Think your bank account verification process confirms ownership? Think again.

How procurement and finance departments verify banking information generally falls into these three buckets:

1. Collecting a voided check or account info on bank letterhead
2. Calling the vendor to confirm the change
3. Multi levels of internal approvals for changes

All of these seem, on the surface, to be solid, but are not infallible in defending the vendor master from infiltration by fraudsters.  If your organization is relying on any of these three ways to ensure the validity of your vendor master file's banking info, you are likely leaving holes wide enough for a fraudster to walk right in. 

Let’s break each one down:

Author note: I had the pleasure of meeting Kristen Drobnis during this past summer.  She was gracious with her time and passionate about risk.  This combination intrigued me so much I immediately asked her if she would be on our podcast.  This podcast and blog are taken from our interview in August 2021.

As the Chief Risk and Privacy Officer for Commonwealth Financial Network, one of the largest privately-held broker dealers in the United States, Kristen Drobnis understands risk as well as anybody. 

And while the word ‘risk’ itself conjures up images of theft, fraud and other treacherous topics, Kristen brings a calm and measured approach to this fascinating industry.

PaymentWorks sat down with Kristen to discuss many topics, including why she loves her job, how to deal with fraudsters intent on playing the long game, and what element of dealing with risk keeps her up at night.

You can listen to the entire podcast here.

As promised, we have our ‘counterpoint’ to last week’s blog. This week it’s your turn AP!  There is so much you can learn from your peers in procurement. I cannot wait to dive in!  (Side note: finding just the right image in stock art kept me up late last night.  Please enjoy this wonderful team huddle.)

At PaymentWorks we love Procurement and AP equally. We have amazing champions and customers in both areas, and our platform has strategic benefits to both functions.  Yet, we are constantly surprised that these two seemingly made-for-each-other departments don't always appreciate all they do in support of each other.

So we thought we'd take a stab in this two part series at playing 'counselor' to this couple, and walk through just how much they could learn from each other.

Let's begin.

John Wilkerson is so passionate about the American Rescue Plan Act it feels like family to him.

"This has become my life's work," he says. "I will not have any more kids, I can't imagine, but if I do I will name it ARPA after the American Rescue Plan Act."

Listen to our entire podcast with John Wilkerson here.

If you think he's kidding, guess again. Wilkerson has served the last 15 years as general counsel to the Arkansas Municipal League and takes great pride in helping 500 cities and towns across Arkansas develop and implement strategies to become stronger financially.

ARPA was passed by Congress in response to the Covid-19 Pandemic, and while one big bucket of the funding must go towards fighting Covid, there's much more that can be done with the money that Congress has allocated.

All day long we hear from customers and prospects alike that their vendor master data is ‘a mess’, ‘out of date’ and ‘full of duplicates’.  We have published in the past about the hidden ways your vendor master is costing your organization with both fraud risk and compliance issues, but we understand that many organizations find it to be a challenge to quantify those risks in dollar terms when working towards making an investment in automation and clean up. 

We get it, it can be overwhelming to nail down the myriad ways a messy vendor is costing your organization.  We’ve spoken with countless customers and prospects and gathered for you these three factors you can, and should, consider when creating your cost/benefit analysis.

In the course of building our network and our platform, we did what product people do: we talked to the market.  When it comes to the risk associated with vendor onboarding, everyone we spoke to was united.  However, when it came to how to solve it, consensus was elusive. Vendor management, AP and Procurement personnel know they should not trust banking information that arrives via email.  That is a given. To solve this most seem to focus verifying vendor banking information.  But what, exactly, does that mean?

How banking information gets 'verified', generally falls into these three buckets:

1. Collecting a voided check or account info on bank letterhead
2. Calling the vendor to confirm the change
3. Multi levels of internal approvals for changes

All of these seem, on the surface, to be solid, but are not infallible in defending the vendor master from infiltration by fraudsters.  The devil, as they say, is in the details. If your organization is relying on any of these three ways to ensure the validity of your vendor master file's banking info, you are likely leaving holes wide enough for a fraudster to walk right in.

Our CTO and co-founder Alan Greenblatt answers all the questions from Threat.Technology about who we are at PaymentWorks, and where we are going.

We talk a lot (I mean A LOT) around these parts about the constant threat posed to organizations when it comes to business payments fraud.  And you can see why:

• 74% of companies reported they were the target of an actual or attempted payments fraud scam in 2020- AFP Payments Fraud and Controls Survey, 2021
  
  
• Email compromise scams accounted for $2B in losses in 2020 - FBI Internet Crime Report, 2021
  
  
• 62% of financial losses due to social engineering frauds were the result of either an absence of controls, human error, or a process not being followed- Willis Towers Watson database statistic, 2020

The problem is, numbers this huge can tend to make a problem seem unknowable and unsolvable.  Especially since we very rarely get to learn exactly what happened. When an organization suffers financial losses due to a fraudster, they are usually unwilling or unable to share the details publicly, so the financial community as a whole doesn’t get to learn anything that could help them to avoid the same fate. 

Until now.