CHAPTER 17

Fraud in E-Commerce

LEARNING OBJECTIVES TO THE STUDENT

After studying this chapter, you should be able to: E-commerce fraud is one
of the most significant pro-
• Understand e-commerce fraud risk. blems in business today. As
• Take measures to prevent fraud in e-commerce. you read this chapter, con-
sider the skills required for
• Detect e-business fraud.
e-commerce fraud detec-
tion and investigation.
Many students find it an
exciting field to specialize
in because of its highly
technical nature and its
need for the modern appli-
cation of fraud principles.
It is one way you can spe-
cialize and differentiate
from other fraud exami-
ners. Use this chapter as a
high-level overview of this
type of work and as a start-
ing point to more in-depth
books.

601

Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
 602 Part 6: Other Types of Fraud

ames, Vijay, and Em became good clicks. These robots can impersonate differ-
J friends through their group work in ent IP addresses through the use of anon-
MBA school; after graduation, they decided ymizers and different browsers through
to start an Internet business together. After faked user agents. They fool search
careful research, they started an online engines into thinking each click is a unique
store selling anti-spam software. Sales user. Click-through frauds can cost busi-
were slow for the first year, and the busi- nesses tens or even hundreds of thousands
ness was in danger of failing. Vijay, a mar- of dollars if they are allowed to continue
keting major, contacted Google, Bing, and over time.1
several other search engines and pur-
chased advertisements linked to specific
Although its growth occurred only about 20 years
search terms. ago, the Internet has become a foundation part of
Initially, the advertising campaign went modern society. From business home pages to infor-
very well. During the first few weeks, Vijay’s mational wikis to social networking sites, it has
advertisement campaign generated a 1–2 permeated almost every aspect of professional and
percent click-through rate (CTR), meaning individual life. Consider how its adoption compares
with other technological advances. It took radio
that 1–2 percent of users clicked on his
more than 35 years and television 15 years to reach
advertisement link when it was presented 60 million people; it took just 3 years for the Internet
in search results pages. Vijay knew he had to reach over 90 million people. The Internet is now
to pay a few dollars or cents each time a available in most homes, businesses, and mobile
potential customer clicked on his advertise- devices. When Jack Welch (former CEO of General
Electric) was asked where the Internet ranks in
ment links, but felt this cost was more than
priority in his company, he responded that “it’s
offset in the resulting purchases of anti-
numbers 1, 2, 3 and 4.”2
spam software. This technology revolution has provided perpe-
Imagine Vijay’s surprise when he trators with new ways to commit and conceal fraud
returned from an extended vacation and and to convert their ill-gotten gains. It has challenged
found that his campaign statistics had regulators, educators, and fraud examiners to keep up
jumped from 1 to 2 percent to an abnormal with both technological and cultural advances. New
opportunities exist in the consumer Internet and in
35–40 percent CTR! At first he was elated,
e-business networks. Essentially, e-business3 uses
but then he realized something must be information technology (IT) and electronic commu-
amiss. Overall sales had not changed, and nication networks to exchange business information
Web site traffic had remained relatively and conduct paperless transactions. While most con-
stable. sumers primarily use Web browsers to access the
Vijay had been a victim of click-through Internet, businesses routinely connect to one another
over Internet lines through e-business connections,
fraud. Although names have been chan-
virtual private networks (VPNs), and other special-
ged, this fraud occurred in a real firm ized connections. For example, even if you only pur-
with several large search engines. Click- chase items at local stores and conduct transactions
through fraud occurs when a competitor with your local bank in person, an Internet transac-
or an adverse individual repetitively clicks tion occurs each time you purchase with a credit card
advertisement links with no intention of or conduct a bank transaction. Even though you are
not using the Internet, the businesses you interact
purchasing products or services at the tar-
with use it continually. Because most businesses rely
get site. Advanced implementations of this on Internet-based transactions, many fraud exami-
fraud use custom scripts and robots to ners are consulted for fraud information related to
quickly generate enormous numbers of e-commerce.

Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.

