Financial institution employee fraud schemes last a median of 18 months beforedetection, with a median loss of $140,000, said CUNA Mutual SeniorRisk Management Consultant Roger Nettie during a breakout sessionWednesday morning at CUNA's America's Credit Union Conference inNew York.

According to the 2012 Global Fraud Study conducted by theAssociation of Certified Fraud Examiners, more than one-fifth ofthese caused losses of at least $1 million.

Also from 2013 ACUC:
DataCan Give Competitive Edge
Indirect Lending Debate Shifts Views
Gladwell Says Press the Competition

“The longer a perpetrator works for an organization, the higherfraud losses tend to be,” Nettie said. “CUNA Mutual Group claimsrecords show that over a five-year period, employee dishonestyrepresented just 13% of fraud claims, but 45% of fraud losses.”

Many credit unions believe their employees are all trustworthyand that they have strong enough internal controls to preventinternal theft from occurring, he said.

Yet, it still occurs.

“Fraud does not discriminate. There is no immunity to thisexposure based on geography, asset size, employee tenure, or pastexperience,” Nettie said.

Another growing area of direct losses is wire fraud, especially from HELOC accounts, with credit unionsreporting more than $25 million in losses from 2007 to 2012, hesaid. The average reported loss in 2012 was $175,000, with someapproaching $1 million. “Credit unions experiencing lossesgenerally had inadequate security for large-dollar transfers,enabling crooks to easily defeat callback security measures,”Nettie said.

Consequently, CUNA Mutual Group implemented new terms with itsfunds transfer coverage to encourage additional controls for remoterequests, and discourage the practice of accepting large-dollarremote requests.

Nettie offered a number of recommendations to limit wire fraud,such as spotting fraud red flags and using layered levels ofsecurity.

In addition, electronic crime continues to cause direct lossesthrough computer malware and money mules that illegally transfermoney on behalf of scam operators, typically in anothercountry.

Nettie said prevention measures such as cookies, devicerecognition, Internet protocol and challenge/response questionshave limited effectiveness. As alternatives, he suggestedout-of-band authentication, hardware tokens, digital certificatesand biometrics.

Liability losses for credit unions continue to be led byemployment practices liability claims and subsequentlitigation.

“EPL losses make up nearly two-thirds of all of CUNA MutualGroup Management and Professional Liability losses, with the mostcommon allegations being wrongful termination, retaliation, andrace and gender discrimination,” he said.

Nettie suggested credit unions have updated policies andprocedures reviewed by legal counsel and provide regular stafftraining.

Finally, Nettie discussed the growing incidence of costly lenderliability claims, which generally allege the credit union failed tofollow state law requirements in their Notices of Intent to sellrepossessed property and Notices of Deficiency letters.

“Usually, this is a case of you getting sued by your worstborrower and then having it mushroom into a class action lawsuit,”Nettie said. “It's vitally important to have your forms reviewedand approved by legal counsel for each applicable state, and trainemployees on how to properly complete the forms.”

The conference wrapped up Wednesday at the New York Hilton.