, fees and overdraft charges; other finance company lending products, services and practices; etc.

The data book summary provides a detailed breakdown of the top ten consumer fraud and other complaints along with the top six identity theft type complaints for each state and the District of Columbia.  This data comes from consumer complaints made directly to the FTC as well as those received by state and federal law enforcement agencies, national consumer protection organizations and non-governmental organizations.

Remember your credit union members are being targeted by these imposter scams so it's helpful to keep abreast of trends.  Fraud prevention is also on NCUA's agenda as it's a supervisory priority focus for 2017. 

Whistleblowing and Fraud Prevention; New HMDA Resources Available from the CFPB

Written by Elizabeth M. Young LaBerge, Senior Regulatory Compliance Counsel

The NAFCU Compliance Team has seen an uptick in questions about various internal fraud prevention issues, like whistle blower information, fraud policies and NCUA’s Fraud Hotline. This isn’t necessarily surprising since NCUA indicated that internal controls and fraud prevention are one of their primary areas of supervisory focus in 2017.

Section 1790b of the Federal Credit Union Act has a provision protecting whistleblowing employees against retaliation:

“§1790b.                     §213

Credit union employee protection remedy.—

(a) In general.—

(1) Employees of credit unions. — No insured credit union may discharge or otherwise discriminate against any employee with respect to compensation, terms, conditions, or privileges of employment because the employee (or any person acting pursuant to the request of the employee) provided information to the [NCUA] Board or the Attorney General regarding any possible violation of any law or regulation by the credit union or any director, officer, or employee of the credit union.” FCU Act, section 1790b(a)(1) (Emphasis and clarification added).

Some laws, like the Sarbanes-Oxley Act which applies to publicly traded companies, require a hotline be available for whistleblowing purposes. NCUA does not have a provision explicitly requiring that credit unions make a hotline available for whistleblower employees. NCUA has established a Fraud Hotline for the reporting of suspicious or illegal activity directly to NCUA. Reports are confidential and can be anonymous.

While there may not be federal regulation from NCUA requiring credit unions to make a hotline available or post information about NCUA’s Fraud Hotline, many credit unions’ internal policies and procedures, such as the Fraud Policy, may contain requirements to do so. These policy requirements implement the FCU Act’s provisions and mitigate risk by facilitating or encouraging employees to report illegal acts or internal fraud. Lastly, there may be state law or human resource management requirements that might require a whistleblower policy or the availability of a hotline for reporting insider abuse.

NCUA does require that credit union management develop and implement a fraud policy. Chapter 14 of the NCUA’s Examiner’s Guide states “[t]he board of directors should adopt the policy and require that staff given written acknowledgement of receiving and reviewing that policy.” See, page 14-5. In the AIRES Examination Questionnaire on Red Flags, the failure to have a fraud policy is considered an indication of a material weakness in internal controls. NCUA recommends that credit unions require employees to review and acknowledge the Fraud Policy on an annual basis. See, NCUA’s Help Deter, Detect and Report Insider Fraud website. Further, a Fraud Policy may be required to obtain fidelity bond coverage for the credit union.

For more information on internal controls and fraud prevention, see the below resources:

• NCUA’s IRPS 87-1 regarding the Bank Bribery Act and codes of ethics
• Federal Credit Union Act
• AIRES Examination Questionnaires on “Red Flags” and “Internal Controls – Management”
• NCUA’s Fraud Prevention Center website
• The Supervisory Committee Guide for Federal Credit Unions, Chapter 22
• NCUA Examiner’s Guide
  • Chapter 14, “Fraud and Forgery” and “Internal Control Structure” sections, p. 14-5
  • Chapter 7, “Conflicts of Interest” section, p. 7-24
• NCUA’s Help Deter, Detect and Report Insider Fraud website
• The NCUA Fraud Hotline website
• NCUA’s Fraud Series video series
• NAFCU Compliance Blog Post - Safeguarding Against Insider Fraud
• FFIEC’s BSA/AML Examination Manual, Suspicious Activity Reporting-Overview

New HMDA Resources Available from the CFPB

Earlier this month, the CFPB issued some additional resources on new HMDA, including a webinar discussing data points and a chart illustrating options for collection and reporting. These new resources can be found on the CFPB’s HMDA Rule Implementation webpage. For more information about HMDA compliance under the new rule, see NAFCU’s HMDA Compliance webpage.

