Fraudsters are becoming more sophisticated, and businesses are increasingly finding themselves in their crosshairs. Today's scams don't always begin with an obviously suspicious email or an unfamiliar caller. They may look like a request from your bank, a message from a coworker or an updated invoice from a longtime customer or vendor.

The most important thing your team can remember is simple: If payment instructions change, stop and verify before you send.

Fraud Prevention at a Glance

Before changing payment information or sending funds:

  • Verify independently. Confirm changes to account numbers, routing numbers, payees or payment instructions using trusted contact information you already have on file.
  • Check the sender carefully. Review the full email address for subtle misspellings, extra characters or unusual domains. Hover over the sender's email address and any links to see the true address or destination before taking action.
  • Don't click first. Do not click links or open attachments from unknown or suspicious senders. If a message appears to come from someone you know but seems unusual, verify it through another trusted method.
  • Don't rely on email alone. Even a legitimate email account can be compromised, allowing a fraudster to send convincing messages from someone you regularly communicate with.
  • Be cautious of urgency. Fraudsters often pressure employees to act immediately or bypass normal procedures.
  • Protect your credentials. BLC Community Bank will never ask for your password, token or fob code, or multi-factor authentication code.
  • Use dual approval when possible. A second review can help catch a fraudulent change before money leaves your account.
  • Monitor activity. Account alerts and regular transaction reviews can help identify suspicious activity quickly.

Download our Fraud Prevention at a Glance Flyer

Know What Today's Fraud Can Look Like

Fraud doesn't always begin with an obvious scam message. In many cases, the fraudster is intentionally trying to make the request look like part of your normal business.

When the "Bank" Calls

One tactic we're seeing involves fraudsters impersonating a financial institution and telling a business there is a problem with an ACH file or template.

The caller may sound knowledgeable and convincing. They may even know information about your business or banking relationship. They create urgency, stay on the phone while you log into online banking and instruct you to create or copy an ACH template, change a payee, or enter new account and routing information.

BLC Community Bank will never ask for your online banking password, token or fob code, multi-factor authentication code, or other login credentials. We will also never call and instruct you to change payee or account information in an ACH template at our direction.

If someone claiming to be from BLC asks you to take an action that doesn't feel right, hang up. Do not use a phone number, website link or contact information supplied by the caller. Instead, Contact Us to reach a known and trusted BLC team member.

When the Request Appears to Come From Inside Your Company

Another increasingly convincing scam involves impersonating an owner, executive, manager or coworker.

An employee may receive what appears to be a legitimate email, Teams message or phone call asking them to update ACH information, change a payment template, add a new payee or quickly send money.

Don't assume a familiar name means the request is legitimate. Before acting, look closely at the sender information. Fraudulent email addresses can be designed to look nearly identical to legitimate ones, sometimes changing only a letter, adding a character or using a slightly different domain.

Hover over the sender's email address and any links in the message to see the true address or destination. Do not click links or open attachments from unknown or suspicious senders.

If a request changes where money is going, verify it using a second, trusted communication method. Call the employee at a number already on file, speak with them in person or contact them through an established internal channel.

A familiar name on a message is not enough verification when money is moving.

This extra step is especially important when a request is unexpected, unusual or urgent. Business email compromise schemes frequently rely on impersonating a trusted person and creating pressure to act quickly. The FBI recommends independently verifying requests to send money and changes to account numbers or payment procedures.

When a Customer or Vendor Changes Banking Information

Consider this scenario: A customer or vendor you've worked with for years sends an email explaining that they've changed banks. They provide a new routing number and account number and ask you to use the new information for the next payment.

It sounds reasonable. The email may even come from the person's real email account.

That's exactly why these scams can be so effective.

A fraudster may have gained access to your customer's or vendor's email and waited for the right opportunity to insert fraudulent payment instructions into an otherwise legitimate conversation. This is commonly known as business email compromise (BEC).

Establish a callback procedure for changes to payment information. Call your customer or vendor using a phone number you already have on file, not a number provided in the email requesting the change, and verbally confirm the new instructions.

For higher-dollar or unusual transactions, consider requiring approval from a second employee before making the change. A five-minute verification call can prevent a very expensive mistake.

Unexpected Money Can Be a Warning Sign, Too

Fraud isn't always about money leaving your account unexpectedly. Sometimes the first warning sign is money coming in.

Be cautious if your business receives an unexpected ACH credit, particularly if someone then contacts you and asks you to quickly forward, return or redirect the funds to another person or account.

Before moving unexpected funds, determine where they came from and contact your financial institution for guidance. Fraudsters often try to move stolen money quickly from one account to another.

Don't forward, return or redirect unexpected funds based solely on instructions from the person contacting you. Contact BLC first so we can help you determine the appropriate next step.

Put Stronger Controls Around Your Payments

Good fraud prevention doesn't rely on one employee spotting one suspicious message. Businesses should create processes that make fraudulent payment changes harder to complete.

Consider building these practices into your company's payment procedures:

  • Requiring independent verification for changes to payment instructions.
  • Establishing callback procedures for customers and vendors.
  • Reviewing sender email addresses and link destinations before acting on requests.
  • Using dual control or secondary approval for ACH and other payment activity when available.
  • Limiting system access based on each employee's job responsibilities.
  • Using account alerts and reviewing transactions regularly.
  • Training employees who handle invoices, payroll, ACH, wires and other payments on current fraud tactics.

Most importantly, give employees permission to stop the process and ask questions. A request to slow down and verify a payment should be viewed as good risk management, not an inconvenience.

Put Your Treasury Management Tools to Work

Technology can add another important layer of protection.

BLC's Positive Pay solution includes both Check Positive Pay and ACH Positive Pay. The system can identify transactions that don't match established information or authorization rules and allow businesses to review exceptions before deciding whether an item should be paid or returned.

Learn more about BLC Treasury Management and Positive Pay

Your company's needs will depend on how you receive funds, make payments and divide responsibilities among employees. BLC's Treasury Management team can help you review your current processes and discuss solutions that may strengthen your fraud prevention strategy.

If Fraud Happens, Act Quickly

One of the most important things to understand about payment fraud is that preventing the transaction is much easier than recovering the money afterward.

Once your business approves a transaction and funds are sent, recovering them may be difficult. BLC can work with the receiving financial institution to attempt to recover fraudulent funds, but recovery is not guaranteed.

If you believe you've sent money as part of a scam or notice a transaction you don't recognize, contact BLC immediately.

Don't wait until the next business day or until you've completed your own investigation. When fraud is involved, acting quickly matters.

When Something Changes, Ask Questions

You know your business, employees, customers and vendors better than anyone.

If a familiar process suddenly isn't working, payment information changes unexpectedly, an email address looks slightly different, someone pressures you to act immediately, or a request simply doesn't feel right, trust that instinct.

You can never ask too many questions when money is moving.

Stop. Verify. Then send.

Want to strengthen your company's fraud prevention procedures? Connect with BLC's Treasury Management team to discuss Positive Pay, payment controls and other tools available to help protect your business.

And if you know another business that could benefit from these fraud prevention reminders, please share this resource with them. Protecting our local businesses helps protect our entire community.