In this chapter, we discuss unique aspects of
e-business fraud, risks specific to e-business, and
ways to prevent electronic fraud. We discuss e-business
fraud detection briefly, but do not discuss fraud investi-
gation in detail because technology-based methods are
beyond the scope of this book. However, remember that
the processes used to investigate e-business fraud are the
same as those for other frauds. The specific tasks used to
detect e-business fraud may require more technical
knowledge, but the overall process is the same. Once
you understand the risks inherent in this new area of
fraud, you will know where to target your detection
efforts and how to involve advanced forensic specialists
in the process.
S T O P & T H I N K How has the Internet changed your
day-to-day life? What security precautions do you take
each time you use the Internet?
Fraud Risks in E-Commerce
Although fraud can occur in any environment,
several aspects of e-business environments present
unique risks. These characteristics of the Internet-
driven economy create pressures and opportunities
specific to e-commerce fraud. Just like other frauds,
these new frauds are perpetrated when pressures,
opportunities, and rationalizations come together.
E-commerce elements that create increased or unique
risks are listed in Table 17.1.
E-Commerce Risks Inside Organizations
Many of the most serious e-commerce fraud risks are
found within organizations. Once perpetrators are
within firewalls and security checks, it is much easier
to infiltrate systems, steal money and information,
and cause damage. Perpetrators with inside access
know the control environment, understand security
mechanisms, and find ways to bypass security. One
of the most serious problems is the abuse of power
that has been granted to users. For example, program-
mers and technical support personnel usually have
full, superuser access to the systems they create and
administrate. Often, removal of programmer access is
overlooked when systems go into production, allow-
ing them free and unlimited access of corporate data
years into the future. In one survey, more than a third
of network administrators admitted to snooping into
human resource records, layoff lists, and custom
Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Chapter 17: Fraud in E-Commerce 603
databases4 A related survey found that 88 percent of
administrators would take sensitive data if they were
fired, and 33 percent said they would take company
password lists.5
The theft of money is usually the primary goal in
traditional fraud. In the electronic environment, the
data theft is normally the first concern because data
have many useful attributes. First, they can be con-
verted to cash fairly easy. For example, stolen personal
information about customers can be sold or misused,
and individuals can be blackmailed. Second, informa-
tion is replicable, allowing the perpetrator to simply
copy data rather than remove them as traditional fraud
would require. Theft acts often leave very few tracks
because the source data remain intact and usable. The
easy replication of data is one reason that e-commerce
frauds often go undetected for long periods of time—
unless companies are carefully monitoring access logs,
they will not notice the act of replication. Third, data
can be transferred easily and quickly to any location in
the world. If perpetrators use cell phones or other pri-
vate connections to the Internet to transfer data, detec-
tion can be very difficult. Finally, many managers lack
the technical expertise to prevent and detect data theft.
IT managers and assurance providers need to be aware
of the critical points in e-business infrastructures at
which data can be stolen.
Even if a perpetrator does not have personal access
to needed systems, he or she can hijack others’ pass-
words to achieve access. Passwords can be the Achil-
les’ heel of many systems because password selection
is left to the end user and cannot be fully controlled.
Mothers’ maiden names, birthdays of children, favor-
ite locations, and other personal information used to
generate passwords can be guessed by perpetrators
when fraud is internal and employees know each
other personally. Hackers often use social engineer-
ing techniques to gain access to passwords. Instant
messaging, blog entries, Facebook walls, and other
social networking devices provide perpetrators with
a new method of gathering information. When a
hacker presents valid information to a user and asks
for “just a little more,” some users think the request is
appropriate. For example, a hacker may call a tar-
geted user and pose as technical support. Statements
like the following place users in a position of urgency
and unease, and they often lead users to take risks
and provide information:
Hi. This is technical support in room 415. We have
been monitoring your account all day, and it appears
 604 Part 6: Other Types of Fraud

T A B LE 1 7 . 1 E L E M E N T S OF FR AU D R IS K I N E - C OM M E R C E

Pressures
• Dramatic growth, which has created tremendous cash flow needs.
• Merger or acquisition activity, which creates pressures to “improve the reported financial results.”
• Borrowing or issuing stock; additional pressures to “cook the books.”
• New products, which require intensive and expensive marketing and for which an existing market does not yet exist.
• Unproven or flawed business models, with tremendous cash flow pressures.
Opportunities
• New and innovative technologies for which security developments often lag transaction developments.
• Complex information systems that make installing controls difficult.
• The transfer of large amounts of information, a factor that poses theft and identity risks such as illegal monitoring and unautho-
rized access.
• Removal of personal contact, which allows for easier impersonation or falsified identity.
• Lack of “brick-and-mortar” and other physical facilities that facilitate falsifying Web sites and business transactions.
• Inability to distinguish large and/or established companies from new and/or smaller companies, making it easy to deceive custo-
mers by falsifying identity and/or business descriptions.
• Electronic transfer of funds, allowing large frauds to be committed more easily.
• Compromised privacy, which results in easier theft by using stolen or falsified information.
Increased Propensity to Rationalize
• The perceived distance that decreases the personal contact between customer and supplier.
• Transactions between anonymous or unknown buyers and sellers—you can’t see who you are hurting.
• New economy thinking contends that traditional methods of accounting no longer apply.