Should Credit Unions Photocopy Identification Cards?

Written by Shereefat Balogun, Regulatory Compliance Counsel

So last week, I attempted to take some cash out of my credit union’s ATM but the customer in front of me had a bunch of checks she had to deposit and took forever.  I decided to walk into the branch and ask for the cash withdrawal.  The teller asked me for my driver’s license or any similar ID. I told her that I did not have any ID on me (don’t judge me!), but I had my ATM/debit card.  The teller said she would be able to process my request only if the credit union had a copy of my ID on file.  While I understood the benefits of having the copy on file, I could not help but to think about the different compliance issues this raises.  Yes, the copy of the ID is great for verifying your members’ identity or helping to detect fraud.  However, it got me thinking about compliance issues relating to IDs, such as military IDs and fair lending concerns.  Contrary to what we’ve been taught, what’s good for the goose is NOT always good for the gander. 

Bank Secrecy Act and CIP Recordkeeping

The Bank Secrecy Act requires a credit union to know its member (KYC or KYM whichever lingo you prefer) and have a customer identification program (CIP). This includes checking a government identification number, which can be done with documentary evidence like an ID.  So collecting the ID to verify the information is one thing.  But should a credit union keep a copy of the ID in its records?  For recordkeeping purposes, the CIP rule leaves it up to the credit union to determine how it wants to document verification that has been performed.  Generally, the rule requires a credit union to retain a description of the document that was relied on, noting the type of document, any identification number contained in the document, the place and date of issuance, and expiration date.  So, a description is generally sufficient.  Though the credit union may retain a copy of the ID, it certainly is not required.  See, 31 C.F.R. §1020.220(a)(3)(i)(B).  This is also confirmed in FinCEN’s Guidance on Customer Identification Regulations FAQs:

2. Can a bank keep copies of documents provided to verify a customer’s identity, in addition to the description required under 31 C.F.R. § 103.121(b)(3)(i)(B), even if it is not required to do so?

Yes, a bank may keep copies of identifying documents that it uses to verify a customer’s identity. A bank’s verification procedures should be    risk-based and, in certain situations, keeping copies of identifying documents may be warranted. In addition, a bank may have procedures to keep    copies of documents for other purposes, for example, to facilitate investigating potential fraud…

(Emphasis added.)

Keep in mind though, that although there are no federal regulations prohibiting a credit union from photocopying ID, some states prohibit photocopying IDs.  Be sure to check with your individual state law to see if there are any limitations here.

But wait…what about military IDs?  Good question!  While a credit union may use a military ID to collect identifying information for CIP purposes and other purposes, it cannot copy the ID for CIP purposes.  Federal law generally prohibits the copying or scanning of military ID:

Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both.

(Emphasis added.)

As stated above, photocopying military ID can subject a person to fines and imprisonment up to 6 months.  If your BSA/CIP program permits the photocopying of military ID identification, you may want to reassess your CIP requirements. 

To emphasize, the statute prohibits the photocopying the military identification card.  For CIP purposes, it’s our understanding that some credit unions document information found on the military ID since they are unable to make a copy.  This practice is consistent with the CIP recordkeeping requirement discussed above. 

Fair Lending Concerns

So we’ve established that it is customary to collect and retain a copy of a driver’s license for CIP purposes.  However, for purposes of Regulation B and other fair lending laws, credit unions may want to keep that copy out of the member’s loan application file.  For example, Regulation B prohibits financial institutions from considering certain information when evaluating an application and making a credit decision.  Indeed, the FinCEN FAQ highlighted above also warned:

Nonetheless, a bank should be mindful that it must not improperly use any document containing a picture of an individual, such as a driver’s license, in connection with any aspect of a credit transaction.

(Emphasis added.)

