Deck 17: Fraud in E-Commerce

Question 1

Spoofing is which of the following?

A) Any fraud scheme involving a 3rd party
B) Changing the information in e-mail headers or IP addresses
C) Creating false vendors
D) Creating a false doctor during an insurance scam

Answer 1

B
B: Correct

Question 2

Locks on the doors to the computer room, is an example of which electronic control?

A) Biometrics
B) Independent checks on performance
C) Adequate separation of duties
D) Physical control over assets and records

Answer 2

D
A: Unique features of the human body to create secure access controls
B: Careful and continuous review of the other four e-business controls
C: Making sure that individuals who authorize transactions are different from those who actually execute them
D: Correct

Question 3

Which of the following is an important element of the control environment?

A) Integrity and ethical values
B) Board of directors and audit committee participation
C) Management's philosophy and operating style
D) All of the above

Answer 3

D
D: Answer: 'D' is correct. Implementation of each of the elements mentioned above will ensure a better control environment that will reduce the chance of fraud.

Question 4

According to the book, which 3 of the 5 traditional internal control elements are most important in ebusiness transactions?

A) Control environment, risk assessment and monitoring
B) Risk assessment, control activities and information & communication.
C) Control environment, risk assessment and control activities
D) Control activities, information & communication and monitoring.

Question 5

Which of the following are controls over authorization of transactions and activities?

A) Passwords.
B) Digital Signatures.
C) Biometrics.
D) All of the above.

Question 6

Separation of duties falls under which of the following internal control element

A) Control activities
B) Risk assessment
C) Control environment
D) Monitoring

Question 7

Which elements of E-commerce are not risks unique to E-commerce?

A) Cash flow constraints instigated by tremendous growth causing a need for more borrowing or issuing of stocks
B) More precise and frequent expectations by Wall Street, creating pressure to cook the books
C) Anonymous transactions
D) Invisible businesses-You don't know the size, or the location
E) A and B

Question 8

The best way to reduce fraud in an e-business environment is to focus on _______?

A) Customer transactions
B) Reducing opportunities through the implementation of appropriate internal controls
C) Designing new fraud-proof technologies
D) Apply Benford's law

Question 9

Which of the following is a unique risk for e-commerce?

A) Merger or acquisition activity, which creates pressures to "improve the reported financial results"
B) Unproven or flawed business models, with tremendous cash flow pressures.
C) Borrowing or issuing stock, which adds additional pressures to "cook the books"
D) All of the above

Question 10

Which of the following uses features of the human body to create secure access controls?

A) Biometrics
B) Spoofing
C) Biological Signatures
D) Physical science controls

Question 11

What is the most important aspect of internal control?

A) The personnel
B) The board and audit committee participation
C) A controlled system
D) All of the above are equally important aspects of internal control

Question 12

Which is the most secure method of computer authorization?

A) Digital Signatures
B) Passwords
C) Biometrics
D) Voice activation

Question 13

Identify the true statement about control activities in an e-business environment.

A) Although the same types of control activities are used, they are not as effective in e-business.
B) Adequate separation of duties is not as important in e-commerce as it is in traditional brick-and-mortar businesses.
C) Proper authorization is a key control in e-business - passwords, firewalls, digital signatures and certificates, and biometrics are especially important and must be carefully monitored.
D) A and C only
E) All of the above

Question 14

Viewing information that passes along a network communication channel is referred to as:

A) Falsified Identify
B) Spoofing
C) Sniffing
D) Hijacking

Question 15

What is biometrics?

A) A signature sent over the internet
B) Using unique features of the human body to create secure access controls
C) A medical device that forces subjects to tell the truth during interviews
D) Complex information systems implementation

Question 16

Which is not a method of proactive e-commerce fraud prevention?

