-- Back to Table of Contents --
Over the past 6 years, the Federal Reserve has reported that check volumes have been in steady decline. The 2004 Federal Reserve Payments study revealed another turning point in history where the number of electronic payments surpassed paper check payments. In 2003, the number of electronic payment transactions last totaled 44.5 billion - exceeding the number of checks paid, 36.7 billion.(1) The interesting fact is that check dollars are not declining at anywhere near the same rate as the number of checks paid.
In 2004, the ACH network accounted for more than 12 billion transactions, a 20% increase over 2003.(2) The growth in ACH payments is a rapid and marked change in payment behavior that presents a new fraud risk for both consumers and businesses - the risk of ACH debit fraud.(3)
It is agreed that paper checks will remain a major form of payment for businesses and consumers alike for a very long time, and that the risk for check fraud continues to rise annually despite declining check volumes. The annual dollar volume of checks remains high, indicating that higher dollar transactions are still taking place via the paper check. We may be approaching an environment where creating checks will require the level of controls used for wire transfers, simply because of the dollars involved.
Payment behavior is changing, and it is due in part to the risks and fees associated with paper check payments. The 2005 Diamond Cluster Report, Banking on Payments, is an excellent resource on payments history and an educated perspective on where the industry is going. (http://www.diamondconsultants.com/PublicSite/ideas/perspectives/downloads/INSIGHT - Banking on Payments_single.pdf)
The report explains that processing fees for various forms of payment will continue to be the driving force behind what forms of payment businesses will choose to accept and use. (4)
"If the cost of payment processing technology has declined and the volume of payments has soared, why haven't banks reduced interchange fees?" These words from Daniel Olstad, Director of Payments at Best Buy Co. Inc, are being echoed by major retailers across the country. Wal-Mart along with other large businesses won a $3 billion, precedent-setting lawsuit in 2003 against VISA and Mastercard over fee contentions. (4)
The increasing popularity of plastic payment adds fuel to the concern over interchange fees. Businesses pay the following average transaction processing fees on a $100 purchase:
| Signature Debit |
$1.12 | |
| Credit Card | $1.87 | |
| PIN Debit |
$0.46 (4) |
Aside from retailers encouraging the use of PIN debit cards, they are also aggressively converting check payments to ACH at the point of sale (POS) to reduce their interchange fee overhead. The latest technology is creating a power shift from banks to businesses. (4)
With ARC conversion technology, businesses can continue to offer consumers the convenience of accepting checks but not incur the average $3.00 processing cost. Businesses pay just pennies for an ACH payment.4 Conversion types include ARC, POP and RCK. Annual ARC volume alone grew by more than 1 billion payments and accounted for 54% of ACH growth in 2004. (2)
Businesses have also begun looking to companies like Debitman, which launched a national debit card POS network offering reduced processing fees in 2001. Debitman was inspired by a similar operation in Germany that processes half of the country's debit transactions with zero fees. (4)
Other companies take the path of trying to control their destiny with private label credit cards . (4)
What does all this mean for banks? Bank revenue from consumer payments is now at risk. Lower-priced payments also leave little or no room for covering payment risks and any significant losses.
The future of transaction processing fees largely lies with what happens at the point of sale. Banks face a challenging future that is not entirely in their control, with emerging technologies that will affect the payments landscape in unexpected ways. (4)
Banks must find ways to effectively manage the competing silos they house to maximize bank revenue. The optimal collective path is not clear as it relates to products, services and pricing for their check processing, credit, debit and ATM units. Banks individually will need to develop global strategies for how their silos will work together to add value and reduce risks for businesses and their customers. (4)
With check volumes declining, the check processing business is ripe for consolidation among some of the largest banks and external players. Regional and small banks may decide Check 21 investments for processing any kind of check - electronic or paper - makes little sense. Some may opt for less expensive technology intended solely to accept electronic images and then outsource their paper check processing. (4)
Large banks, however, can actually consider making a profitable investment in Check 21 imaging and processing technology. Banks that can get large retailers to invest in imaging technology at the point of sale will reap the benefits of fewer touch points and costs associated with paper checks. (4)
The growth of online banking is another obvious shift in the payments landscape. Consumers and businesses alike are finding the web a convenient vehicle for transactions, account reporting, and financial management. Balancing client information security and convenience has become a focus for all banks.
Banks are also now approaching next-generation online services where HTTPs is no longer considered secure enough for the services being rolled out. New secure transfer communications are being investigated and introduced.
Payments processing does account for up to 40% of all banking income. (4) Another source of significant revenue for banks is generated from their treasury offering to corporate clients. Again technologies are emerging that enhance treasury products and services by making them easier to implement and more convenient to use. In a competitive marketplace, banks of all sizes are seeking the technologies that reduce bank and client risks associated with implementation and, in turn, increase revenue opportunities.