Regulation B and Regulation C require a credit union to collect certain information for monitoring purposes.  For instance, Regulation B requires a credit union that receives a credit application to collect certain information, such as ethnicity, sex, and age.  See, 12 C.F.R. §1002.13(a).  Similarly, Regulation C requires a credit union to collect certain data in relation to applications for home purchase loans, home improvement loans, and refinancings.  This information includes information about the ethnicity, race, and sex of the applicant or borrower.  See, 12 C.F.R. §1003.4(a)(10).  When collecting this information, a credit union may list questions regarding the ethnicity, race, and sex of the applicant on the loan application form, or on a separate form that refers to the application.  See, Appendix B to 12 C.F.R. Part 1003.

Although neither rule explicitly instructs credit unions to refrain from maintaining a copy of a driver’s license from a loan file, doing so may increase your fair lending risks, and may lead to examiner scrutiny.

As always, if you have any questions about this blog or any other compliance issue, please feel free to reach out to NAFCU’s Regulatory Compliance Team.  We’re here for you!

FinCEN Advisory Alert: SARs Required for Certain Cyber Activity + Compliance Trivia!

Written by Shereefat Balogun, Regulatory Compliance Counsel

Woah, we’re ending cyber security month with a bang!  Just last week, we blogged on the two massive cyberattacks that hit Netflix, Amazon, PayPal, Twitter, and others.  In the wake of the increasing attacks, FinCEN recently issued an advisory outlining credit unions’ SAR obligations as they relate to cyber-events and cyber-enabled crime.

As many may know, especially those who just earned the NAFCU Certified Bank Secrecy Officer designation (woo hoo!), any illegal or suspicious activity can form the grounds of a SAR (Suspicious Activity Report, or as was used throughout our BSA Seminar “Something Ain’t Right”) filing. In certain cases credit unions are required to file a SAR.  In particular, when criminal or suspicious activity from someone outside of the credit union that totals $5K or more and you have a suspect, you must file a SAR. For criminal or suspicious activity from an outsider totaling $25K or more, even if the credit union can’t identify a potential suspect, the credit union is required to file a SAR.  See, 12 C.F.R. 1020.320.

Since cyber events targeting financial institutions often constitute criminal activity, FinCEN is requiring credit unions and other financial institutions to report cyber-events and cyber-enabled crimes. The advisory is careful to say that this “does not change existing BSA requirements or other regulatory obligations” and credit unions “should continue to follow federal and state requirements and guidance on cyber-related reporting and compliance obligations.” But as applied to cyber-events and cyber-enabled crimes, the advisory clarifies that credit unions are required to report a cyber-event that involves $5,000 or more.  The advisory generally defines a “cyber-event” as an attempt to compromise or gain unauthorized electronic access to electronic systems and information.  The advisory further defines a “cyber-enabled crime” as illegal activities, such as fraud, money laundering, or identity theft, carried out by electronic systems and devices.

Unlike money laundering and terrorist financing or other financial crimes, the dollar amount at stake in a cyber-event or cyber-enabled event may not be readily apparent.  But based on the guidance and examples used, it appears that just about any unauthorized access that exposes or compromises member accounts could qualify as activity that would trigger the SAR obligation where the credit union “reasonably suspects” the amount at stake meets an applicable SAR threshold .  The FinCEN advisory states that in determining the dollar amount involved in the cyber-event, the credit union should consider the funds and assets involved in or put at risk by the cyber-event.  The advisory provides non-exhaustive examples of situations in which SAR reporting of cyber-events is mandatory:

Example 1: Through a malware intrusion (a type of cyber-event), cybercriminals gain access to a bank’s systems and information. Following its detection, the bank determines the cyber-event put $500,000 of customer funds at risk, based on the system s and/or information targeted by the cyber-event. Accordingly, the bank reasonably suspects the intrusion was in part intended to enable the perpetrators to conduct unauthorized transactions using customers’ funds.

The bank must file a SAR because it has reason to suspect the cybercriminals, through the malware-intrusion, intended to conduct or could have conducted unauthorized transactions aggregating or involving at least $5,000 in funds or assets. As explained in the next section, the bank should include all available information in the SAR relevant to the suspicious activity, including cyber-related information such as a description and signatures of the cyber-event, attack vectors, command-and-control nodes, etc.

