Features of risk management in the field of falsification of scanned documents

[НСК-СБ]

Features of risk management in the field of falsification of scanned documents ALEXEY KUZNETSOV, SMTDP Tech Sales Director​

The article discusses the problem of high-tech fraud associated with scanned copies of documents that occurs when using EDMS (electronic document management system) when working both within the company and with external contractors. Examples of counterfeiting scanned copies of documents Interaction with the services responsible for internal control and the transition of companies to electronic document management in various sectors of the economy (insurance companies, energy, IT companies, logistics), showed that fraudsters are usually motivated by the following motives: • Confirmation of non-existent qualifications and the ability to engage in a certain type of activity (licenses, certificates, certificates, work books, etc.) • Concealment of real counterparties and activity of work on them (payments, TIN, USRLE, signatures and seals in acts and contracts, amount of contracts) to reporting bodies, banks, company owners, auditors, funds. EXAMPLE. TENDER APPLICATIONS AND PURCHASING ACTIVITIES IN THE CONSTRUCTION SPHERE When submitting applications for tenders on electronic sites in the field of construction and energy, scanned copies of bank guarantees and certificates of membership in the SRO (self-regulatory organization) are included in the application package. The cost of membership in an SRO costs about $ 20,000 per year, so many either receive an SRO certificate for 1 year, and then fake the date of issue or take an SRO certificate from a foreign organization on the Internet and change its name. It is clear that you can verify membership in an SRO by calling the appropriate SRO (there are about 300 of them), but when purchases are made in bulk and with a large number of participants, this becomes a time-consuming task. A bank guarantee costs about 0.5% of the purchase amount, therefore, in order not to pay it with a similar SRO certificate, they fake it. EXAMPLE. CHANGING KEY PARAMETERS IN A CONTRACT Scanned copies of documents usually always follow paper versions of documents, but the latter are always late and stored in an unordered form in the archives of organizations. At the same time, in medium and large companies, no one checks the signed scans with the coordinated electronic versions of documents (stored in Word) in the EDMS. Even internal auditors and audit firms mostly work with copies, not originals. This means that you can agree on a document in the amount of 120,000 rubles, and add 150,000 rubles to the signature agreement - and no one will notice the discrepancy . EXAMPLE. CERTIFICATE OF CERTIFICATE OF AVAILABILITY OF QUALIFICATIONS WHEN RECEIVING TO CRYING COMPANY To confirm the qualifications of the ship’s crew members, it is necessary to receive certificates every 5 years worth from $ 100 to $ 200 each, while they are sent to crewing companies exclusively in the form of scanned copies. Forging a certificate is accordingly cheaper and easier than getting it. In addition, to work in the port, the master of the ship and the sailors need to undergo retraining every 5 years, which costs about $ 1000. There is also a great temptation to falsify documents. As we can see, in most cases the problem lies not in the impossibility of identifying a fake (any scanned document always exists in paper form), but in the expensive verification process from the point of view of logistics (to come to the inspector and personally verify the availability of the document) and the labor of the inspectors (when the documents a lot, even a simple action - to call the organization that issued the document makes the verification process economically unprofitable). Technology for forging scanned copies of documents and hiding traces of crime Almost anyone who is familiar with simple office programs like Paint can fake a scanned document. You do not even need to be qualified as a graphic designer with the skill of specialized programs such as Photoshop. For example, to replace a year in a certificate from 2011 to 2013, it is enough to find the number “3” in the source document, select a fragment with it and copy it to “1”. Further, usually all scanned documents are collected either in PDF or in zip archives. Such actions usually lead to concealment (unintentional or intentional) of special metadata contained in the photograph, by which it would be possible to determine that the scanned copy of the document contained traces of editing graphic programs. The easiest way is to identify the use of graphics programs. Scanned documents are rarely in color, usually using 24-bit shades of gray. But in order to save space (or to hide traces of editing), they often use the monochrome mode and very low scan resolution (150DPI to 150DPI). Such a struggle for the size of scanned documents really leads to a saving in the size of file servers, but actually does not allow to recognize fakes in scans in the future. This is what fraudsters use, as well as they wrap corners in documents, lift the lid on the scanner at the time of making the copy, etc. That is, they use technologies that lead to losses in the quality of scanned copies and their “unintended small damage”. Interaction with forensic experts preparing judicial opinions showed that compressed scans in poor quality do not make it possible to prepare materials for the court to confirm modifications in the scanned document, so it is important to understand that saving on the size of photographs, provided that the storage cost is 1 fold multiple data leads to irreversible consequences. Anti-counterfeiting tools for scanned copies of documents For the purpose of controlling the modification of scanned copies of documents, electronic document management systems such as Documentum, Efrat, Directum, etc. are used. They allow you to control electronic versions of documents, including all changes that were in the document at the stage of document modification as part of the business process within the company . However, if a scan arrives from outside (tender applications for the tender) or at the stage of going beyond the organization’s perimeter (exchanging paper copies of documents and signing them with subsequent scanning), they do not allow you to track the changes made, that is, in fact, we are talking about the fact that at the stage the document is not loaded into the system, it is not checked for authenticity or for compliance with the scan, the agreed version of the document in the Word editor. Many believe that the use of EDS solves this problem, since the counterparty signs the copies of documents sent with his personal key, but EDS is only a means of identification, but not authentication. The company’s counterparties or its employees, who go to the forgery of documents, are well aware that they provide modified copies of documents, and are aware that they are identified in the system. They hope that the situation will not reach the moment of raising the primary documentation and counter checks. And in principle, they are right, since even auditors, as already noted earlier, do not work with originals. To reduce the likelihood of editing between the stage of scanning a document and its entry into the information system, special scanners are used that put a watermark on the document - a special picture that is modified when changes are made. Firstly, such devices are very expensive, and secondly, external counterparties cannot be forced to buy such scanners, so the risks of fraud are not reduced. Another way to verify the scanned documents for authenticity, which is only suitable for documents issued by services that have an open registry, for example, SRO certificates (self-regulatory organization), is to compare information obtained from a copy of the certificate (for example, number and date) with the database SRO members, which is available on the SRO website. This method is simple and effective, but in the case of a significant number of incoming scanned documents, it is not applicable, since it is time-consuming. An expert analysis of scanned documents is not common among forensics, as the alternative to it has always been a request for primary documentation (come and show the original document). Although it has its own expert subtleties in the analysis: for example, to check the size of the font size or to identify the heterogeneity of noise in the image obtained from the scanner. At the fake location, the noise level (distortion introduced by the scanner into the picture) differs from the “natural” level in the document. For the purpose of comprehensive protection against falsification of scanned documents, SMTDP TECH suggests using the DMI product - Document Manipulation Inspector, which combines: • automated recognition of editing traces in documents and the allocation of suspicious documents; • selection of the type of document and separation of data from it, which can be automatically compared in open data sources (SRO, TIN, USRLE) or with data from internal information systems. According to company estimates, the introduction of such a software package in the procurement activities of a company with a scale of 100+ people allows you to effectively deal with fakes of scanned copies of documents and identify fraud threats among contractors and company employees on time. Conclusion In conclusion, I would like to note that, of course, there are ways to get around any protection method, and there is no 100% way to protect against high-tech fraud associated with the falsification of digital documents. Therefore, only the use of a set of tools and instruments will provide complete protection against these types of threats. It is important to be aware and understand what methods exist and the limits of their application.

https://www.s-director.ru/magazine/magdocs/view/160.html

 

[Частный детектив. Москва.]

Thanks for the review and the article!

 

[Частный детектив Донецк]

Interesting post! Thank you.