Until now, all customer-based reporting services have been relatively similar; new technology enhancements can improve the customer-bank relationship. Previously information was delivered to the desktop and possibly to programs like Excel; tomorrow's services will tie directly to the client's AR, AP and ERP systems. Failure to offer clients state-of-the-art information delivery will leave lesser banks in a noncompeting position.
-- Back to Table of Contents --
In this evolving payments landscape, one thing remains certain, criminals continue to find ways to profit from payment methods that leave room for fraud.
Just take a look at paper check fraud. It continues to rise despite declining check volumes. According to the latest statistics from the 2003 Nilson Report, check fraud now costs U.S. businesses in excess of $20 billion annually. (5)
According to the most recent ABA Deposit Account Fraud Survey, attempted check fraud rose by a sweeping 28% in 2003, with criminals attempting to cheat businesses out of $5.5 billion (an increase of $1 billion dollars from when the last survey was conducted in 2001). (6)
With respect to deposit accounts, ABA survey respondents indicated that identity theft was the leading threat against the industry, with check fraud being second, followed by the internet. (6)
The AFP Payments Fraud and Control Survey, dated March 2005, gave a revealing look at the types, frequency, and costs of payments fraud today. Of the 256 member organizations that responded to the survey, 55% indicated they had been victims of some type of payments fraud in 2004. Four out of five of these organizations indicated that their highest dollar fraud resulted from checks, as compared to 8% reporting credit cards caused their highest dollar fraud, and 5% reporting ACH debits. (7)
Checks remain the most likely vehicle for payment fraud attacks, with 94% of the organizations that reported fraud indicating that they had been victims of check fraud in 2004. (7)
Survey results also show that fraud comes at a high price. For organizations reporting fraud, the median dollar amount for all payments fraud was $26,600. (7)
For more information on payments fraud see Apendix B: AP Technology Special Report on Payments Fraud Statistics
Actually, the number of checks being issued is decreasing at a much slower rate than the number of checks being processed, which means that most check processing volume statistics do not give the full picture on the number of checks in circulation that are available to be acted upon fraudulently. (8)
The paper check continues to be a very popular form of payment, and this will not change any time in the near future.
". check usage isn't expected to go away anytime soon. Check payments remain particularly popular in transactions between businesses. A survey released yesterday by the Association for Financial Professionals, a trade group, found that more than 75% of business-to-business transactions are made with paper checks."
- Robin Sidel, The Wall Street Journal, October 28, 2004
The availability of low-cost desktop publishing software, printers, and copiers, in addition to pressures on banks to clear checks quickly, makes the paper check an easy target for criminals. The predominant types of check fraud affecting banks and their clients include forgery, NSFs, counterfeiting, closed accounts, kiting, stop payments, and alterations.
The question of who is liable for check fraud is spelled out legally in the Uniform Commercial Code (UCC). Most often courts determine that both the bank and their client share some level of liability for fraud losses.
Although open to judicial interpretation, businesses and banks alike should be fully aware of their rights and responsibilities with regards to check fraud as explained in the UCC.
We have had a long time to implement effective measures to prevent various forms of paper check fraud. Check imaging or electronification, however, opens a new frontier for fraudsters who will now try to access and alter digitized information.
The Check Clearing for the 21st Century Act (Check 21) took effect on October 28th, 2004. It allows banks, if they choose, to remove an original paper check from the check collection or return process and utilize a substitute check (Image Replacement Document - IRD) without delivering the original check. The purpose of Check 21 was to enhance the efficiency of check payments processing and clearing, and to prevent a recurrence of a payments bottleneck that occurred just after the September 11, 2001 terrorist attacks and shut down our nation's airline system. (4)
"Under a federal law that will take effect today, banks will have more leeway to process checks electronically, and this will translate to shorter or even nonexistent float times - the grace period between the time the check is written and when the money is debited from the account."
- Jennifer A. Kingson, New York Times, October 28, 2004
Check 21 will most likely decrease some types of fraud such as bad check-writing schemes that rely on lengthy float time.
However, the general consensus is that Check 21 will actually result in increased check fraud, for many reasons:
"Payments are going to be in an evolving environment that the world hasn't seen for quite some time" says Steve Hill, managing principal of the global payments consulting division at Carreker Corp. Hill believes that the Check 21 changes will bolster positive pay - the strongest protection against check fraud being employed by companies today. (10)
Checks processed through Check 21 technology may be disputed by businesses for only 30 days. (4)
With ACH payments now surpassing paper check payments, everyone agrees that containing ACH fraud is a growing concern. The availability of low-cost software makes fraudulent ACH transactions readily possible for criminals. (3)
A party really only needs two pieces of information to initiate an ACH transaction, the routing number of the payor's bank and the payor's account number. (3) In affect, a company without proper internal controls may remain unaware that a fraudulent debit has been made on their account for many months, and by current rules this may make it impossible for a company to regain lost funds.
