Recently, we’ve been asking readers to think about Alice and Bob, the famous pair in physics used to demonstrate propositions in a variety of contexts but, just for now. Let’s look at how Alice might be able to detect financial fraud, courtesy the blog Expensivity. Fraudster Frank can cheat Financial Alice. But how does she know? Bernard Fickser asks us to consider two ways… and to ask, what if it involves stealing her vote?

1.The money just disappeared. In this case there would be no record of any authorization by Alice, or by someone impersonating Alice, or by any bank official that she disbursed the funds. This would represent a cybersecurity failure on the part of the bank, and the bank would clearly be liable. Perhaps outsiders were able to hack into the bank’s computers. Perhaps insiders were able to subvert the bank’s cybersecurity.

Cybersecurity measures exist to prevent such fraud. With such an eventuality, the first question is, Where did the $10,000 go? Unless, per impossibile, the money simply vanished without a trace, whatever entity owns the account to which the money was first transferred would immediately be suspect, though in a money laundering scheme, the money would be quickly transferred elsewhere, perhaps multiple times, to break the trail and keep the fraudster Frank in the shadows.

Of course, given Frank’s ability simply to make money dematerialize, (i.e., to transfer it without any authorization), it seems that Frank should not simply have stopped with $10,000. Instead, he should have cleaned out Alice’s account entirely, and that of the other account holders, and then perhaps also corrupted or even crashed the bank’s computers.

With data integrity methods in place, however, it would still be clear when the fraud happened and what damage was done. The worst blame in all this would fall on the bank for not securing its technology against bad actors like Frank, who can be expected to be bad. The bank, however, is not expected to be digitally incompetent.

2.Faking authorization by Alice The money left Alice’s account, and there’s a record of Alice authorizing the transfer, but in fact Alice did not authorize it. This sort of fraud happens regularly with debit cards that are used at ATM machines or at stores to make purchases. The debit cards are stolen or cloned, and the bad actor Frank uses it, with Alice’s seeming authorization, until the fraud is discovered, after which he discards the card and likely attempts to repeat the fraud under another guise, unless or until he is caught.

With debit cards there’s a limit to how much the account can be debited. Common daily caps are $200 for ATM machines and $2,000 (plus or minus) for purchases. Thus there is a limit to how much damage Frank can do to Alice in such cases, the fraud usually being quickly detectable. In fact, because of FDIC insurance, Alice should be able to recover her loss by notifying the bank and issuing an affidavit that there was fraud on her debit card. A new debit card will be issued, and Alice’s account will be credited with the money that was stolen.

A debit card used to withdraw funds from Alice’s account serves as a proxy for Alice. It’s as though Alice is authorizing the withdrawal of those funds by means of the card. Someone who steals or clones the card is therefore essentially impersonating Alice, using the card to authorize, in Alice’s name, the withdrawal of funds.

However, for larger withdrawals, such as $10,000, a debit card won’t work. Any faked authorization for such a disbursement will require gaining hold of Alice’s identity to a greater of lesser extent. It could be as simple as getting into Alice’s online checking account via her username and password. It could also require getting hold of Alice’s “challenge questions,” posed during the login process to ensure that it really is Alice (e.g., “Where did you meet your significant other?”). And a two-step verification using Alice’s cell phone could add further safeguards to ensure Alice’s identity.

None of these security measures is foolproof. As a consequence, banks need to allow that such fraud can happen, much as they allow for and anticipate cloned debit cards, but also build in some damage control. An obvious place for such security measures is to limit what can be disbursed via online checking. If $10,000 is over the limit, then hacking into Alice’s online checking account won’t be able to transfer that amount. Indeed, Alice herself may want to place limits on the total amount of any single disbursement from online checking as well as any total over a given time frame.

Banks and credit card companies have also gotten good, via machine learning, at discerning patterns in the financial transactions of their users and flagging inconsistencies. This is not an exact science, yielding up false positives as well as false negatives. But it’s better than nothing. By setting a low threshold for false positives, and thus flagging a lot of seemingly suspicious transactions actually authorized by Alice, the banks minimize false negatives but also increase the inconvenience to Alice by more frequently having to query her, “Did you authorize this expenditure? Reply YES or NO.”

