December, 2012

In this Issue:
   Board Reporting
   by Barry Thompson
December is the seasonal time for security officers to report to the board of directors. Always provide a detailed written report noting equipment that has been retired, equipment that has been purchased, and the dates staff training was conducted. Most board members will not know exactly what the security officer does so remember to include an introductory paragraph that outlines the duty of the security officer.

Training Webinars

Personal Survival: 25 Rules to Live By
January 9
by Dana Turner
Statistically, one-fourth of all Americans will become victims of a violent act during their lifetime, either at home, at work -- or anywhere in between. Events like these happen every day and they can be used as "training tools." Everyone should learn simple, effective violence prevention and response tactics that can significantly reduce the likelihood of becoming a victim -- or at least increase a victim's chances of survival. This presentation will share twenty-five rules on how to navigate tricky survival decisions when faced with personal or workplace violence.
Enterprise-wide Information Security Risk Assessments 101
January 11
by Susan Orr
Risk assessments are a key focus of examinations today and are mandated by regulation. They are essential to an effective and appropriate risk management program and provide the basis for your security, audit, vendor management, and identity theft red flag programs, as well as for your business continuity plan. Many organizations are still a little unclear on what is meant by an enterprise-wide risk assessment. This presentation will provide an approach for developing an enterprise-wide information security risk assessment and a framework that can be adapted to the other numerous risk assessments now required or expected by regulators.

Welcome to the December issue of Security Spotlight
In this month's Security Spotlight, 'tis the season for board reporting tips, capturing thieves - on and off camera - security challenges, and joining in on some lively discussions in the BOL threads. We hope you have a safe, uneventful holiday!

Candid Escape and Candied Evidence
His minute of fame...A bank robber in Dallas, TX should have taken his cues from Jolly Old St Nick and tried the chimney for his escape after he broke into the American First National Bank on a Saturday afternoon when the branch was closed. Patty Hamilton, a professional photographer, was using the ATM at a neighboring bank when police, responding to the alarm, arrived on the scene and drew their weapons. Using her iPhone, Hamilton did what any good photographer would do - she began to video the incident. As she was recording, the alleged bandit attempted his escape through a broken window. Additional police arrived on the scene and the suspect was apprehended. Inside the bank, police found candy wrappers scattered on the floor, along with the suspect's wallet. We don't think he's going to escape a guilty verdict, especially with this incriminating evidence.

Eight banks or bust - Michael Patrick Downing was desperate, or at least that was the FBI's assessment of the thief who committed multiple robberies wearing different disguises such as wigs, mustaches and eyeglasses. Linked to at least seven bank robberies in California within the past three months, Downing was arrested shortly after his latest heist at the First Bank in Indio, California.

And in Shaker Heights, IL, Kevin Wolcott was busted attempting to pull off his eighth bank heist at PNC Bank. Effective training and quick action by bank employees, who activated the alarm while Wolcott was inside the bank, resulted in his prompt apprehension by police officers who were near the bank when the alarm was sounded. Wolcott and a female accomplice with him that day were arrested.

Now it's jail or bust for these serial sandbaggers.

Check our Bank Robbery page for photos and information on the latest robbery suspects. There are 42 unknown bank bandits featured in our suspects gallery for November. Of these, only two are not wearing sunglasses or hats to disguise their appearance. Enforcing a no hats, hoods and sunglasses policy could help reduce the number of bandits who target your bank. Get signs for all of your branches from the Banker Store.

Fatal Robberies and Fatal Losses

Information sharing - When your bank is robbed, do you share that information with other banks? If you hear of a nearby bank being robbed, do you verify your training is up to date? Consider the Chicago area where the "Stringer Bell Bandit" is thought to have robbed, or in one case attempted to rob, banks on eight occasions since October 10. He did rob one branch twice, less than two weeks apart. If you aren't sharing robbery information, perhaps this is a good time for all banks to reconsider this. If you are in the Chicago area, here is an image of the robber.