Example 2: Through a cyber-event, cybercriminals gain access to a financial institution’s systems/networks. The cyber-event exposes sensitive customer information such as account numbers, credit card numbers, balances, limits, scores, histories, online-banking credentials, passwords/PINs, challenge questions and answers, or other similar information useful or necessary to conduct, affect, or facilitate transactions.

By evaluating the cyber-event and the type of information sought by its perpetrators, the financial institution reasonably suspects the cyber-event may have targeted information for the purpose of conducting, facilitating, or affecting transactions aggregating to at least $5,000. For instance, the financial institution could reasonably suspect the cybercriminals intended to steal and sell the exposed sensitive customer information to other criminals for financial exploitation to include unauthorized transactions at the institution. As further described below, the targeted financial institution should file a SAR to report all relevant information, including cyber-related information and information pertaining to any related unauthorized transactions.

The advisory also notes that credit unions should, in addition to the requirements set forth in the advisory, be familiar with existing guidance and NCUA’s cyber-related SAR-filing obligations. For example, in December 1997, NCUA issued Regulatory Alert, No. 97-RA12, providing guidance for reporting computer-related crimes.

As I mentioned during my presentation last week, BSA is sometimes said to be one of the most burdensome set of rules.  And this new advisory seems to add more to our reporting obligations.  But, as we emphasized during each session of the BSA seminar, BSA compliance officers are the gatekeepers who can help reduce the risk of a credit union being used to accomplish these financial crimes, and help law enforcement detect and stop them.  

We will publish another blog detailing the information that needs to be included in a cyber-related SAR filing.

Trivia Question: What are the timing requirements for a SAR filing? When does the clock start? Books/Manuals closed!

Safeguarding Against Insider Fraud; NAFCU Regulatory Compliance Seminar

Written by Shari R. Pogach, Regulatory Paralegal

Insider fraud is the bane of any financial institution. I’ve provided you with a couple of case examples in previous posts here and here. So how does a credit union protect itself against insider fraud?  The September issue of The NCUA Report includes an article on what a credit union can do to discourage the possibility of fraud. 

The article notes it’s important that a credit union enact strong internal controls, make certain such controls are tailored to the credit union’s products and services, and controls cannot be internally overridden.  Two common internal controls are the member-account verification and the credit union’s annual audit.  Additional internal controls can include using an outside auditor or having periodic internal audits during the year done by an internal auditor or the supervisory committee.  The article also offers this list of common internal controls:

• Dual controls;
• Computer access controls;
• Reviews of file maintenance reports;
• Cash counts;
• Surprise audits; and
• Measures that prevent employees from accessing family member accounts.

According to NCUA, a credit union can also use the following to deter fraud:

• Performing background checks before hiring employees;
• Requiring employees to sign a fraud policy annually;
• Conducting basic fraud awareness training;
• Requiring mandatory vacations and having another employee perform the vacationing employee’s duties; and
• Monitoring employees, including lifestyle and behavioral changes.

NCUA indicates it is important for the board of directors and supervisory committee to have continuous ongoing training in order to establish and maintain strong internal controls.   

The article also discusses how to report suspected fraud either through channels within the credit union or to NCUA through its fraud hotline. 

Insider fraud continues to rise and the cost of fraud to institutions also continues to increase.   Strong internal control safeguards are paramount to help detect and prevent against internal fraud.   

***

Seminar in New Orleans:  Our Regulatory Compliance Seminar is coming up next month in fun and fabulous New Orleans. I hope you’ll join us for the best credit union compliance training in the industry, in one of the best cities in the world! With their official motto of laissez les bons temps rouler – let the good times roll – you’re bound to have a great time exploring the city after class has ended. Check out some of their top restaurants and things to do. This popular event is almost sold out. Secure your seat today!

Debit Card Error Resolution: Can We Require an Affidavit?

Written by Stephanie Lyon, Regulatory Compliance Counsel

Greetings, fellow compliance aficionados! My name is Stephanie Lyon and I recently joined NAFCU as a Regulatory Compliance Counsel. Prior to NAFCU, I worked as a compliance officer in a small credit union and also interned at a large credit union during law school. I am thrilled to join the Regulatory Compliance Team and I look forward to working with all of you!