There are three types of ACH payments that allow billers to originate ACH debits to consumer accounts using info from their check. At this time, this does not apply to business checks, but may likely apply in the near future. Also, the biller would not know if a criminal presented a stolen consumer or commercial check. (11)
Much of the fraud problem seems to be stemming from ARC, WEB and TEL transactions:
According to 2003 statistics, the aforementioned transactions carry a 14-17% payment rejection rate, as compared to a 2% rejection rate for more conventional business-to-business, consumer-to-business, or business-to-consumer transactions. (3)
There are a number of defenses that banks should encourage their corporate clients to implement to combat check, ACH and other forms of payments fraud. The AFP Payments Fraud and Control Survey makes it clear that larger organizations are much more likely to have implemented these techniques than smaller organizations. 88% of the organizations surveyed have already taken the step to implement positive pay or reverse positive pay, and 71% use ACH debit blocks of some kind. (7)
Following is a valuable checklist of today's best practices that will reduce any organization's exposure to check and ACH fraud:
Banking clients are welcome to take a Check Fraud Risk Assessment by visiting http://www.acuprint.com/for/cfra/ to receive a quick overview of their organization's strengths and weaknesses with regards to check fraud prevention planning.
-- Back to Table of Contents --
To comply with recent legislation, public companies and/or banks have been reviewing and documenting their processes to assure the accuracy, security and privacy of their information. The effort to comply can be a harrowing undertaking, and the path is not defined with exactness, but the end result will likely be a reduced risk for fraud. Following is a top-level overview of the most recent laws, outside of Check 21, along with a general explanation of their impact on banks and businesses.
Sarbanes-Oxley legislation was enacted July 2002 to regulate financial practice and corporate governance with stringent rules designed "to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws." It is also meant to "deter and punish corporate and accounting fraud and corruption, ensure justice for wrongdoers, and protect the interests of workers and shareholders." (Quote: President Bush). (13)
The Sarbanes-Oxley Act was prompted in large part by a series of high-profile scandals. The act is comprised of eleven segments, however, Section 404 seems to be raising the most concern as to how to comply. (13)
In very quick summary, Section 404 requires:
SOX compliance requires aligning a company's personnel and operations with the key components of the Enterprise Risk Management Framework (ERM Framework). The Committee of Sponsoring Organizations (COSO) of the Treadway Commission has recently released (Sept. '04) their final ERM Framework report that has become recognized by the SEC as the critical methodology for Sarbanes-Oxley Section 404 compliance. (15)
Quotes from Jerry Rehfuss, a Finance Director at Kimberly-Clark, when asked in July 2003 about SOX requirements:
"In other words, CEOs and chief financial officers who are signing off on the validity of data must be sure that the systems maintaining that data are secure. If their systems aren't secure, then their internal controls are questionable and those executives could face criminal penalties if a breach is detected. Perhaps this presents another good thing about the Sarbanes-Oxley Act: Security technology is no longer just an IT matter; it's an organizational and an integrity issue to be reckoned with at the executive level."
"I am not adverse to doing work, but this was one of the biggest pieces of corporate regulation that's come in decades."
"You cannot have compliance without ensuring, through technological means, that the integrity of the corporation's financial records is intact. The internal controls mandated by Sarbanes-Oxley call for a strict set of access controls to be put into place that regulates who has access to what information."
The Sarbanes-Oxley Act puts in the foreground the need for companies to have mechanisms in place that assure security with regards to IT transmissions and accounting. The language of SOX issues in a new age of responsible and accountable practices that will help to prevent fraud.
To reiterate, it is not just about companies implementing best practices, but about creating accountability through our court system if companies fail to proactively seek out and implement the practices and solutions that could have prevented security breaches.
The way to comply with SOX remains vague and is a topic of current discussion, but clearly any solution will meld internal security practices with best-of-breed technology. SOX raises the bar for all public companies by requiring accountability, reporting that accountability, and the safeguarding of information integrity.
Senator Phil Gramm, Chairman of the Senate Committee on Banking, Housing and Urban Affairs, issued the following statement regarding the Gramm-Leach-Bliley Act:
"I believe we have passed what will prove to be the most important banking bill in 60 years. It overturns the key provision of the Glass-Steagall Act that divided the American financial system."