There is armed, and then there is heavily armed - The FBI is currently offering a $50,000 reward for information leading to the arrest of the "AK-47 Bandit." Last February this man entered a bank in Chino, CA, wearing body armor and carrying an AK-47 (or similar) assault rifle. He demanded cash and left. While he was fleeing the scene, he encountered a police officer, who ended up being shot and seriously wounded. A 911 call containing a threat made from a pay phone is believed to have been a diversion by this robber. He is also suspected in similar robberies near Sacramento and Washington, and has been linked to a November 7th robbery in Rexburg, Idaho. In that robbery he ordered the employees to enter the vault. These are examples of why it can be helpful to share information about robberies.

Fatal outcome televised - In Santa Clarita, CA, following the robbery of a Bank of America branch, several patrol cars from the Sheriff's Department pursued the fleeing bandit for a 45 mile chase that included a mountain highway in the Antelope Valley of the Mojave Desert and ended in Lancaster. A spike strip flattened one tire on the robber's SUV which failed to stop him, but the pursuit eventually ended on a cul-de-sac when the driver found himself boxed in. The bandit briefly exited his vehicle to toss some of the stolen loot in the street. After re-entering his SUV, gunfire erupted and the alleged robber was shot and killed. A helicopter news camera at the scene televised the fatal outcome.

Fatality in Florida - On the opposite side of the country, there was another robbery-related shooting and fatality in Florida earlier in the month. Police responded to a reported robbery at a Chase bank branch in Pompano Beach, FL by what police believed to be a serial robber. FBI Agent David Bell reported that they had been "looking for this individual now for about eight months. He has hit numerous banks...particular banks he's hit numerous times, including the bank he went to today. He's hit it two other times."

The robber, later identified as Michael Webb (who was known by the FBI as "the counter jumper"), entered the bank wearing a ski-mask and carrying a pistol. He pointed the pistol at a customer's head and demanded cash when he realized that, since his previous two robberies at that location, the bank had installed bulletproof glass to protect the tellers and he couldn't jump over the counter. His heist was unsuccessful and he left the bank empty handed. Based on the employees' description of the getaway car, police located Webb downtown in the area of I-95 during the busy lunch hour. When police attempted to pull him over, Webb rammed his car into the cruiser, got out and was fatally shot.

Insider sentenced for fraud - A major contributing factor to the April 2010 failure of the St. Paul Croatian Federal Credit Union was insider fraud. More than 1,000 fraudulent loans totaling more than $70 million were later discovered. COO Anthony Raguz was found to have accepted bribes and kickbacks of more than one million dollars for loans he made to borrowers with few or no assets, and little income or employment history. Raguz then handled the collection of these account and new loans were made to fictitious borrowers to pay off the fraudulent loans.

Raguz was sentenced this month to 14 years in prison and ordered to pay more than $72.5 million for the fraud he was found guilty of perpetrating over a ten year period. John Warren, vice president and general counsel of the Association of Certified Fraud Examiners, said "somewhere along the way, somebody had to have known or suspected that the COO of this bank was engaging in improper activities." An-depth review of the loans would have raised red flags and detected the fraud earlier. This is a prime example why financial institutions must ramp up anti-fraud as well as corporate ethics training. While loan review doesn't fall under the duties of the security officer, employee training does. Train your employees to know that when they suspect there is a problem, who it should be reported to. A loss of this magnitude that contributed to the liquidation of a $250 million institution could, and should, have been avoided.

ID theft hits close to home - ID Analytics, a consumer risk management company behind LifeLock and other ID solutions, examined almost 1.7 billion "identity risk events" over a three year period in an effort to better understand where they originate. These are not cases of dumpster diving, but include applications for short-term payday loans, new credit card accounts, utility services and credit cards, which are some of the more common ways identities are being stolen. The study also revealed cases of information change requests, such as requesting an address change after opening a credit card account.

From the analysis, 10,000 identity theft rings were identified. While these cases occur in all states, a trend extends from Virginia through North and South Carolina, Georgia, Alabama, the Florida panhandle, Mississippi and into Texas where it then gets spotty through New Mexico but starts to pick up again in Arizona, Nevada and California. While organized crime is often behind a lot of these cases, there are also many "mom and pop" operations, involving parents, children and siblings. One case included five family members who ran an identity theft operation out of Florida for three years. In some cases different families work together and trade information, then make small changes to the personal information in hopes of avoiding detection. ID Analytics hopes to use this valuable information to improve the software programs offered by ID Analytics and its subsidiaries to increase detection of these types of transactions.

