So this is Fraud Awareness Week, and what have you done? That may not be a line from a John Lennon song, but I want to make a similar point to Lennon and Ono’s “Happy Xmas (War Is Over)”. At this time of year we could engage in a mutual celebration, slapping each other on the backs as we commend ourselves for how much we care about fraud. Or we can ask what we have done to make the world even slightly better than it was 12 months ago. International Fraud Awareness Week, a creation of the Association of Certified Fraud Examiners (ACFE) certainly achieves its stated goal, which is to promote public awareness of fraud. My question is simple: why is so much effort going into promoting awareness, when so little is being directed towards more effective ways of fighting fraud?
This is the ACFE advice on how to get involved in this year’s Fraud Awareness Week, and it reads just like the advice they gave during every previous Fraud Awareness Week.
- Put up a poster.
- Arrange an audience for a speaker who has passed an ACFE exam.
- Download the logo for Fraud Awareness Week and put it on a website.
- Get somebody or other to spread tips on fraud prevention for small businesses.
- Get somebody else to proclaim their support for fraud prevention week.
- Arrange a different audience and do a fraud prevention talk yourself.
- Do a fraud ‘check-up’ for your organization.
- Share the Fraud Prevention Week hashtag on social media.
Excuse me if I do not expect hardened criminals to be concerned about the threat posed to their income by logos, hashtags, posters and proclamations. The only serious advice is to check the quality of anti-fraud controls in your organization, and I would argue it sets a bad precedent to expect to do this only once a year.
I am not suggesting it is unproductive to raise public awareness of fraud. Everyone should be aware of fraud just like everyone should be aware of potential terrorists active in their community, and aware of the risks of lumps in their breasts. But asking for more awareness is of secondary importance to employing intelligence professionals to monitor terrorist organizations, or employing health professionals to conduct systematic screening for breast cancer. The same is true for fraud prevention. A real fraud prevention week would demand the following.
- Implement and offer two factor authentication for every service that customers access remotely, with no exceptions.
- Switch from SMS or email 2FA to a stronger second factor for any service of more than trivial value.
- Use legislation to force the adoption of robust anonymous whistleblowing procedures in every organization, and to protect whistleblowers from reprisals.
- Train more police officers to do serious and lengthy investigations of organized fraudsters.
- Reduce the reliance on the private sector to fund anti-fraud police work; fraudsters do not pay taxes like honest businesses do!
- Make greater use of existing powers that allow law enforcement to confiscate the wealth accumulated by fraudsters.
Why are we not implementing these six important steps that would have a dramatic impact on the level of fraud suffered by law-abiding businesses and citizens? Because they cost money and they are unpopular. In contrast, downloading logos and putting up posters is cheap and popular. Public awareness campaigns only serve a useful purpose in the context of crimes that are widespread and persistent. Relying on public awareness campaigns is hence an admission of failure.
Fraud professionals are already aware of the hard choices that need to be made, but educating the public is easier than tackling stubborn decision-makers who refuse to put sufficient resources into fighting fraud. Improvements in technology could potentially be harnessed to prevent many types of fraud, if we have the will to implement those technologies. Doing this will protect the public, even if they do not understand they are being protected. Often we do not implement anti-fraud technology because we do not want to inconvenience customers or members of the public.
These are the reasons why I say we need the opposite of International Fraud Awareness Week. Perhaps it might be called International Fraud Action Week instead?