"Finally, we met the legitimate privacy needs of Americans by guaranteeing that every bank must tell every customer what its privacy policy is, by assuring that every customer can opt out by changing to another bank, if they don't like how they are treated, and by requiring that any bank which is considering use of our private information outside the institution give us an absolute right to simply say 'no.' This is the strongest privacy policy provided in American history, but also one that will not destroy the information age before it begins." (16)
Title V of the Gramm-Leach-Bliley Act addresses how banks must protect the privacy of customer information:
The Act requires all financial institutions, regardless of whether they form an FHC, to disclose to customers their policies and practices for protecting the privacy of non-public personal information. The disclosure, which customers would receive at the time of establishing the relationship and at least annually thereafter, would allow customers to "opt-out" of information sharing arrangements with non-affiliated third parties. The Act does permit financial institutions to share personal customer information with affiliates within a holding company. (16)
It is considered a criminal offense for any person (including firm employees) to obtain or attempt to attain customer information relating to another person from any financial institution by making a false or fraudulent statement to an employee of that financial institution. (16)
No. Section 313.12 generally prohibits disclosure of credit card, deposit, or other transaction account numbers "for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer." (16)
Financial institutions are already largely compliant with the requirements of this Act.
As the Patriot Act was passed on October 26, 2001 there was a focus on securing U.S. funds from terrorism. By taking away the money that terrorists used, they would be unable to continue their activities in an organized manner. The end result has been an enhancement to overall account security and fraud prevention efforts.
The Patriot Act requires that financial institutions develop procedures to account for all relevant risks, including those presented by the types of accounts they offer, the various methods of opening accounts, the type of identifying information needed, and the financial institution's size, location, and type of business or customer base. Thus, specific minimum requirements in the Act, such as the basic types of information to be obtained from each customer, are often supplemented with risk-based verification procedures to ensure that the financial institution has reasonable assurance of each customer's identity.
U.S. Attorney Johnny Sutton for the Western District of Texas, writes:
"Like all Americans, I hold dear our freedom from unwanted government intrusion into our private lives. As a people, we have always recognized that greater freedom may be accompanied by somewhat diminished security. As recent events have shown, terrorism poses a serious threat to both our security and freedom."
"The Patriot Act strikes a reasonable and sensible balance between freedom and security to meet the real dangers we face. The act provides the essential means we need to defend ourselves against terrorists while maintaining and protecting the civil and constitutional rights we cherish."
Banks and businesses are watching as the payments industry goes through a rapid transition, and the true industry leaders will be the ones that seek and define the best ways to parlay the risks and opportunities associated with these changes.
Electronic payments are replacing paper check payments, and it is agreed that interchange fees and POS technology will continue to be important factors guiding a shifting payments landscape. With a declining number of checks, but large check dollar volumes remaining, consolidation within the check processing industry is expected. Online banking for businesses and consumers alike will thrive, and the banks that strike the right chord with secure and convenient offerings will have the greatest success.
Banks and businesses today will implement proven technologies that:
It is agreed that the increasing complexity of the payments industry has, if anything, created new opportunities for fraud. Both check fraud and electronic payments fraud are growing concerns. In most cases, the risk premium for fraud is not included in standard bank payments pricing.
Banks and businesses that implement the best internal practices and technologies for fraud prevention will be the ones that are prepared to effectively protect themselves from fraud and its liabilities.
Implementing appropriate technologies is an important part of Risk Management planning for banks and businesses. AP Technology solutions reduce the risk for check fraud and provide secure access to banking information for your corporate clients.
9 of 10 leading U.S. banks have positive pay partnerships with AP Technology. In fact, the SecurePay solution is the world's best-selling positive pay conversion and auto-transmission software available today.
AP solutions are also helping customers attain compliance with the latest legislative demands.
Positive Pay File Creation
Improved Client Access and Web Usage
Accelerated Client Implementation and Reduced Transcription
Check and Form Printing
For more than 17 years, AP Technology has developed and installed secure payment solutions for businesses and banks throughout North America. As a private California corporation founded in 1989 (as AcuPrint, Inc.), AP Technology pioneered the development of secure and cost-effective MICR laser check printing software and hardware solutions. The company has emerged as a leading provider of innovative software and web-based technologies that connect banks with their business clients.
In 1998, the company introduced SecurePay, the first client-based, universally-compatible positive pay software solution for use with a bank's existing positive pay services. To date, over 2,000 copies of SecurePay have been installed.
In 2005, AP Technology released SecurePayWEB, an online positive pay file conversion service that allows business clients to rapidly implement their bank's positive pay services without installing any software.
Now all businesses, both large and small, can receive the risk management advantages of positive pay through several economical alternatives from AP Technology.
Donovan Perkins
SVP, Business Development
760-602-5423
donovan.perkins@aptechnology.com
John Cipriano
SVP, Financial Services
760-602-5427
john.cipriano@aptechnology.com
Corporate Headquarters Address
AP Technology
5973 Avenida Encinas, Suite 140
Carlsbad, CA 92008
800-258-5901
www.aptechnology.com
To order this document in .pdf format, please contact:
Jessica Andrews - 760-602-5424
jandrews@acuprint.com