By: Kristan Keelan Most financial institutions are well underway in complying with the FTC’s ID Theft Red Flags Rule by: 1. Identifying covered accounts 2. Determining what red flags need to be monitored 3. Implementing a risk based approach However, one of the areas that seems to be overlooked in complying with the rule is the area of commercial accounts. Did your institution include commercial accounts when identifying covered accounts? You’re not alone if you focused only on consumer accounts initially. Keep in mind that commercial credit and deposit accounts also can be included as covered accounts when there is a “reasonably foreseeable risk” of identity theft to customers or to safety and soundness. Start by determining if there is a reasonably foreseeable risk of identity theft in a business or commercial account, especially in small business accounts. Consider the risk of identity theft presented by the methods used to open business accounts, the methods provided to access business accounts, and previous experiences with identity theft on a business account. I encourage you to revisit your institution’s compliance program and review whether commercial accounts have been examined closely enough.
By: Kristan Keelan What do you think of when you hear the word “fraud”? Someone stealing your personal identity? Perhaps the recent news story of the five individuals indicted for gaining more than $4 million from 95,000 stolen credit card numbers? It’s unlikely that small business fraud was at the top of your mind. Yet, just like consumers, businesses face a broad- range of first- and third-party fraud behaviors, varying significantly in frequency, severity and complexity. Business-related fraud trends call for new fraud best practices to minimize fraud. First let’s look at first-party fraud. A first-party, or victimless, fraud profile is characterized by having some form of material misrepresentation (for example, misstating revenue figures on the application) by the business owner without that owner’s intent or immediate capacity to pay the loan item. Historically, during periods of economic downturn or misfortune, this type of fraud is more common. This intuitively makes sense — individuals under extreme financial pressure are more likely to resort to desperate measures, such as misstating financial information on an application to obtain credit. Third-party commercial fraud occurs when a third party steals the identification details of a known business or business owner in order to open credit in the business victim’s name. With creditors becoming more stringent with credit-granting policies on new accounts, we’re seeing seasoned fraudsters shift their focus on taking over existing business or business owner identities. Overall, fraudsters seem to be migrating from consumer to commercial fraud. I think one of the most common reasons for this is that commercial fraud doesn’t receive the same amount of attention as consumer fraud. Thus, it’s become easier for fraudsters to slip under the radar by perpetrating their crimes through the commercial channel. Also, keep in mind that businesses are often not seen as victims in the same way that consumers are. For example, victimized businesses aren’t afforded the protections that consumers receive under identity theft laws, such as access to credit information. These factors, coupled with the fact that business-to-business fraud is approximately three-to-ten times more “profitable” per occurrence than consumer fraud, play a role in leading fraudsters increasingly toward commercial fraud.
We know that financial institutions are tightening their credit standards for lending. But we don’t necessarily know exactly how financial institutions are addressing portfolio risk management -- how they are going about tightening those standards. As a commercial lender, when the economy was performing well, I found it much easier to get a loan request approved even if it did not meet typical standards. I just needed to provide an explanation as to why a company’s financial performance was sub-par and what changes the company had made to address that performance -- and my deal was approved. When the economy started to decline, standards were suddenly elevated and it became much more difficult to get deals approved. For example, in good times, credits with a 1.1:1 debt service coverage could be approved; when times got tough – and that 1.1:1 was no longer acceptable – the coverage had to be 1.25:1 or higher. Let’s consider this logic. When times are good, we loosen our standards and allow poorer performing businesses’ loan requests to be approved…and when times are bad we require our clients perform at much higher standards. Does this make sense? Obviously not. The reality is that when the economy is performing well, we should hold our borrowers to higher standards. When times are worse, more leniency in standards may be appropriate, keeping in mind, of course, appropriate risk management measures. As we tighten our credit belts, let’s not choke out our potentially good customers. In the same respect, once times are good, let’s not get so loose regarding our standards that we let in weak credits that we know will be a problem when the economy goes south.