Now let’s all have a moment of silence for the hundreds of thousands of dollars credit unions have paid to members whose pin numbers were written on the back of their cards when lost or to members who went online shopping at www.fraudsters.com and had their card information stolen. Stories like these are not uncommon in the financial industry and each narrative seems to be more outrageous and expensive than the last. Unfortunately, some regulations are very member friendly and may make a credit union pay for losses, even if the member was negligent.

The federal Electronic Funds Transfer Act and Regulation E were enacted to protect consumers from electronic fund transfer errors and prevent financial institutions from unduly delaying the investigation and crediting of funds when errors are detected. The generous consumer protections built into Reg E, specifically section 1005.11 and its relevant staff commentary, may cause some credit unions to consider implementing procedures for members reporting unauthorized electronic fund transfers. These procedures require members to take steps in order to get their money back, with the goal of preventing unreasonable losses to the credit union. Credit unions often ask NAFCU’s compliance team if the credit union can require members who report unauthorized use of their debit card to provide documentation like police reports, affidavits, and signed written statements. While it is understandable that credit unions may want documentation from their members, the rule is very member friendly, mechanical and allows for minimal procedural variances in the error resolution process.

The rule states that a “financial institution may require a member to give written confirmation of an error within 10 business days of an oral notice” provided that the credit union tells the member of this requirement. See, 12 C.F.R. § 1005.11(b)(2). For credit unions that require a written confirmation, the error resolution process may look something like this:

1. Member notices an unauthorized charge on their account and calls the credit union.

2. The credit union asks the member to provide a written confirmation while it investigates the dispute per section 1005.11(b)(2).

3. The member fails to send a written confirmation of the error and the credit union takes longer than 10 business days to make a final determination.

4. The credit union has to make a decision of whether or not to provisionally credit the member’s account per section 1005.11(c)(2)(i).

5. The credit union makes the final determination of the error, makes the provisional credit final (if provided) and notifies the member per section 1005.11(c)(1).

There is extensive debate among compliance officers on whether section 1005.11(b)(2) and its relevant commentary allow credit unions to require members to provide affidavits and police reports. Unfortunately for credit unions, the rule is written narrowly and only gives credit unions the discretion to require written confirmation and withhold provisional credit in specific circumstances. The relevant sections of the rule that talk about written confirmation and provisional credits are sections 1005.11(b)(2) and 1005.11(c)(2)(i)(A), respectively.

First, let’s discuss what must be in the written confirmation. According to Reg E, the required contents of the member’s error notice are few; it must (a) enable the institution to identify the member (account number, member number, social security number or other personal identifier); and (b) indicate why the member believes an error exists along with the type of error, date, and amount of the error. See, 12 C.F.R. § 1005.11(b)(1)(ii)-(iii). The contents of the error notice can be given by the member orally or in writing. The rule does allow credit unions to require a signed written confirmation after receiving an oral notice of error. Is a signed written statement an affidavit? While affidavit requirements vary by jurisdiction, the Merriam-Webster dictionary defines an affidavit as “a sworn statement in writing made especially under oath or on affirmation before an authorized magistrate or officer.” Reg E’s written confirmation requirement is not nearly that formal.

Next, let’s discuss how the ability of the credit union to require a written confirmation impacts investigation responsibilities under Reg E. The main responsibilities of credit unions are to investigate an EFT error and to come to a resolution. Credit unions argue that without written confirmation, the credit union does not have anything to investigate and hence it should not have to pay for the unauthorized use of the member’s card. Even though the credit union may take into account the lack of documentation as a factor for its investigation, it must begin investigating promptly upon receipt of an oral notice. The rule clearly states that the credit union must follow all of the steps outlined in the regulation, even if the member only gives oral notice of the error. See, 12 C.F.R.§ 1005.11(b)(1). Comment 1005.11(b)(1) – 2 states:

“2. Investigation pending receipt of information. While a financial institution may request a written, signed statement from the consumer relating to a notice of error, it may not delay initiating or completing an investigation pending receipt of the statement.” 

(emphasis added).