that a hacker is trying to get into your account. If the
hacker succeeds, it will start an investigation into your
computer use, password selection, and use of company
property. We need to stop this before it goes any fur-
ther. Let’s start by verifying your username and pass-
word. What is your exact username and password?
Even when corporate policies require periodic pass-
word changing, many users circumvent the intent by add-
ing a sequential number or another character to the end
of their old password. It is common to find a few employ-
ees who write their passwords down on sticky notes
placed in their desk drawers or even on their computer
monitors! In addition, in a world with increasing num-
bers of passwords, secret PINs, and account numbers to
remember, many users reuse the same password from
internal system to Internet site and from e-mail client to
application login. If a perpetrator can discover a user’s
password to a relatively unprotected system, that pass-
word is likely useful in more secure systems.
Unencrypted communications between users often
pose a threat that many employees do not appreciate.
For example, although encrypted e-mail access has
been available for decades, many users still check their
mail using unencrypted Post Office Protocol 3 (POP3),
Internet Message Access Protocol (IMAP), or other
protocols. Since most e-mail clients log in and check
for new mail every few minutes, perpetrators have sig-
nificant opportunities to sniff passwords and infiltrate
systems. E-mail text is also not regularly encrypted,
even if a user is using an encrypted connection to his
or her server. Unless the e-mail text itself has been
encrypted using Secure/Multipurpose Internet Mail
Extensions (S/MIME) or another technology, the
e-mail transfers in plain text from the sending server
to the receiving server. Sniffing is the logging, filtering,
and viewing of information that passes along a network
line; it is a common method of gathering information
from unencrypted communications. Sniffing is easily
done on most networks by hackers that run freely
available applications like Wireshark and tcpdump.
Figure 17.1 shows a screen shot of the Wireshark soft-
ware. Note that these applications have legitimate uses
in activities like troubleshooting network problems, so
the applications themselves are not the problem.
Even though firewalls, spam filters, and virus applica-
tions protect organizations from external attack, employee
laptops and mobile devices present risks that are difficult
to manage. For example, each time employees go on busi-
ness trips, they connect their laptops to unprotected envir-
onments like hotel and other business networks. On these
networks, computers can be exposed to viruses, spyware,
and hackers that are often not as present in work networks.
In addition, information on stolen laptops can provide sig-
nificant opportunities for perpetrators. Finally, when em-
ployees return to the office from trips or home and plug
their laptops back into the corporate network, they bypass
firewalls and controls. Viruses, trojans, and worms are able

Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.

FIGU RE 17.1 WIRESHARK SOFTWARE
to enter protected areas because employees physically walk
laptops from unprotected networks to protected networks.
One of the more recent scams for business travelers is
called wartrapping. In this scam, hackers go to known
business traveler locations like airports and set up access
points through their laptops to the Internet. Their lap-
tops look like regular wireless networks to which others
can connect. When travelers open their laptops, their
wireless cards connect automatically to these “free”
Internet access points. Many travelers think they are con-
nected to the airport’s official wireless network, but they
are actually passing network traffic through the hackers’
computers. As the travelers browse the Internet, check e-
mail, and use their corporate networks, the hackers sniff
for passwords and other important information.
Recently, the advent of USB drives, increased mem-
ory on phones, and portable external hard drives poses
security threats. Their large capacities allow them to
Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Chapter 17: Fraud in E-Commerce 605
quickly download significant amounts of information
from internal networks. These devices, including cam-
era phones and iPod-like music players, have been
banned at many military installations because of the
potential threat they pose. For example, when iPods
first hit the market, a common tactic by customers at
electronics stores was to connect iPods to a demonstra-
tion computer and quickly steal software like Microsoft
Office. Because of the iPod’s fast interface and ubiqui-
tous appearance, stealing hundreds of megabytes of
data could be done within just a few minutes.
Vandalism is always a risk with internal systems.
From sophisticated denial-of-service attempts on local
machines to deletion of files to physical damage, van-
dalism is an easy way for employees to harm internal
systems. Vandalism can be obvious, or it can be very
difficult to find—hiding for weeks or months before its
effects are discovered.
 606 Part 6: Other Types of Fraud
E-Commerce Risks Outside Organizations
In 2009, hackers set a new high score for credit card
