ELECTRONIC FUNDS TRANSFER FRAUD

Electronic funds transfer systems have begun to proliferate, and so has the risk that such transactions may be intercepted and diverted. Valid credit card numbers can be intercepted electronically, as well as physically; the digital information stored on a card can be counterfeited.

Of course, we don't need Willie Sutton to remind us that banks are where they keep the money. In 1994, a Russian hacker Vladimir Levin, operating from St Petersburg, accessed the computers of Citibank's central wire transfer department, and transferred funds from large corporate accounts to other accounts which had been opened by his accomplices in The United States, the Netherlands, Finland, Germany, and Israel. Officials from one of the corporate victims, located in Argentina, notified the bank, and the suspect accounts, located in San Francisco, were frozen. The accomplice was arrested. Another accomplice was caught attempting to withdraw funds from an account in Rotterdam. Although Russian law precluded Levin's extradition, he was arrested during a visit to the United States and subsequently imprisoned. (Denning 1999, 55).

The above forms of computer-related crime are not necessarily mutually exclusive, and need not occur in isolation. Just as an armed robber might steal an automobile to facilitate a quick getaway, so too can one steal telecommunications services and use them for purposes of vandalism, fraud, or in furtherance of a criminal conspiracy.1 Computer-related crime may be compound in nature, combining two or more of the generic forms outlined above.

The various activities of Kevin Mitnick, as described in Hafner and Markoff (1991) are illustrative.

Problem areas

• Telecommunications

• Electronic vandalism, terrorism and extortion

• Stealing telecommunications services

• Telecommunications piracy

• Pornography and other offensive material

• Telemarketing fraud

• Electronic fund transfer crime

• Electronic money laundering

Legal areas

Here are just a few rhetorical questions about the law relating to search and seizure of electronic evidence. These were formulated in October 1998 at a special expert working group meeting convened in Tokyo under the auspices of the United Nations and with the involvement of the Australian Institute of Criminology.

(a) Investigative issues

(i) Does the law distinguish between the search and seizure of stored data in a computer, and the interception of data that is being communicated from one computer to another or within a computer system?

(ii) Can a person voluntarily provide law enforcement agents with electronic data that may afford evidence of a crime? Can a person voluntarily permit law enforcement agents to undertake a search for such data, rather than provide it to them? Could continuing cooperation of this nature by a person with law enforcement have a legal effect on the ability of law enforcement to obtain or use the data?

(iii) In most jurisdictions, the ability of law enforcement to obtain data that may afford evidence usually requires some form of prior judicial approval. What legal authority is required for obtaining electronic stored data without the consent of the persons concerned?

(iv) Electronic data under most jurisdictions is considered as being intangible. The law of some jurisdictions may only permit seizure of tangible material. In such cases, intangible data can only be obtained by seizing the physical medium (e.g., data on diskette or other storage medium) on which the data is stored and found. Do your nation's laws provide for the seizure of intangible data without seizure of the physical medium which it is found?

(v) In some cases, the precise location of electronic data within a computer system may not be apparent. How specific must be the description in the judicial authority (e.g., search warrant) of the place to be searched or the data to be seized?

(vi) In most jurisdictions, the scope of a warrant should be as narrow as possible. The precise location of the electronic data may not be immediately apparent at the time a warrant is sought, or even when law enforcement agents arrive at the scene. Does the law provide guidance on whether to seize the entire computer system, or merely one or more of its components? What practical criteria do law enforcement use to make this decision? How would this be done in practice?

(vii) Does your law obligate a suspect or a third person to provide access (including passwords) to a computer system that is the target of a lawful search? If not, what practical measures or tools can be employed by law enforcement to gain access?

(viii) Seizure of, or during the course of a search the shutting down of, an entire computer system may be extremely intrusive, and particularly burdensome to an ongoing business. What practical circumstances would justify seizing or shutting down a complete system rather than merely taking a copy of the data? Does the law provide for copying of relevant data as an alternative to seizure, and can the copy be regarded as admissible evidence? Would the law permit the seizure of the entire data base for the purpose of subsequently identifying the relevant data? What practical means can be used to copy large volumes of data?

(ix) In the course of a search, law enforcement authorities may come across incriminating data related to the crime under investigation, but which was not originally specified within the scope of the warrant. Can this data be legally seized without obtaining another warrant?

(x) In the course of a search, law enforcement authorities may come across electronic data relating to a crime different from that which is under the current investigation. Can this data be legally seized without obtaining another warrant?

(xi) Does the law permit seizure of data, without a warrant, under exigent circumstances, such as when there is risk of erasure or destruction of data? Alternatively, are law enforcement agents able to secure the premises or computer system, pending the obtaining of a warrant?

(xii) In some cases, the data sought may be located on another computer system that is networked to the system currently being searched. Does the law permit an extension of the search into the connected system in order to search and seize relevant data within the scope of the warrant? Can the warrant include an authorization to extend the search to the connected system? Alternatively, can law enforcement obtain a second warrant to extend the search from one system to the other?