In cases when the credit union is unable to conclude its investigation in 10 business days, it may take up to 45 calendar days from receipt of a notice of error to investigate and determine whether an error occurred. If the credit union chooses to use the additional time, it must provisionally credit the member’s account in the amount of the alleged error, unless the institution requires but does not receive written confirmation within 10 business days of an oral notice of error. See, 12 C.F.R. § 1005.11(c)(2)(i)(A). Hence a credit union can make the choice to withhold provisional funds if the member fails to provide the written confirmation of the error so long as the credit union does not delay commencing an error investigation because the member has not provided an affidavit, police report or other signed written documentation.

The bottom line is, Reg E does not permit altering the member’s rights or the investigation process by requiring additional documentation, whether they are police reports, affidavits, or otherwise. If the credit union requires a written confirmation and the member fails to provide it within 10 business days, the credit union does not have to provisionally credit the member’s account. So, while the credit union can request a written confirmation of the error, it cannot close an investigation merely because the credit union did not receive it. Credit unions requiring affidavits and police reports during its EFT error investigations may want to review their procedures with counsel, or risk giving its members reasons to complain to the NCUA.

Resources for Fraud Victims

Written by Eliott C. Ponte, Regulatory Compliance Counsel

Last Friday, I became the target of a scammer.  Yes, little ol’ me. Why?  I can’t tell you.  But I was chosen.  And at around 3:30 PM, I received a phone call from a “credit card company” stating that my card was breached.  

Scammer: Hi, my name is John and I am calling to notify you that your credit card was breached.

Eliott:  Again... geez.  What credit card are you calling about?

Scammer:  Well, before I give you any additional information, I need to verify your identity.  Please verify your name, address, and credit card number?

Eliott:  What credit card are you calling about?

Scammer:  I can’t tell you what credit card I am calling about until I verify your identity.

Eliott:  What bank or credit union do you work for?

Scammer:  I am in a call center, but I work for many banks... Bank of America, Wells Fargo, Citi Bank, Capital One, Chase....

Eliott:  Almost everyone in America has a credit card with one of those banks.  Which credit card are you calling about?

Scammer:  Is your cell phone number ###-###-####

Eliott:  Yes.

Scammer: If you give me your name or social security number, I can pull up your account.

Eliott:  I understand your company does not want to give out social security numbers over the phone before a consumer’s identity is verified, but I don’t know what credit card you are calling about. 

Scammer:  Well, I need to know your name before I can pull up your account.

Eliott:  You don’t know my name?  You called me to notify me of a breach.  What’s my first name?

Scammer:  I am trying to help you and protect you from someone ruining your credit.

Eliott:  I am just going to start calling the numbers on the back of my credit cards so I can ensure that my card was actually breached.

Second Scammer:  Hello Sir, we are trying to help you.

Eliott:  Who is this?

Second Scammer:  My name is Michael, I am one of the supervisors at the credit card call center.  I was listening on the phone call, as a part of our quality control.  We need your credit card information so we can cancel your credit cards 

Eliott:  My credit card information?

Second Scammer:  Yes, if you give us your 16 digit credit card number, I can look up your account.

***Eliott Hangs Up****

After I hung up, I called all of the institutions I have credit cards with and confirmed that my cards were not breached. Feeling confident and upset, I redialed the number they called me from.  To no surprise, after one ring I received a message that stated “the magic jack customer you are trying to reach is unavailable.”

Since this week is National Consumer Protection Week, which is a coordinated campaign that encourages consumers nationwide to learn how to protect themselves from fraud and scams, I decided to put the top-three  fraud reporting resources I found to be helpful in a blog.  I hope our blog readers can use these resources to help members, who are victims of theft, report scams to the appropriate authorities.

#1 Federal Trade Commission. The FTC has the most resources available to consumers on its website www.ftc.gov.  I also found their website to be the most helpful and easy to navigate.  The FTC’s website does an excellent job educating consumers on different types of scams, as it has helpful videos and commentary broken down by scam topic.  The FTC also tracks scam trends, which may be helpful to credit union employees tasked with promoting financial literacy.  Consumers can also report identify theft to the FTC.  The FTC employs a three-step process aimed to minimize damage and bring a thief to justice.  Members who want to file a report with the FTC should be directed to www.identifytheft.gov.  A Spanish version of the site is also available at RobodeIdentidad.gov.  Consumers wishing to report mass marketing (including SPAM) and telemarketing fraud can also file a complaint with the FTC.