theft by allegedly stealing 130 million credit cards at
one location.6 Albert Gonzalez, a 28-year-old, used
SQL injections (described later in this chapter) to get
around corporate firewalls and steal credit and debit
card information. They attacked several companies, in-
cluding convenience store chains, credit card processors,
and supermarket chains. When federal agents raided his
home, they found computers, firearms, expensive jew-
elry, and $1.1 million in cash buried in the backyard.
While this case may be the largest in history, it is cer-
tainly not the only one; a web search for “hackers credit
cards” yields many such stories of stolen credit cards.
The Internet provides a rich medium for external
hackers to gain access to personal systems. Hackers
are relatively protected because they cross international
boundaries and are mostly anonymous—making track-
ing and prosecution difficult. When successful investi-
gation and prosecution do occur, sentences are
typically light and do little to deter would-be attackers.
For example, Jeffrey Lee Parson, a 19-year-old who
unleashed part of the MSBlast worm attack, received
18 to 37 months in prison. Jan de Wit, author of the
Anna Kournikova virus, was required to complete 150
hours of community service in the Netherlands. These
viruses infected millions of computers and caused sig-
nificant damage, costs, and time loss worldwide.
Computer viruses must be taken seriously in today’s
e-commerce environment. Viruses come in three vari-
eties. True viruses attach themselves to existing pro-
grams on a computer. Viruses were rampant during
the 1980s and 1990s. They are still in existence today,
but are used less by hackers. Today’s largest threat is
from Internet worms, self-contained programs that
spread via direct transfer, e-mail, or another mecha-
nism. Hackers use social engineering techniques more
than technical prowess to get users to spread their mal-
ware. Compared with previous decades where viruses
were written in the difficult assembly language, today’s
worms are extremely easy to write and distribute be-
cause they are usually written in relatively simple lan-
guages like Visual Basic or Javascript. Have you ever
gotten an “urgent” e-mail telling you to click on an
attachment? These attachments often take the form of
operating system patches, tracking information for
packages, or interesting graphics. Despite their appear-
ance, the e-mail attachments are actually programs that
infect your computer and spread to your contacts.
Whereas viruses were written by sophisticated hackers
Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
in previous years, today’s worms can be written by inter-
mediate programmers. Finally, a trojan horse is a pro-
gram that claims to do something useful, but also
contains hidden behavior. The ubiquitous nature of
some programs, like Windows, Microsoft Outlook,
and Internet Explorer, provides rich fields for viruses,
worms, and trojans to spread through. In addition to their
ubiquity, these programs are often used by less experi-
enced users who are more susceptible to social tricks.
Spyware has become a difficult online problem in re-
cent years. This type of malware—similar to a trojan
horse—installs monitoring software in addition to the
regular software that a user downloads or buys. For ex-
ample, peer-to-peer music and video-sharing applica-
tions are some of the worst spyware offenders. Many of
these programs install monitors that send online user be-
haviors to companies that turn a profit on the personal
information they collect. More targeted spyware can lift
financial or other sensitive information from internal di-
rectories and files and send it to external entities.
Phishing is a common method that hackers use to
extract personal or corporate information from employ-
ees. Phishers send e-mail or pop-up messages to users
asking for personal information in inventive ways. For
example, a hacker might send an e-mail impersonating
technical support to company employees. If even 1 per-
cent of the employees respond with their password or
other information, the hacker may be able to access
a company’s internal networks and open future back
doors before preventative steps can be taken. False
Web sites are another method of tricking users into
providing personal information. A well-known scam
on PayPal involves e-mail being sent to many custo-
mers with a link to a PayPal-like site. Users who click
the link are presented with a login page that imperso-
nates PayPal’s regular login screen. Their attempt to log
in with their usernames and passwords inadvertently
sends their login information to the false site. Users
are then redirected back to the regular PayPal login
screen where they try to log in once again. Most users
never realize they are at an imposter site on the first try.
Spoofing changes the information in e-mail headers
or IP addresses. Perpetrators hide their identities by
simply changing the information in the header, thus
allowing unauthorized access. Since e-mail was one of
the first network-based applications, very few security
measures were placed into its protocols. E-mail headers
are created by e-mail clients and, as such, are extremely
easy to forge. Most users receive spam on a daily basis,
much of which has forged headers.