A) Encryption
B) Firewalls
C) Digital Signatures
D) Biometrics
E) All of the above

Question 17

All of the following make it easier for perpetrators within an organization to commit e-commerce fraud =except:

A) They know the control environment
B) They understand security mechanisms
C) They find ways to bypass security
D) All of the above

Question 18

The process for detecting E-Business fraud is similar to detecting other types of fraud except:

A) E-business is a different type of business than brick-and-mortar companies and must be understood prior to detecting fraud.
B) E-business doesn't have the same fraud risks of other companies
C) E-business fraud symptoms constantly change and cannot be narrowed down
D) E-business fraud detection works best when the queries are automated so that they examine every business transaction and business relationship.

Question 19

Which activity is used legitimately by companies to monitor network traffic, but may also be used illegally to capture confidential information?

A) Sniffing
B) Spoofing
C) Hijacking
D) Impersonation

Question 20

Traditional ___ reduces the risk of falsified identity.

A) CSS (Cascading Style Sheets)
B) EDI (Electronic Data Interchange)
C) WWW (World Wide Web)
D) SQL (Structured Query Language)

Question 21

Which of the following is not part of risk assessment in e-business?

A) Falsified identity
B) Integrity and ethical values
C) Spoofing
D) Sniffing

Question 22

Which of the following are pressures commonly found in e-business?

A) Dramatic growth, which creates cash flow needs
B) Expensive marketing of new products
C) Unproven business models
D) All of the above

Question 23

Which area of risk in E-Commerce involves fraudsters presenting themselves as authorized employees?

A) Sniffing
B) Spoofing
C) Hijacking
D) Customer impersonation

Question 24

___________ is defined by the book as "Changing the information in an email header or an IP address to hide identities".

A) Digital signatures and certificates
B) Spoofing
C) Biometrics
D) Sniffing

Question 25

Why must e-business organizations have proactive fraud prevention efforts in place?

A) Because defrauding people is easier when perpetrators can't see the consequences to the fraud victim.
B) Because security measures often lag process development.
C) Because information systems are often complex.
D) All of the above.

Question 26

A risk assessment should:

A) Identify the risk of doing business with e-business partners
B) Focus only on financial data
C) Be avoided at all cost
D) Cover only non-technological areas

Question 27

E-Commerce fraud elements differ from other types of business fraud in that they don't involve which element of the fraud triangle?

A) Perceived pressures
B) Perceived opportunities
C) Rationalization
D) None of the above

Question 28

Which of the following is not a type/category of control activities?

A) Adequate separation of duties (useful for making sure that individuals who authorize transactions are different from those who execute them)
B) Adequate documents and records (documents and records are the physical objects by which transactions are entered and summarized and can be the audit trail by which auditors can investigate wrongdoings)
C) Proper authorization of transactions and activities (most common controls in e-business include passwords, firewalls, digital signatures, and biometrics)
D) Use of internal auditors

Question 29

When dealing with e-commerce fraud, the primary objective of fraudsters is to steal data. Which of the following is not a useful attribute (from the fraudsters' perspective) of data?

A) Data can easily be converted to cash
B) Data can be copied rather than removed
C) Data can easily be transferred to any location in the world
D) Many managers lack the technical expertise to prevent data theft
E) All of the above are useful attributes of data

Question 30

Reducing or eliminating the elements that motivate fraud is the best way to prevent fraud. Which of the following element/s can easily be reduced in preventing fraud in e-business?

A) Pressure
B) Opportunity
C) Rationalization
D) All of the above can easily be reduced in e-business

Question 31

In an electronic environment, no other control can better prevent fraud than the wise use of:

A) Separation of duties
B) Physical control over assets and records
C) Independent checks on performance
D) Passwords

Question 32

Why are passwords often considered the "Achilles heel" of electronic systems?

A) Passwords involve a human element
B) Systems cannot handle complex passwords
C) Many systems allow multiple login attempts
D) Two of the above

Question 33

___________ are self-contained programs that spread via direct transfer, email, or another mechanism.

A) True viruses
B) Internet worms
C) Trojan Horses
D) Spyware

Question 34

Which of the following is not a risk associated with doing e-business?

