Government agencies around the globe are at risk from within. Just as in the private sector, more error and misuse occurs from internal employees and partners and suppliers than from anyone else. A recent study from Price Waterhouse Coopers indicates that the problem may be getting worse. According to the consultancy’s latest Global Economic Crime Survey, nearly half of organizations in the public sector have been hit by economic crime in the past 12 months. Cyber crime, employee and supplier fraud in particular are on the rise. The survey also found 46 per cent of respondents had experienced one or more incidents of such crime in the past year. That’s quite a jump from 37 percent in 2009 and considerably higher than the average of 34 per cent across all sectors.
Some of the other key findings from the survey are equally alarming:
• More than two-thirds of the crimes experienced in the past 12 months were committed by public sector employees, compared with just over half in 2009.
• Supplier fraud jumped from 13 per cent to 32 per cent over the same period.
• Over 50% of those surveyed said they had the resources to detect cyber crime, but most lack the forensic capabilities needed to investigate such incidents.
Source: 2011 Global Economic Crime Survey, PWC: http://www.pwc.com/en_GX/gx/economic-crime-survey/assets/GECS_GLOBAL_REPORT.pdf
Further, the study links this rise in activity to the cuts in public sector spending—a trend that is likely to continue and deepen if the current economic reality remains unchanged.
Government agencies are clearly struggling to address internal fraud. Their efforts are complicated by shifting compliance requirements, impaired visibility into user activity, legacy systems that house mission-critical processes, and the limited effectiveness of existing controls and traditional logging capabilities.

Information technology moves fast. Recent advances have led to streamlined business operations and innovative products and services. They have also opened up new avenues for fraud. Breach announcements disclosing information leaks and theft of privacy data are so commonplace, many of us turn a deaf ear to them and a blind eye to the underlying vulnerabilities they represent. But should we? What is it that these events actually represent?

In some cases, these incidents are the result of an outside-in attack. Worms, malware, phishing scams come to mind. However, it’s easy to overlook the insider threats that lurk in every business. No one likes to think that their trusted insiders–employees, contractors, consultants, and even trusted business partners–could be committing fraud and data abuse from within their systems. Frankly, it is an ugly thought. And, unfortunately, it’s a reality. The wide array of threats that businesses face often originate from the inside.

In today’s fast paced, connected business environments, anyone can exploit the privileges and knowledge they have acquired about business operations and practices to commit fraud, violate privacy protections, and steal valuable confidential information. Fortunately, detection and prevention practices and applications are adapting to the threats posed by malicious insiders.

As you consider your risk profile and how to mitigate such abuses within your own systems, consider the power of continuous monitoring and continuous audit. With the next-generation monitoring technologies, you and your auditors can have greater confidence that data is safe and protected, that your policies are actually being followed and that you can quickly spot “bad actors” intent on doing harm or introducing error.

Enterprise fraud and workplace policy abuse come in many forms, and every business is at risk.

 Unfortunately, it’s not always obvious when workplace fraud occurs. Perpetrators are often insiders – long-time employees or trusted staff members who have access to sensitive information.

 The very idea that these people would cheat you can be hard to accept. It may even be tempting to think, “It could never happen here.” But it could. And the less you do to prevent it, the more likely it is to occur.

 Workplace fraud could mean failed compliance audits, hefty fines, or irreparable damage to your brand. It could also mean a serious blow to your bottom line.

 So don’t let others profit unethically at your expense – take steps to stop them. Here are four common types of workplace fraud and some suggestions for avoiding an all-out fraud nightmare.

1. Accounting mischief

 If your accounts are vulnerable, employees can use them to their advantage. Think “skimming” small amounts of money from the tops of checks or taking unreported cash payments.

 When the amounts are small, this type of fraud can be hard to detect. And if you never perform any audits, it could be virtually untraceable. While internal audits are an option, they’re often difficult to conduct. Slinging together data in an attempt to create a complete audit trail can quickly become a nightmare.

 On the other hand, by bringing in external auditors, you’ll be able to keep your accounts in check. Make external audits routine, and you can prevent accounting fraud before it even starts.

2. Exchanged credentials

 Or falsified ones. With counterfeit documents, records, or licenses, scammers may seek employment at your organization. They may also use someone else’s credentials to gain access to your office or work facility.

 Don’t forget: In hiring, even one fake reference represents a serious case of fraud.

 Always call professional references, verify credentials, and conduct background checks of each new hire. After all, you should be confident in the employees who represent your organization, not suspicious of them.

3. Unauthorized data access

 The use of false credentials can also help employees access data that was never theirs to consume.

 When this happens, the privacy of your patients or customers – not to mention confidential business information – could be in jeopardy. And what if employees don’t even need to use false credentials? What if they’re accessing sensitive information because it’s already easy to do so without being caught?

 That’s why you must implement data-handling policies that specify who has access to what. Also establish a system for verification before anyone can access sensitive material. Things like passwords and account numbers should never be shared and, if possible, should be changed often.

4. The address swap

 This is what happens when an employee changes the address to which a check is sent – presumably to his or her own – and then changes it back.

 To combat this kind of fraud, conduct regular reviews of all purchases. Consistent audits of accounts and contracts will also help protect you. While you don’t want to create a culture of surveillance that makes employees feel like Big Brother is lurking behind every corner, audits and reviews should create an atmosphere of accountability.

 Because when employees are accountable for their actions, you’ll enjoy greater security.

 For more information about Enterprise Fraud Management, be sure to check back here on Insider Fraud Spotlight!

I was speaking with a friend the other day about Medical Identity Theft, HIPAA compliance and enterprise fraud management. We were discussing a survey report published in March by the Ponemon Institute that found roughly 1.5 million Americans are victims of medical ID theft. In the survey, fourteen percent of respondents said the breach occurred at a health care office, and 10% said employees at a health care organization’s office had stolen the data.

 It occurred to me that medical identity theft is one of those “wild west” opportunities for identity thieves at the moment. While everyone is pretty familiar with the concept of financial fraud and what happens when your credit card information is stolen, what happens when someone pretends to be you to access medical care can have far more devastating consequences.

According to the Federal Bureau of Consumer Protection, here are some indications that might indicate that someone has been a victim of medical identity theft. Victims may:

• get a bill for medical services they didn’t receive;
• be contacted by a debt collector about medical debt they don’t owe;
• see medical collection notices on their credit report that they don’t recognize;
• be told by their health plan that they’ve reached their limit on benefits; or
• be denied insurance because their medical records show a condition they don’t have.

Source: http://business.ftc.gov/documents/bus75-medical-identity-theft-faq-health-care-health-plan

Whoa—think about that for a moment. Those are significant impacts. Then, spin the scenario out a bit further. What happens if medical records become co-mingled at the provider level? Can you get to a point where the records of the thief are entered into the medical history of the victim? According to the experts, you can. Back in 2006, Pam Dixon, founder of the World Privacy Forum, referenced the challenges that medical identity theft can create and cited examples of misinformation appearing in patient files. She also stated that changes to patient records could remain in the files for many years.

Providers Protecting Privacy as Part of Their Healthcare Brand

Leading healthcare organizations are increasingly seeing ways to protect their brand while safeguarding patient privacy. Moving the privacy discussion beyond the HIPAA disclosure form that all of us sign when accessing care and making ePHI protection a differentiator demonstrates a commitment on the part of the provider. When given a choice, my healthcare dollars are spent with those institutions that care enough about me to protect my personal information. It just makes sense to require the same level of accountability from my doctor as I do from my bank—the risks are just as real and the opportunity for damage may even be greater.