Falsified identity is another significant risk in
e-business. For an electronic transaction to take place,
each party to the transaction needs to be confident that
the claimed identity of the other party is authentic.
These threats are less of a concern in traditional elec-
tronic data interchange (EDI) settings because traditional
EDI uses relatively limited access points, dedicated lines,
and established value-added network providers as
intermediaries. But authenticity is a significant concern
for transactions conducted through public electronic
channels in e-business. In particular, identity theft (dis-
cussed in Chapter 15) is a significant problem today.
Public and private key encryption technology is one of
the best ways to prevent falsified identity, but advanced
hackers can spoof this technology as well.
Remember this …
Fraud risks in e-commerce systems are signifi-
cant. Due to the rapidly changing tactics of
perpetrators and new opportunities offered,
e-commerce fraud is likely to remain a major
problem in the future.
Database query (SQL) injections and cross-site
scripting (XSS) present risks that many sites are not
designed to handle. In an SQL injection, hackers send
a database command after regular data in an online
submission form. Since many back-end systems simply
relay commands from forms to databases, the SQL in-
jection is executed by the corporate database. This
command might insert an unauthorized record giving
a hacker access, or it might simply drop tables with
common names (such as the users table, customers ta-
ble). XSS is a method of injecting Javascript and other
browser commands into Web site data. When these
commands are interpreted by users’ browsers, unau-
thorized behavior occurs. Common examples are redi-
rection of users to a false Web site and hijacking of user
cookie IDs for unauthorized access.
As noted in Chapter 16, one of the most common
frauds in traditional business is the “bust-out”—the
planned bankruptcy. In its simplest form, perpetrators
set up a business, buy inventory on credit, sell it for
low prices, and then disappear with the money before
the bills are paid. Bust-outs are especially problematic
in e-business. Instead of renting a brick-and-mortar
store, the perpetrators merely establish a false Web site
(at significantly less cost). The false Web site may
grab confidential information or conduct fraudulent
Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Chapter 17: Fraud in E-Commerce 607
transactions. False Web sites look like the site of a real
bank or an online broker or retailer and collect identifi-
cation and credit card numbers from unsuspecting cus-
tomers. Alternatively, perpetrators use false Web sites to
conduct business transactions for which they never in-
tend to pay.
E-mail messages and Web visits can be hijacked
because subtle differences in Internet host names
often go unnoticed by Internet users. For example,
“computer.com” and “computer.org” are two completely
different host names that can be easily confused. If the
two names are owned by different entities, one site could
mimic the other and trick users into thinking they are
dealing with the original Web site or e-mail address.
Many businesses purchase all the domain names for all
forms of their company names, including misspellings,
to prevent these types of Web sites from being set up
and to help customers find the legitimate site.
Fraud risks in e-commerce systems are significant.
While traditional methods of fraud, such as bribery and
kickbacks, are understood by many people, many
employees do not fully appreciate the risks and meth-
odologies that online fraud perpetrators take. Fortu-
nately, users are becoming increasingly educated on
the types of online and e-commerce fraud. For exam-
ple, most business users and students now know they
should not click on e-mail attachments from unknown
senders. However, due to the rapidly changing tactics
of perpetrators and new opportunities presented by
changing protocols and technology, e-commerce fraud
is likely to remain a major problem in the future.
Preventing Fraud in
E-Commerce
Preventing fraud in each business setting involves reduc-
ing or eliminating the elements that motivate fraud: pres-
sure, opportunity, and rationalization. In e-business
settings, reducing pressures and eliminating rationaliza-
tions has thus far proved difficult. The lack of personal
contact makes it hard to know what pressures exist or
what rationalizations perpetrators are using.
One of the greatest fallacies of e-commerce security
is a prevention measure known as security through
obscurity. Security through obscurity is the tactic of
keeping security holes, encryption algorithms, and pro-
cesses secret in an effort to confuse attackers. Many
managers are lured into a false sense of security when
they feel that entry into their system is convoluted
enough to discourage attackers. Rather than employing
 608 Part 6: Other Types of Fraud
robust, proven security measures, companies that employ
security through obscurity play the odds by hoping that
attackers will not figure out how their security works.
Experience shows that obscurity only heightens the chal-
lenge to a hacker! The early computer industry of the
1970s and 1980s is littered with failed attempts at hidden
algorithms and obscure security. For example, try search-
ing the Internet for password crackers for programs like
WordPerfect or Microsoft Excel. Because these programs
didn’t use robust encryption, password crackers abound.
C A U T I O N Security through obscurity is an appealing,
yet ineffective, type of security. Rather than take chances
with security through obscurity, employ robust, time-tested
security methods.
In contrast to obscurity, true security is found when
algorithms and processes are subjected to intense review
and stand the test of time. For example, the triple-DES
and AES encryption algorithms have been public for
many years, and yet they are still generally considered
secure because they seem to be mathematically sound.
As far as we know, neither algorithm has been broken.
Secure Web connections over HTTPS (the protocol you
use when connecting to your bank or credit card site) are
based in these robust algorithms, and they work very
well. VPNs and other security measures based on public,
tested algorithms are always more secure than algo-
rithms based on private, untested methods. Of course,
we are not suggesting that companies publish their
security measures on their Web site home page! We are
proposing that security measures be based on time-
tested methods that have withstood public scrutiny.
The Control Environment
One of the best ways to prevent fraud in an e-business
settings is to focus on reducing opportunities, usually
through the implementation of appropriate internal
controls. In traditional businesses, internal controls in-
volve five different elements: (1) the control environ-
ment, (2) risk assessment, (3) control activities or
procedures, (4) information and communication, and
(5) monitoring. In e-businesses, the first three elements
are often the most important. Therefore, we limit our
discussion to the control environment, risk assessment,
and control activities.
The essence of effectively controlled organizations lies
in the attitude of their management. If top management
believes that control is important, others in an orga-
nization will respond by conscientiously observing
established controls. On the other hand, if it is clear
Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
to employees that management is only giving lip ser-
vice to the idea of controls, rather than meaningful
support, the organization’s control objectives will al-
most certainly not be achieved, and fraud is a more
likely occurrence. Because controls are so important,
firms endeavoring to prevent e-business fraud must
do everything possible to establish and observe good
controls. Another key strategy is understanding the
controls in place in the companies with which the
organization conducts its electronic business.
As noted in earlier chapters, the following are the most
important components of the control environment:
Integrity and Ethical Values
An organization’s culture of integrity and ethics is the
product of what its standards are and how they are
communicated and reinforced in the firm. This includes
management’s actions to remove or reduce incentives
and temptations that might prompt personnel to engage
in fraud. It also includes the communication of organi-
zational values and behavioral standards to personnel
through policy statements and codes of conduct and
by example. A good question to ask about companies
that engage in electronic business is whether they have a
formal code of conduct and whether it is available to be
examined.
Board of Directors and Audit Committee
Participation
An effective board of directors is independent of man-
agement, and its members carefully scrutinize manage-
ment’s activities. The board delegates responsibility for
internal control to management, but it undertakes reg-
ular, independent assessments of management-
established internal controls. In addition, the presence
of an active and objective board often discourages
management from overriding existing controls. A study
of financial statement frauds during the period 1987–
1997 revealed that a weak or ineffective board was one
of the most common elements in firms that issued
fraudulent financial statements7
Management’s Philosophy and Operating Style
Management provides clear signals to employees about
the importance of internal controls. For example, does
management take significant risks, or is it risk-averse?
Are profit plans and budget data set as “best possible”
plans or “most likely” targets? Can management be de-
scribed as “fat and bureaucratic,” “lean and mean,” or
dominated by one or a few individuals, or is it just
right? Understanding these and similar aspects of
 Chapter 17: Fraud in E-Commerce 609

