J.P. Morgan, Chubb Insurance and PaymentWorks recently came together for an enlightening panel discussion on the state of fraud today. The bad news? Fraud isn’t going away – in fact, the FBI tells us it’s a $43 billion dollar problem. The good news: There are tangible things you can do to protect yourself and your organization.

Here are my top 3 takeaways from the discussion that will help you stay vigilant and prevent a social engineering fraud from costing your business millions.  

Last week, I had the honor of presenting at the TMANY 2022 Cash Exchange Conference alongside Christopher Arehart, SVP, First Party Product Manager, North America Financial Lines at Chubb.  We had one hour to share with treasury professionals everything we wanted them to know about vendor impersonation frauds, why they are successful, and how to address organizational risk in the vendor onboarding and management process.  (For the record, I believe Chris and I could actually speak for a solid six hours on this subject, so it was a tall order to fit it into 60 minutes!)

For those of you who were not able to attend the exceptional TMANY event, I offer the following quick takes on our subject:

1. A good vendor impersonation scam will be impossible for your staff to spot. (Yes, impossible).
2. Social engineering losses are generally not covered by crime or cyber insurance policies (or if they are, they have very low limits).
3. If you cannot audit your vendor onboarding and change process, then it’s not actually a process, and it’s likely not insurable.

Let's dig in.

At PaymentWorks, we are passionate about secure vendor onboarding as the lynchpin of secure payments.  When nearly three quarters of organizations have actual or attempted payments fraud scams aimed at them, we know that finding ways to gain peace of mind when it comes to avoiding these scams is keeping a lot of you up at night.  

Think your bank account verification process confirms ownership? Think again.

How procurement and finance departments verify banking information generally falls into these three buckets:

1. Collecting a voided check or account info on bank letterhead
2. Calling the vendor to confirm the change
3. Multi levels of internal approvals for changes

All of these seem, on the surface, to be solid, but are not infallible in defending the vendor master from infiltration by fraudsters.  If your organization is relying on any of these three ways to ensure the validity of your vendor master file's banking info, you are likely leaving holes wide enough for a fraudster to walk right in. 

Let’s break each one down:

As promised, we have our ‘counterpoint’ to last week’s blog. This week it’s your turn AP!  There is so much you can learn from your peers in procurement. I cannot wait to dive in!  (Side note: finding just the right image in stock art kept me up late last night.  Please enjoy this wonderful team huddle.)