J.P. Morgan, Chubb Insurance and PaymentWorks recently came together for an enlightening panel discussion on the state of fraud today. The bad news? Fraud isn’t going away – in fact, the FBI tells us it’s a $43 billion dollar problem. The good news: There are tangible things you can do to protect yourself and your organization.

Here are my top 3 takeaways from the discussion that will help you stay vigilant and prevent a social engineering fraud from costing your business millions.  

Vendor Onboarding 101: How to Build a More Secure and Compliant Process

Top 3 Take-Aways from Our Live Event with AP Guru, Debra R. Richardson

We recently had the pleasure of talking to Debra R. Richardson, LLC., who is using her 20+ years of experience in AP, AR, general ledger and financial reporting for Fortune 500 companies to help AP teams implement authentication

techniques, internal controls and best practices to prevent fraud in the vendor master file. She also has a weekly blog and hosts the podcast: “Putting the AP in hAPpy”.

Last week, I had the honor of presenting at the TMANY 2022 Cash Exchange Conference alongside Christopher Arehart, SVP, First Party Product Manager, North America Financial Lines at Chubb.  We had one hour to share with treasury professionals everything we wanted them to know about vendor impersonation frauds, why they are successful, and how to address organizational risk in the vendor onboarding and management process.  (For the record, I believe Chris and I could actually speak for a solid six hours on this subject, so it was a tall order to fit it into 60 minutes!)

For those of you who were not able to attend the exceptional TMANY event, I offer the following quick takes on our subject:

1. A good vendor impersonation scam will be impossible for your staff to spot. (Yes, impossible).
2. Social engineering losses are generally not covered by crime or cyber insurance policies (or if they are, they have very low limits).
3. If you cannot audit your vendor onboarding and change process, then it’s not actually a process, and it’s likely not insurable.

Let's dig in.

In the course of building our network and our platform, we did what product people do: we talked to the market.  When it comes to the risk associated with vendor onboarding, everyone we spoke to was united.  However, when it came to how to solve it, consensus was elusive. Vendor management, AP and Procurement personnel know they should not trust banking information that arrives via email.  That is a given. To solve this most seem to focus verifying vendor banking information.  But what, exactly, does that mean?

How banking information gets 'verified', generally falls into these three buckets:

1. Collecting a voided check or account info on bank letterhead
2. Calling the vendor to confirm the change
3. Multi levels of internal approvals for changes

All of these seem, on the surface, to be solid, but are not infallible in defending the vendor master from infiltration by fraudsters.  The devil, as they say, is in the details. If your organization is relying on any of these three ways to ensure the validity of your vendor master file's banking info, you are likely leaving holes wide enough for a fraudster to walk right in.

We talk a lot (I mean A LOT) around these parts about the constant threat posed to organizations when it comes to business payments fraud.  And you can see why:

• 74% of companies reported they were the target of an actual or attempted payments fraud scam in 2020- AFP Payments Fraud and Controls Survey, 2021
  
  
• Email compromise scams accounted for $2B in losses in 2020 - FBI Internet Crime Report, 2021
  
  
• 62% of financial losses due to social engineering frauds were the result of either an absence of controls, human error, or a process not being followed- Willis Towers Watson database statistic, 2020

The problem is, numbers this huge can tend to make a problem seem unknowable and unsolvable.  Especially since we very rarely get to learn exactly what happened. When an organization suffers financial losses due to a fraudster, they are usually unwilling or unable to share the details publicly, so the financial community as a whole doesn’t get to learn anything that could help them to avoid the same fate. 

Until now.

Julie-Anne White isn't going to argue that having a clean vendor master file is more important to a company than generating sales and growing revenue. (Because it isn't.)

But that doesn't mean the financial industry veteran thinks companies should penny pinch by failing to devote resources to vendor management. (Because they shouldn't.)

We interviewed Julie-Anne on the importance of accurate vendor information for our Risky Business podcast.  You can listen to the entire interview here.

"I feel as if I am holding a hand grenade with the pin pulled."

This is an actual quote from one of our customers, before she was a customer.  We hear versions of this all of the time when we speak to prospects. People are scared. 

Cyber criminals stole more than $28 billion through email fraud from 2016-2020, according to the FBI.  Let that sink in.

We were thrilled to contribute to Informa’s Fraud Intelligence publication with an article to explore how locking down your vendor master can significantly help eliminate the risk of an increasingly costly threat – business payments fraud.

Increasingly savvy fraudsters have noticed and exploited all that is involved with vendor onboarding and maintenance fueling a significant increase in fraud attempts over this past year.

Read the article here.

David Kurrasch, President of Global Payment Advisors and a Financial Service consultant with decades of experience in the payments industry, recently sat down with us for a lively and far ranging conversation around ACH, banks and payments fraud risk.  Excerpts are below.

Dave Kurrasch, President of Global Payments Advisors, has worked in corporate treasury, banking and consulting for over 40 years. His career started as a cash manager at a large, diversified corporation where he ran the day-to-day cash desk, short term borrowings and investment, and bank relationships. Dave joined Wells Fargo Bank as Vice President and National Sales Manager for the Bank’s Treasury Management Division and later was promoted to Senior Vice President in charge of the Bank’s Treasury Management Product Development and Management operations. Dave and his team were responsible for all product development, risk and fraud management, unit costing and profitability analysis.

After 15 years at Wells Fargo, Dave founded Global Payments Advisors in 1997 and has provided consulting advice and contracting services to banks, corporations, universities, governments and FINTECH start-ups in the United States, Canada, Europe and Asia. He has deep experience in all facets of treasury management, payments, risk and fraud management and their statutory/regulatory compliance.