management’s philosophy and operating styles pro- 3. Adequate documents and records.
vides a sense of management’s attitude about internal 4. Physical control over assets and records.
controls and fraud. 5. Independent checks on performance.

Remember this … Adequate Separation of Duties

The “tone at the top” is the most important factor
in control effectiveness.
Human Resources Policies and Practices
The most important aspect of internal control is per-
sonnel. If employees are competent and trustworthy,
other controls can be absent and reliable transactions
will still result. Honest, efficient people are able to per-
form at a high level, even when there are few other
controls to support them. However, dishonest people
can reduce to shambles a system with numerous con-
trols in place.
Risk Assessment
Risk assessment identifies the risks of doing business
with e-business partners. A key part of the assessment
focuses on the control environment of those organiza-
tions. Another part identifies key risks in the electronic
exchange of information and money, so that control
procedures tailored to the special challenges that these
exchanges present can be installed—procedures that
counter the risk of data theft, sniffing, unauthorized
access to passwords, falsified identity, spoofing, cus-
tomer impersonation, false Web sites, and e-mail or
Web site hijacking.
A specialized branch of risk assessment is intrusion
detection. Firms specializing in intrusion detection try
to gain access to networks and secure information, and
they report their findings directly to management. Nor-
mally, a security audit includes an investigation into
technology, processes, controls, and other factors at a
client. The Robert Redford movie Hackers highlighted a
firm doing just this type of work.
Preventing Fraud through
Control Activities
As you learned earlier in this textbook, control activi-
ties are the policies and procedures that ensure that
necessary actions are taken to address risks and frauds.
As you also learned, control activities generally fall into
the following five types:
1. Adequate separation of duties.
2. Proper authorization of transactions and activities.
In e-business, this control is useful for making sure
that individuals who authorize transactions are differ-
ent from those who actually execute them. Probably
the most common frauds in purchasing and sales
transactions are kickbacks and bribery. Kickbacks
occur when one individual becomes too close to sup-
pliers or customers. Adequate segregation of duties
prevents bribery because employees don’t have com-
plete control of transactions.
Proper Authorization of
Transactions and Activities
Proper authorization is another key control in e-
business. The most common authorization controls
are passwords, firewalls, digital signatures and certifi-
cates, and biometrics. Every transaction must be prop-
erly authorized.
Passwords Passwords are a vital part of the security
of any electronic system, but they are also an Achilles’ heel
because they involve people. Compromised passwords
allow unauthorized transactions to be made. To prevent
fraud, organizations should have clearly communicated
policies regarding selecting, changing, and disclosing
passwords. In an electronic environment, no other control
can better prevent fraud than the wise use of passwords
and adequate training of users regarding them.
Digital Signatures and Certificates Just as signa-
tures on paper documents serve as authorization or
verification, digital signatures reassure users that trans-
actions are valid. Digital signatures and certificates
thus prevent falsified identity and impersonation and
as such are increasingly important.
Biometrics One of the most promising areas of
technology and systems security is biometrics—the
use of unique features of the human body to create
secure access controls. Because each person possesses
unique biological characteristics (for example, iris and
retina patterns, fingerprints, voice tones, facial struc-
tures, and writing styles), scientists and technology
firms are developing specialized security devices that
have the potential to be highly accurate in authenticat-
ing identity. Access and permission to execute a trans-
action is granted or denied based on how similar the
subsequent reading is to the reference template.

Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
 610 Part 6: Other Types of Fraud
Adequate Documents and Records
Documents and records (sales invoices, purchase orders,
subsidiary records, sales journals, employee time cards,
and even checks) are the physical objects by which trans-
actions are entered and summarized.
In e-business, these documents are present in elec-
tronic form. This lack of hard-copy documentation, the
very essence of e-business, creates new opportunities
for fraud. Documents and records typically are detec-
tive controls, not preventive controls. They are the
audit trail and enable auditors and fraud examiners to
investigate suspected wrongdoing. Although most com-
puter systems create records of transactions that can be
accessed or reconstructed, smart perpetrators figure out
how to remove evidence of transactions from servers
and computers.
Because many of the traditional document controls
aren’t available in e-commerce, additional controls
must be put in place. The primary electronic transac-
tion and document control is encryption, which pro-
tects confidential and sensitive information (such as
checks or purchase or sales transactions) from being
“sniffed” or stolen. Public-key encryption allows infor-
mation to be sent in encrypted format over unsecured
networks like the Internet and is widely used to protect
data and ensure privacy. In public-key arrangements,
communicating parties have two keys, one that is
made public and another that is held private. These
keys are inversely related: If one key is used to “lock”
a message, the other must be used to “unlock” it. Thus,
a message locked by a public key can be read only by
the party holding the private key. Similarly, a message
that can be unlocked by a particular public key can
have originated only from the party holding the corre-
sponding private key. Public-key encryption is thus
used for privacy (by locking a message with the in-
tended recipient’s public key) and for authenticity (by
locking a message with the originator’s private key).
Physical Control over Assets and Records
When records—electronic or paper—are not adequately
protected, they can be stolen, damaged, or lost. Highly
computerized companies need to go to special lengths to
protect computer equipment, programs, and data files.
Three categories of controls protect IT equipment,
programs, and data files from fraud. As with other types
of assets, physical controls are used to protect computer
facilities. Examples are locks on doors to the computer
room and terminals and adequate and safe storage space
for software and data files. In addition to software-based
security, the software and hardware that comprise the
Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
IT infrastructure must be physically secure. Remember
that authorized personnel who can access computers
and servers can also execute unauthorized transactions
or steal sensitive information. Sometimes physical in-
frastructure is so sensitive and critical to e-business
operations that the system is placed in an isolated loca-
tion with only high-level security access.
Many firms use third-party providers—often known
as application service providers—to provide data storage
and application services. Because their entire business is
based on data security, these firms generally take security
very seriously. They provide 24-hour monitoring and se-
curity and effective password and encryption manage-
ment. They are normally located in geographic locations
considered “safe” from power outages, political unrest,
and natural disasters like hurricanes or earthquakes. For
many companies, the additional security benefits these
firms provide are well worth the additional cost. Regard-
less of a company’s security precautions, physical controls
must be a primary consideration. A recent twist on offsite
location of services is cloud-based architectures like Goo-
gle’s App Engine or Amazon’s S3. These services can co-
locate data on multiple continents to provide speed and
reliability. If your firm uses these services, be sure to un-
derstand the unique advantages and challenges they have
in regard to fraud risks and protection.
Remember this …
One of the best ways to prevent e-commerce
fraud is by focusing on reducing opportunities
through sound security measures and a solid
control system.
Independent Checks on Performance
As with traditional business, a key component in
e-business controls is the careful and continuous
review of the other four components—the independent
checks and internal verification. The need for indepen-
dent checks arises because internal controls change
over time. Personnel forget or fail to follow procedures,
or become careless—unless someone observes and eval-
uates their performance. The likelihood of fraudulent
transactions goes up when controls break down.
Independent checks are particularly important in
preventing fraud in e-business. Organizations should
always conduct checks on their e-business partners.
These checks can range from simple Dun & Bradstreet
reviews to full-fledged investigations of the firm and
its officers. A quick search of LexisNexis and other

financial databases on the Internet often reveals pro-
blems the organization should be aware of before it
conducts electronic business.
Electronic fraud, especially that perpetrated by smal-
ler companies, is often committed by individuals high
in the organization, and quite often on behalf of the
organization as opposed to against the organization. Be-
cause management is usually involved, management
and the directors or business partners must be investi-
gated to determine their exposure to, and motivation
for, committing fraud. To prevent fraud, gaining an
understanding of the management or the organization’s
business partners and what motivates them is impor-
tant. In particular, three items— (1) backgrounds,
(2) motivations, and (3) decision-making influence—
must be examined. What organizations and situations
have management and directors been associated with in
the past? What really drives and motivates the organi-
zation’s leaders? Is their personal worth tied up in the
organization? Are they under pressure to deliver unre-
alistic results? Is their compensation primarily based on
performance? Do any debt covenants or other financial
pressures exist? Management’s ability to influence deci-
sions is important to understand because perpetrating
fraud when only one or two individuals have primary
decision-making power is much easier.
Detecting E-Business Fraud
In Chapter 6, we introduced data-driven fraud detec-
tion, in which the types of fraud that can occur are
identified and then technology and other activities are
used to look for fraud symptoms. That is, fraud exam-
iners (1) endeavor to understand the business or opera-
tions of the organization, (2) identify what frauds can
occur in the operation, (3) determine the symptoms
that the most likely frauds would generate, (4) use
databases and information systems to search for those
symptoms, (5) analyze the results, and (6) investigate
the symptoms to determine if they are being caused by
actual fraud or by other factors.
S T O P & T H I N K How can the data-driven fraud
detection approach be used to detect e-business fraud?
What data sources can be used to discover potential
frauds?
This method of fraud detection works very well in
detecting e-business fraud. One of the best techniques
for implementing this type of fraud detection is to use
Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Chapter 17: Fraud in E-Commerce 611
technology to catch technology fraud. Many of the
hacker tools were actually written to troubleshoot net-
works and catch perpetrators rather than to hack into
systems. It is extremely important for fraud investiga-
tors who specialize in e-commerce to understand the
tools and methods that perpetrators use. Knowledge of
Web servers, e-mail clients and servers, and intrusion
programs like Nmap, Airsnort, and Wireshark is criti-
cal to catching perpetrators and securing systems. Fraud
investigators who want to specialize in e-commerce
fraud should take several information systems or com-
puter science networking and security courses. Since
many of today’s corporate servers and the Internet in-
frastructure are Unix-based, knowledge of Unix/Linux
is imperative. Because clients’ applications are often
Windows-based, knowledge of the security strengths
and weaknesses in Windows is also important.
Computer scripts, written in languages like Perl,
Python, Ruby, and Bash, can monitor logs and systems
for potential break-ins. An assortment of different in-
trusion detection systems (IDS) is on the market today.
Careful use and monitoring of these systems should
be done by every organization.
S T O P & T H I N K What skills are required to detect
and investigate e-business fraud? What other classes might
help you learn these skills?
The appendix to Chapter 6 provides an introduction
to detecting fraud in e-commerce systems and corpo-
rate databases. Planting automated queries in electronic
purchasing records that examine changes in the per-
centage of goods purchased from different vendors by
individual buyer, price changes, the number of returns
(indicating lower quality), and comparisons of these
factors with other vendors is easy. These variables can
even be analyzed on a combined basis; for example, the
system will look for increased purchases from the ven-
dor whose prices are increasing the fastest. Computer
systems can be programmed to provide information
when changes equal or exceed a certain amount. For
example, price changes of a certain percentage within
a certain period might be queried.
The advantage of e-business transactions is that in-
formation about the transactions is captured electroni-
cally in databases that can be analyzed in numerous
ways. These data make fraud detection much faster
than ever before, but the techniques require more com-
puter expertise to run. The most difficult aspect of de-
tecting e-business fraud is correctly specifying the types
of frauds that can occur and the symptoms they will
 612 Part 6: Other Types of Fraud