A) Data Theft
B) Sniffing
C) Spoofing
D) Vendor impersonation
E) All of the above are risks associated with doing e-business

Question 35

Generally, the best way to prevent fraud in e-business settings is to focus on:

A) Reducing fraud opportunities
B) Buying and implementing virus software
C) Keeping software updated
D) Hiring security experts

Question 36

Using techniques to gain passwords and other personal information directly from victims is known as:

A) Social engineering
B) Spoofing
C) Data theft
D) Customer impersonation

Question 37

Defrauding people through e-business is generally __________________ in normal business settings.

A) Easier than
B) Harder than
C) The same as

Question 38

Which of the following is not an e-business risk?

A) Sniffing
B) Unauthorized access to passwords
C) Spoofing
D) All of the above

Question 39

All of the following are unique risks to e-commerce fraud except:

A) Removal of personal contact between customer and company
B) Pressures to "cook the books" and meet analysts expectations
C) Lack of "brick-and-mortar" facilities
D) Inability to distinguish larger, well-established companies from smaller, faux companies

Question 40

Which method of proactive fraud detection works best in an e-business environment?

A) Understanding the business or operations of the organization
B) Use databases and system logs to automatically search for symptoms of frauds likely to occur in a particular company.
C) Physical examination of assets and records.
D) Independent audits and checks on controls.

Question 41

Why is fraud detection easier in an e-commerce environment than in a traditional environment?

A) Because the data captured in databases can be analyzed in numerous ways.
B) Because records kept in an e-commerce environment are more detailed than those kept in traditional environments.
C) Because fewer transactions take place in e-commerce than in traditional environments.
D) Because transactions have to be authorized in an e-commerce environment and not in a traditional environment.

Question 42

Which of the following examples illustrates sniffing?

A) A fraudster impersonating a customer and buying equipment on the customer's account.
B) A fraudster viewing design data of a special project that is being transferred over a network.
C) A fraudster using another employee's passwords to access sensitive information.
D) An internet site mimicking another site by using .com instead of .org.

Question 43

Passwords, biometrics, and digital signatures are examples of:

A) Physical controls
B) Segregation of duties
C) Authorization controls
D) Checks on performance

Question 44

Which is not a method of preventing fraud through control activities

A) Separation of Duties
B) Sniffing
C) Authorization of transactions and activities
D) Physical control over assets and records

Question 45

What is the primary electronic transaction and document control used in e-commerce?

A) Encryption
B) Spoofing
C) Passwords
D) Biometric Controls

Question 46

In traditional business, which of the following is not part of internal controls?

A) Risk assessment
B) Monitoring
C) Control activities or procedures
D) None of the above

Question 47

Which of the five elements of internal controls is least effective in preventing fraud in e-commerce?

A) Monitoring
B) the control environment
C) risk assessment
D) control activities and procedures

Question 48

Specific fraud risks to conducting e-business include:

A) Data theft, hijacking, and biometrics.
B) Sniffing, kickbacks, and spoofing.
C) Falsified identity, spoofing, and hijacking.
D) Unauthorized access to passwords, data theft, and viruses.

Question 49

Which of the following poses a larger risk in an e-commerce environment than in a traditional environment?

A) Pilferage
B) Theft of money
C) Data theft
D) Employee fraud

Question 50

One of the greatest fallacies of e-commerce security is a prevention measure known as security through ___________.

A) maturity
B) obscurity
C) purity
D) surety

Question 51

Fraud risks are higher in e-commerce settings because:

A) Personal contact is limited so the personal hurt that is caused is not seen
B) Fraud can be committed electronically instead of by stealing physical assets
C) Fraud committed electronically is harder to detect than other types of fraud
D) E-commerce is new and few fraud detectors are familiar with electronic fraud schemes