(xiii) Are there any circumstances under which the law permits stored data to be obtained by means of a judicial order to deliver such data to law enforcement authorities, as opposed to the law enforcement authorities themselves searching and seizing it?

(b) Stored transaction data

(i) Records of service use, also known as transaction data, may be kept by some telecommunication carriers and internet service providers. Some carriers or ISPs may, for business or security purposes, retain such data for a period of time. In some jurisdictions, the cooperation of Internet service providers (ISPs) in identifying suspects may be obtained informally. Can this data be voluntarily provided to law enforcement agents by carriers and service providers? Does the law provide a means by which this data can be compulsorily obtained by law enforcement authorities?

(ii) Which types of transaction data does law enforcement require? Which types of transaction data do telecommunications carriers retain? For how long do the carriers or ISPs retain such data? Are there any laws or regulations which require them to retain such data, or to dispose of it after a certain period of time?

(c) Electronic communications

(i) Does the law permit law enforcement to collect current or future transaction data (including the source or destination of communications)? Can this authority for collection of current and future transaction data be achieved by satisfying legal conditions less onerous than that required to intercept the content of communications? What practical or technological means can be used to collect such data? Does law enforcement have the capability to undertake such techniques?

(ii) Even when one is able to determine the location from which a communication originates, identifying the human source of the communication may prove to be challenging. What legal and/or technological tools are available for this purpose?

(iii) How is the ability to collect such current or future transaction data affected if the communication crosses jurisdictional borders, including international borders?

(iv) Does the law permit interception of communications for the purpose of obtaining their content? Does the law permit this interception in respect of communications between computer systems or their components, as well as between persons? Does law enforcement have the practical capability to undertake such investigative techniques?

(v) In some cases, search or interception may be more efficiently and more effectively carried out by representatives of the telecommunications or ISP industry rather than law enforcement personnel. Does the law provide authority or obligation for private organizations or individuals to engage or assist in interception or search on behalf of the state? How does this affect the admissibility of the data as evidence in judicial proceedings? If there is no such authority or obligation, are there trained law enforcement personnel to undertake this task, and how would they do so?

(d) Analysis of data

(i) What legal, practical or technical means are available to preserve the data seized or intercepted in order to ensure its presentation and admissibility in judicial proceedings? What procedures should be followed?

(ii) If the data seized are encrypted, what legal, practical or technical means are available to allow law enforcement to decrypt data? Does law enforcement have legal authority to decrypt seized data using technical means? Can an order be sought from a judicial authority to compel decryption by the suspect or a third person? Can an order be sought to compel a suspect or a third person to hand over the encryption key or algorithm to law enforcement?

(e) Human rights and privacy safeguards

(i) Can a person to whom compulsory measures are applied, as above, challenge the lawfulness of such measures before a court, either before or after execution?

(ii) What legal protections exist for law enforcement agents who are undertaking a coercive investigative measure such as a search and seizure, or interception?

(iii) Which types of remedies may be ordered by a judicial authority?

(iv) How would such remedies be obtained or enforced in the context of a trans-border search?

(v) To what extent would legal protections or immunities apply to law enforcement from another country who are undertaking a trans-border search in your country?

What do to protect your dealership, and recommend that you consider the following protections:

• Establish commercially reasonable security agreements with your bank concerning EFT transactions (such as a call-back procedure). • Limit the number of check signers. • Perform daily bank reconciliations. (Some notification requirements to the bank of defalcations are only 24 hours or you’re totally on the hook.) • Sign up for bank-provided software (it’s surprisingly inexpensive) that prevents an unauthorized outsider from tapping your account with an ACH debit. • Sign up for positive pay capability (also surprisingly inexpensive), which is a process whereby only those checks you electronically communicate on a batch basis to the bank are paid by the bank. • Effectively use your available ACH password-level controls. • Establish the separate “locked” floor plan offset account. • Reconsider whether it’s worth the fraud risk to leave large amounts of excess cash in the dealership. (Keep in mind that these funds are also at risk for a potential court imposed freeze if a serious litigation storm hits the corporation). • Seek out higher dishonesty insurance coverage on check signers or anyone else with cash-handling or accounting responsibilities.
Conclusion

Dealers are particularly vulnerable to EFT fraud, if reasonable protections are not in place. Our discussions with bankers indicate that EFT fraud is a current “hot topic” in their industry and that they are very interested in meeting with their customers and assisting them in considering various protections available to minimize fraud risk. Our experience is that many CPAs and bankers aren’t well-versed on the subject of EFT fraud exposure and what a dealer can do about it. We feel our firm is in a position to assist you in discussing these matters with your bank and to help you in evaluating other internal controls that can be implemented on a cost-efficient basis.

CYBERCRIME LAW