generate. Also, symptoms are only circumstantial evi- or eliminating the elements that motivate fraud:
dence at best. There may be perfectly legitimate explana- pressure, opportunity, and rationalization. In par-
tions for factors that appear to be symptoms. However, ticular, the use of time-tested, publicly available
just as e-business transactions make fraud easier to com- procedures for security is the best measure for se-
mit, they also make it much easier to detect. curity; security through obscurity is seen by most
As discussed earlier in this chapter, a rigorous, time- professionals as a false sense of security.
tested process for security should be used. Security • Detect e-business fraud. E-business fraud occurs in
through obscurity should never be an option. Standards- electronic transactions from business to business—
based systems like VPNs, firewalls, public and private usually from one corporate system to another. The
key infrastructure, strong encryption, and other means data-driven fraud detection approach works well
should be employed and monitored at all times. in discovering this type of fraud because it focuses
on the transactions and log files involved in the
Remember this … electronic process.

The use of time-tested security principles will

help prevent e-business fraud. The data-driven
approach to fraud detection is an excellent way KEY TERMS
to discover and investigate e-business fraud. e-business, p. 602 phishing, p. 606
data theft, p. 603 spoofing, p. 606
passwords, p. 603 falsified identity, p. 607
In addition to technical measures, social preventions
social engineering, security through
and detections are important. Regular audits of user
p. 603 sniffing, obscurity, p. 607
behavior on the system should be done by watching
p. 604 wartrapping, digital signatures and
how users interact with their systems. Employees
p. 605 spyware, p. certificates, p. 609
need to be trained on what e-commerce fraud looks
606 biometrics, p. 609
like so they can spot problems. For example, in the
autobiographical book The Cuckoo’s Egg, Clifford Stoll
discovered an international spy using his systems for
entrance into U.S. military systems. Stoll’s investigation
started with a mere $0.75 discrepancy in system audit QUESTIONS
logs! Users need to be trained that while computer Discussion Questions
anomalies may not look significant, they can often
highlight deeper problems. Just as employee tip lines 1. In what ways do e-business transactions pose
can provide information in traditional fraud cases, heightened fraud risks?
tips can be useful in electronic fraud if employees un- 2. What are some common ways e-business fraud is
derstand what to look for. perpetrated?
3. How can the authenticity of a party in an e-business
Review of the Learning transaction be verified?
4. What is sniffing?
Objectives 5. Why is spoofing a significant risk in e-business?
6. What principles are important in password use and
• Understand e-commerce fraud risk. E-commerce training?
presents new challenges and opportunities for fraud 7. Why does biometrics offer significant promises as
and its detection, but the risks can still be described a way to authenticate e-business transactions?
in terms of pressures, opportunities, and rationaliza- 8. How is the data-driven, six-step detection approach
tions. Because the Internet-driven economy removes relevant to e-business fraud detection?
the need for physical access and interpersonal con- 9. Why can it be dangerous to provide credit card infor-
tact, e-commerce creates risks inside organizations, mation over the Internet? Does it stop the risk if you
outside organizations, and to consumers. only use credit cards at local businesses?
• Take measures to prevent fraud in e-commerce. 10. Can e-business fraud risks ever be completely
Preventing fraud in e-commerce involves reducing eliminated?

Copyright 2011 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.