3.Other, less obvious tricks Frank still has two tricks up his sleeve to defraud Alice: paper checks seemingly signed by Alice and wire transfers in Alice’s name. Paper checks with Alice’s supposed signature will require stealing checks from Alice or counterfeiting them and then forging her signature. There is a danger here that fraudulent checks so used will cause money to disappear from Alice’s account, but precisely because there’s a real paper trail (and not a purely digital trail), the process of transferring the funds tends to be slow and the danger is mitigated. In attempting to deposit such a fraudulent check, Frank will likely face a bank that wants to hold it for a given time before releasing the funds and also to confirm with the issuing bank that it is legitimate. Thus Alice’s bank may even contact her to confirm the check’s legitimacy.

A wire transfer (and a cashier’s check), by contrast, remove funds immediately from Alice’s account and thus will require Alice, or someone the bank mistakes for Alice, to show up at the bank and authorize the wire transfer (or cashier’s check). That’s requiring quite a bit from the fraudster, though that’s not to say it can’t be done. But Frank, or an accomplice, will need to impersonate Alice and be able to jump through quite a few hoops in order to abscond with her funds. The degree to which the bank knows its customers will limit Frank’s ability to carry out this fraud.

We’ve now considered the main lines of attack by which Frank might defraud Alice, and where there’s a burden on Alice to protect her account (or ledger). Leaving aside cybersecurity safeguards put in place by Alice’s bank, which may be solid or less so, Alice’s main task is to protect her identity and keep Frank from co-opting aspects of her identity that would allow him to authorize disbursements from Alice’s account. Moreover, by putting caps on the amounts that may be disbursed from her account, even with varying levels of authorization, Alice supplies her account with further safeguards.

Other fraud is possible with Alice’s account, but the burden in these cases falls not on Alice. If Alice authorizes a disbursement to Bob and the amount is withdrawn from her account, but Bob never receives it because Frank has diverted it, Alice will have good evidence that she authorized the disbursement and intended to send it to Bob (by, say, verifying that she used the correct routing and account number to Bob’s bank). Alice has acted in good faith. The fact that Bob never received the money is on Alice’s bank, or Bob’s bank, or on intermediary channels through which the money needed to go but from which Frank managed to divert it. The possible cybersecurity failures here are immense and will need to be handled on a case-by-case basis.

Finally, there’s the inverse of the previous fraud, in which Bob authorizes a disbursement to Alice, has solid confirmation that he did indeed authorize it, sees his account debited accordingly, but Alice never receives the funds and can verify as much. Neither Alice nor Bob has done anything wrong, and the breakdown in cybersecurity must again be ascribed to the respective banks of Alice and Bob and any intermediate channels connecting the two. In either case, Alice authorizing a transfer of funds that leaves her account but never makes it to Bob, or vice versa, Alice and Bob have done everything in their power to protect themselves.

A postscript is now worth adding. I mentioned the FDIC, or the Federal Deposit Insurance Corporation, which provides insurance on people’s bank accounts, up to $250,000 for each account. If there is provable fraud on a bank account, with funds absent that should be there, banks are thus not only obliged but also ready to make up the difference because they can offload the cost to the FDIC. The point to note is that in the electoral context there is nothing like an FDIC. If there is fraud, the voter is left holding the bag.

If the voter’s ballot was lost or altered or if bogus ballots were mixed in with legitimate ballots, voters have no recourse to a third party like the FDIC to “make things right.” It’s up to the voter to prevent the fraud from happening in the first place. That’s why advice by the Roman orator Quintillian, suitably adapted, needs to apply to elections. In advising aspiring writers, Quintillian urged: “Write not so that you will be understood but write so that you cannot be misunderstood.” The lesson to voters is this: Don’t submit ballots in the hopes that they will be properly counted but submit ballots so bulletproof that they cannot be miscounted.

Next: Why voting is different from run-of-the-mill financial fraud (securing against election fraud)

You may also enjoy our earlier stories in this series:

How do we know financial transactions are honest? Let’s look at the steps we can take to find out. Let’s ignore microthefts, in which fractions of pennies are skimmed off an account at every transaction—almost unnoticeable—what about the big stuff?

How can we prevent financial or election fraud? Both contexts come down to an accounting problem, keeping track of money or votes over time. Let’s take two people, the famous Alice and Bob, used to demonstrate many propositions in math and science and think of them as candidates running for office.

and

How can ballots be both secret and fair? The secrecy of ballots would not be compromised if voters usedsome markers of their identity known only to themselves. Fickser: If you cast a ballot, it is your ballot. If the ballot is cast by someone else in your name, you deserve to challenge it and get it changed.