#2 National Credit Union Administration.  NCUA launched its own Fraud Prevention Center, which helps consumers learn about fraud prevention and online security.  Similar to the FTC’s website, the NCUA does an excellent job of presenting relevant information to consumers.  The website  is not only easy to navigate, but the website does an excellent job at categorizing certain types of fraud.  Consumers can also find consumer protection and personal finance information and resources in Spanish on espanol.MyCreditUnion.gov 

#3 FinCEN. FinCEN’s website contains links to several other websites that will help a victim report fraud.  While not as informative as the FTC’s website, FinCEN is a great place find other resources to all types of fraud.  In addition, FinCEN’s website contains a list of resources on financial education and financial literacy initiatives. 

New NCUA Database; NCUA YouTube Video Series; Free NAFCU Compliance Seminar UDAAP Presentation PowerPoint

 Written by Eliott C. Ponte, Law Clerk

NEW NCUA Database for Financial Service Providers

Last week, the NCUA announced a new online tool to assist credit unions in finding financial service providers.  Created by the NCUA’s Office of Small Credit Union Initiatives, the database will give credit unions the ability to research credit union service providers at no charge.

According to William Myers, Director of the Office of Small Credit Union Initiatives, “credit unions are often looking for companies to provide products and services to help them meet members’ needs, comply with regulations, or just handle day-to-day operational requirements.”  Director Myers believes that “NCUA’s new program can help [credit unions] find the right supplier.”

While I agree with Director Myers that such a database will benefit credit unions, after looking at the database, it does not appear that the database was ready to be released to the public.  Several categories listed in the database, like “Member Business Loan CUSO,” “Cost Benefit Analysis,” and “Credit Reporting Services” are completely empty.  Yes, the database is blank in several areas; but once vendors register, credit unions will be able to use this database as it was intended to be used... to find third party servicers. 

***

NCUA Goes to YouTube to Fight Fraud

Regular NAFCU Compliance Blog readers will remember that we blogged about a NCUA video series on Fraud Prevention back in July of 2014.  In our July blog post, we noted that the NCUA had only released half of their eight-part series.  The first half of the series provided an overview of the series, and outlined the importance of maintaining a policy on employee fraud and conducting surprise cash counts.  The second half of the series includes videos on:

• Employee family accounts
• Vault cash
• File maintenance transaction reports

In addition to the three videos listed above, there is also a conclusion video that highlights the main points of the entire video series, and discusses several helpful resources available to credit unions.  After watching the latest four parts, I can attest that this video series is both well done and informative.  I encourage credit unions to take advantage of this free resource. 

The complete eight-part series, “Deterring, Preventing and Detecting Employee Dishonesty,” is available on NCUA’s YouTube channel.

 ***

NAFCU Compliance Seminar Slides on UDAAP Available: See What You Missed

Last month, former colleague Steve Van Beek presented on UDAAP at NAFCU’s regulatory compliance seminar.  If you were not one of the lucky compliance officers that got to here Steve’s excellent presentation on UDAAP, but you are interested in all the information that you missed:  well, you’re in luck!  Steve has made available his power point presentation to at no cost.  Click on this link to access his presentation and see what you missed by not attending.

 

 ***

NAFCU Closed on Veterans Day; Thank You!

In honor of Veteran’s day, NAFCU will be closed on Tuesday, November 11, 2014.  NAFCU will reopen at 9:00 AM on Wednesday, November 12, 2014. 

The NAFCU compliance team would like to thank all veterans for their service and sacrifice.   We appreciate all that you have done to make sure that freedom still comes free.  Thank you.

