We only perform wires for customers who come into a branch (no phone or fax). Customer signs our wire transfer form, as well as a withdrawal slip. Their ID is taken and documented. The transfer form is then scanned over to our Operations department who perform the actual transfer. Our current procedures require a second person in the branch to sign the transfer form as a witness, and then Operations performs a call-back to the second employee. The purpose of the call-back is to confirm that the money was withdrawn from the account, but also to state that they saw that the customer was actually there and authorized the transaction. We've had situations on a Saturday when the person who signed as the witness, was not working on Monday, so when Operations performed their call-back, they could not speak to the second person who 'witnessed' it. No other employee technically saw that the customer was actually there.

I'm questioning what the purpose of this call-back should actually be. If one employee is documenting ID and has a signed document from the customer, isn't it overkill to require a second employee to actually say "yes, I saw the customer was here and authorized this transaction"? I understand that wires can often involve large amounts of money, but the employee conducting the wire has a wire authority limit, given to them based on their title. Currently this call-back is basically ensuring that the first employee is on the up-and-up. Is this standard for other institutions?

We do not do any sort of 'call-back' if the wire was performed for a customer who was 'in person' at the branch and went through the documentation process. No second person 'witnessing' is required.

We do call-backs for ANY instance where the customer was not personally in the branch to sign the request. And then we call back the CUSTOMER to ensure that they authorized the transfer.

We don't perform a "call back" to the employee, but we require an approval on all wires. So one employee takes the wire instructions, completes the form, performs OFAC, checks ID or signature, and debits the account (there are check boxes on the form that the employee must initial stating they have all been completed). The form is taken to the supervisor who reviews the form for completeness, reviews that the employee has completed all the items, etc. The supervisor signs the wire (the supervisor is the one with the wire limit authority), the form is then scanned to the accounting department who processes the wire. For wires where the customer is not present, we have a call back process (to the customer) and the customer must have a telephone transfer authorization on file.

Once the wire goes to accounting, there is no "call back" process.

Unless these forms are delivered to the wire area through a lock-solid secure method, someone figuring out the process and delivery channel is going to take the bank for a ride. A call back to the branch on a wire order is really not that uncommon as an internal control function.

Just wondering what you mean that someone figuring out the process and delivery channel is going to take the bank for a ride? How so?

For what it's worth, we have 5 branches including the main branch. Four of our branches scan the form over to our Operations dept and at our Main Office an employee simply walks up stairs and hands it to an employee in the Operations dept.

An employee could generate a fraudulent wire and have the funds sent to an account they may have at another bank.

A withdrawal needs to first be made from the customer's account and credited to a GL. An employee could just as easy make a withdrawal to a customer's account and purchase a cashier's check to be deposited to their account at another bank. Both transactions have a paper trail and so it would be quite difficult for an employee to get away with either transaction. At some point the customer would come forward and say, "where's my money".

At some point the customer would come forward and say, "where's my money".

Yes, and your answer to your board of directors is that the $500,000 is long gone. Who cares about a paper trail.

I am simply comparing two types of transactions that both carry equal risk for an employee to steal a large amount of money. I'm not sure I see how it is any more difficult (or harder to trace) for an employee to forge a customer's signature and then purchase a cashier's check to be deposited into their own account, than it would be for them to forge a signature and then wire the money to their own account. Do others have controls in place to prevent an employee from fraudulently purchasing a cashier's check? Is a second employee required to sign off on it and witness it? I'm only bringing this up because I was questioning how our bank is at risk of being taken for a ride. And I was wondering what other FIs were doing regarding a call back. With only a couple responses it's hard to gauge what the industry standard is but no one so far has stated that they also use an internal call back as security check against employee embezzlement.

Forget employee embezzlement. Who says this has to be an employee initiating the wire? You think your fax lines are secure???

You have never gotten an e-mail from what you thought was your customer??

You never received a Fax request from what you thought was your customer??

You never received on on-line wire request from a customer who's computer has been hijacked?

A faxed piece of paper from a branch that looks legitimate triggers an automatic wire without any other verification??

Well good luck with that system.

At our FI, customers do not initiate wires, ever. Only done if they are in person at one of our branches

We don't use a fax for wires, ever.

Forms are scanned and emailed through our internal email or walked over in person to Operations

Once that piece of paper is either received by email or in person, Operations performs a call back and verifies that an employee has made the withdrawal from the customer's account and credited the GL. The wire is not sent unless it is confirmed that the withdrawal was made at the branch.

I was never questioning whether a call back was necessary, I was questioning whether it was necessary as a check against the employee. My original post stated that we had an issue because they were looking for two different employees who saw with their own two eyes that the customer was there and authorized the transaction. In other words, it is not enough that one employee--who has been granted wire authority--to say 'yes, the customer was here and authorized this", they want a second employee to say "yup, I also saw that Mr. Jones was here, and he did, in fact, authorize it".

We have had lots of luck with this system.

Hence my first post that stated: "Unless these forms are delivered to the wire area through a lock-solid secure method,"

tango -Ever thought about your own internal email being hacked? The person who prints that wire out and delivers to Operations would not know it did not come from a branch.

But Operations calls the branch to confirm that the withdrawal was made from the customer's account, which would be conducted by an employee only after getting the customer's signature and taking ID.

in answer to your original question, yes, a callback should always be performed, and yes, it is neccessary. 30 second call can easily save the bank a fraud loss. I've yet to see a bank lose money for a fraudulent wire when all procedures were followed, but there are plenty of examples of when procedures weren't followed that the bank lost.