Threads of Interest
If you are looking for peer-to-peer discussions with other security officers, the public security forum is available for general topics about security. Is your bank spending to attract new customers with giveaways, but not investing in a good DVR for security? This is discussed in the Open Carry thread. Don't be penny-wise and pound foolish!

Weigh in on the question regarding vault lighting requirements here.

We also have a "private" security forum hidden from view for discussion of more private, sensitive topics. The private security forum has discussions between security officers on email encryption, a California bank robbery where the manager was forced to wear what was believed to be a bomb, wire call back procedures and more.

To comment in the BOL threads you must be a registered user. You can register here. If using your bank email account, you will be given access to the private forums. If you are already registered for the threads, but don't yet have access to the private forums, using your bank email address send a request for access to Once your registration request is approved, you can access the Private Security forum here.

CrimeDex alerts feature variety of security challenges
November's CrimeDex alerts reflect the usual mix of fraud, thefts, scams and other crimes designed to separate money and property from their victims, but there was plenty of variety in the mix of over 100 postings. The month started with an alert from a Collinsville, Illinois bank that was hit by a combination of identity theft and ATM deposit fraud. The suspect, who had not been identified, used the identity of one of the bank’s customers to open two fraudulent accounts and used one of the accounts to make an empty envelope deposit and a withdrawal at one of the bank’s ATMs. Excellent surveillance photos included in the alert should help identify the thief. Public Service Credit Union (Denver, CO) posted an alert that counterfeits of its cashier’s checks continue to be passed all over the country, most recently in response to Craigslist ads. The CU offered to verify checks by telephone to help protect victims and their banks. A California county sheriff's office sought help in locating bank account information on a suspect in a large embezzlement investigation. A national credit card company requested contacts from banks and others who may have opened accounts associated with a specified address in Maryland. Even the Drug Enforcement Administration uses CrimeDex! One of their field agents reached out to participating financial institutions seeking accounts for any of a dozen different individuals or aliases (will some of those names show up as money laundering suspects on FinCEN 314(a) requests in the future?) Finally, in a rather unique alert, a casino in Milwaukee, Wisconsin reached out in an attempt to identify a business that may have reported as lost or stolen funds in bank deposit envelopes that were emptied and found in the casino's trash.

Keep up on the latest scams, crimes and other threats facing your bank and other businesses with a free subscription to BOL CrimeDex

CrimeDex is now FREE to registered members of the Bankers' Threads
Private Security Forum! Get the details and subscribe now!

Blogging on Facebook
We've had several interesting posts on the BOL Facebook page. On November 21st, we shared about a family that robs banks together who may be responsible for seven robberies in Texas and Oregon. Read about the clues that lead to their apprehension.

On November 13th, Andy Zavoina posted a review that may help you when planning your next security training or program presentation. Instead of hauling out a heavy (by today's standards) laptop, Andy demonstrates how using an iPhone and iPad with PowerPoint files you already have is efficient, easy and at a cost that is minimal.

Read about these topics and more on our Facebook page. Be sure to "like" the articles so we can continue to post more articles of interest to you!

We didn't add any new security-related tools this month, but if you haven't gone through the tools section lately, there are a lot of great tools you can review and download. Just the list of security tools takes two screens, and if you are like most security personnel who wear more than one hat, there are tools available in other areas that could be helpful to you as well. As the calendar year winds down, you may be thinking about your annual security program report and what to include. Whether you've done this before or this is your first year, look at our "Annual Security Program Report - How to Prepare" tool provided by Dana Turner.

Did we mention all these Banker Tools are FREE?! You can find these and more at the BOL Banker Tools page.

Subscribe to the monthly Security Spotlight!
Access archived issues of the Security Spotlight on BankersOnline's
Security Spotlight Archive page.