NCUA Releases Video Series on Preventing Internal Fraud; Free Kick

Written by Ricardo Piñeres, Regulatory Compliance Counsel

NCUA Releases Video Series on Preventing Internal Fraud.  The NCUA’s YouTube channel has now become the home for a series of videos on how credit union managers and volunteers can detect and prevent internal fraud and employee dishonesty.  The videos are a collaboration between the NCUA’s Office of Small Credit Initiatives and CUNA Mutual Group, and discuss how credit unions can bolster internal controls and learn how to identify potential clues that are warning signs for fraud.

The NCUA added the first three videos of the seven-part series to the channel on Friday, July 25.  According to a press release touting the release of the videos, these first three episodes focus on:

• An overview for the series;
• The importance of maintaining a policy on employee fraud; and
• Conducting surprise cash counts.

According to the agency, the remaining four episodes will be released over the coming weeks, and they will address:

• Separation of duties;
• Employee and family member accounts;
• File maintenance transactions; and
• Vault cash.

The video series is just the latest effort from the NCUA to attempt to minimize the risks to credit unions posed by fraud.  These efforts have led the agency to look at new ways in which fraud risk indicators can be identified, both by credit union leadership and NCUA examiners.  In commenting about the release of the video series, NCUA Chairman Debbie Matz highlighted the agency’s concern regarding the risks posed by fraud:

“The potential for employee fraud should always be a concern for credit union officials and volunteers.  Unfortunately, employee fraud led to $311.4 million in losses for the Share Insurance Fund between 2010 and 2013 at liquidated credit unions.  To protect the Share Insurance Fund from future losses, NCUA has developed this new video series to educate credit union managers and volunteers about detecting and reducing the potential for fraud and dishonesty among employees.  I encourage all credit unions to utilize this new resource.”

***

Free Kick.  The “drama” surrounding the transfer window has finally worn off for me.  I can’t wait for meaningful games to be played again, but it just seems like time is moving at a glacial place right now.  Hopefully, with the calendar getting ready to flip to August, things will appear to move a little quicker and the couple of weeks that are left before the season kicks off in earnest will fly by.

While I wait for the season to kick-off, I am going to go try something new, and combine my two sporting passions: football and golf.  Yes, I am making it a point to finally go out and try the phenomenon that is sweeping the nation: FOOTGOLF!  I look forward to sharing my experience in a future blog post.

Fraud Alert: Cyber Criminals Targeting Financial Institution Employee Credentials to Conduct Wire Transfer Fraud

Written by Bernadette Clair, Regulatory Compliance Counsel

Recently, the FBI, Financial Services Information Sharing and Analysis Center (FS-ISAC), and the Internet Crime Complaint Center (IC3), released a fraud alert regarding incidents of cyber crime targeting primarily small-to-medium banks and credit unions.

Cyber criminals are using spam and phishing e-mails, keystroke loggers, and Remote Access Trojans (RAT) to compromise financial institution networks and obtain employee login credentials. The stolen credentials are then used to initiate unauthorized wire transfers overseas.  In reported cases, wire transfer amounts have varied between $400,000 and $900,000.  In some of the incidents, the financial institution suffered a distributed denial of service (DDoS) attack against their public web sites and/or internet banking URL before and after the unauthorized transactions occurred.

The alert provides recommendations for financial institutions, such as:

• Educate employees on the dangers associated with opening attachments or clicking on links in unsolicited e-mails
• Do not allow employees to access personal or work e-mails on the same computers used to initiate payments
• Ensure employees do not leave USB tokens in computers used to connect to payment systems
• Ensure that workstations utilize host-based IPS technology and/or application white-listing to prevent the execution of unauthorized programs
• Monitor employee logins that occur outside of normal business hours
• Reduce employee wire limits in automated wire systems to require a second employee to approve larger wire transfers
• If wire transfer anomaly detection systems are used, consider changing “rules” to detect this type of attack and, if possible, create alerts to notify bank administrators if wire transfer limits are modified
• Monitor for spikes in website traffic that may indicate the beginning of a DDoS and implement a plan to ensure that when potential DDoS activity is detected, the appropriate authorities handling wire transfers are notified so wire transfer requests will be more closely scrutinized
• Strongly consider implementing an out of band authorization prior to allowing wire transfers to execute

Check out the alert for a complete list of the recommendations and information on reporting incidents of cyber crime.