Defending the E-Commerce Fortress

-- Norm Wilcox, National Fraud Center

"Regulations to Force Insurers to Track Customers"

Insurers may soon be required by regulators to independently verify who they are doing business with electronically, under "Know Your Customer" laws that banks and the Securities and Exchange Commission already must comply with.

Under such regulation, an insurer would need to track customer buying habits and investigate changes in those habits, Norman A. Willox Jr. said during a seminar Monday at the A.M. Best Insurance Information Management Conference. For example, if an annuity buyer suddenly started buying much larger annuities, the insurer could be required to investigate and report suspected fraud, said Willox, who is chief executive officer of the National Fraud Center Inc.

As electronic commerce grows toward an anticipated $1 trillion in annual sales by 2002, insurers need to protect that new business from fraud.

Insurers also should assess the vulnerability of their internal systems, evaluate the risks, install deterrents and detection devices, implement changes and prepare for emergencies, Willox said.

The most commonly used protection device is antivirus software. Other popular security measures include firewalls, encryption, intrusion detection and digital identification. A fingerprint identification device that is built into a computer mouse is expected to become popular because a new one on the market costs under $100, Willox said.

One of the most important safeguards is for a company to know what a trading partner will do with the proprietary information that is passed to them electronically--how it will be stored and who will have access to it, he said.

The Internet is a target for fraud simply because it is another medium for doing business, Willox said. The biggest threat comes from disgruntled and former employees as well as contractors who are familiar with and have access to a company's computer systems. U.S. competitors, organized crime, foreign corporations and foreign governments also represent the potential for perpetrating computer fraud, he said.

The fraud threat from insiders includes unauthorized access, stealing passwords and theft of proprietary information. Such fraud costs businesses an estimated $300 billion per year, Willox said.

The same type of economic crimes that businesses already are guarding against, including misrepresentation, extortion and sabotage, are moving to cyberspace, he said.