J.P. Morgan, Chubb Insurance and PaymentWorks recently came together for an enlightening panel discussion on the state of fraud today. The bad news? Fraud isn’t going away – in fact, the FBI tells us it’s a $43 billion dollar problem. The good news: There are tangible things you can do to protect yourself and your organization.

Here are my top 3 takeaways from the discussion that will help you stay vigilant and prevent a social engineering fraud from costing your business millions.  

Last week, I had the honor of presenting at the TMANY 2022 Cash Exchange Conference alongside Christopher Arehart, SVP, First Party Product Manager, North America Financial Lines at Chubb.  We had one hour to share with treasury professionals everything we wanted them to know about vendor impersonation frauds, why they are successful, and how to address organizational risk in the vendor onboarding and management process.  (For the record, I believe Chris and I could actually speak for a solid six hours on this subject, so it was a tall order to fit it into 60 minutes!)

For those of you who were not able to attend the exceptional TMANY event, I offer the following quick takes on our subject:

1. A good vendor impersonation scam will be impossible for your staff to spot. (Yes, impossible).
2. Social engineering losses are generally not covered by crime or cyber insurance policies (or if they are, they have very low limits).
3. If you cannot audit your vendor onboarding and change process, then it’s not actually a process, and it’s likely not insurable.

Let's dig in.

The 2021 numbers are in... and fraudsters are still gonna fraud.

Both the Association of Financial Professionals 2022 Payments Fraud and Controls Survey and the FBI's Internet Crime Report for 2021 recently published, and while there were no big surprises, there were a couple of points that are worth pondering.

In an effort to stay competitive U.S. banks are budgeting big money on tech updates in 2022!

JP Morgan Chase recently announced plans to spend most of its new project budget – a number close to $15 billion – on tech plans as a necessary means to meet customer expectations and compete with other banks and fintechs who are making innovative use of tech. 

So exactly what type of technology are these dollars being spent on? 

All the cybersecurity tools in the world aren’t going to protect your organization from a fraudster who has succeeded in getting your employee to believe a scam.

It’s no secret that fraudsters have figured out how to trick even the most diligent and well-trained employee into believing that they are dealing with their actual vendor. Once they’ve done that, it’s just a matter of time until banking information is changed and the fraudster runs off with money that was intended for your supplier. 

The aftermath of such an event isn’t pretty: bad press, lost jobs, damaged reputations.

Here are three common ways that fraudsters will attempt to trick your employees- and what you should watch out for.

Our recent live event, Social Engineering Fraud and Your Vendor Master - Managing the Risk, brought together industry experts – Taylor Nemeth, Head of Payments at PaymentWorks, and Christopher Arehart, SVP and Product Manager of Crime, Financial Fidelity, Kidnap/Ransom and Extortion at Chubb Insurance. (The dynamic duo also happen to be co-authors of the recent white paper “Guarding Against Social Engineering Fraud." Please download a free copy!)

They took a deep dive into the increasingly hot topic of business payments fraud, which they agree is, at the core, an identity problem. This identity problem happens to be a multi-billion-dollar problem which can be attributed to the combined effect of the fact that 300+ billion emails are being exchanged every day across businesses and individuals and that 30% of existing suppliers are changing their information over the course of a year (PaymentWorks database statistic, 2021). This has added up to $28 billion in losses with an average incident loss of over $150,000 (from 2016-2020), a number which has doubled in 2021! (FBI Internet Crime Report 2021.)

The big question on everyone’s mind is how can organizations avoid this problem and avoid the financial and reputational loss that comes with it? Here, we offer you the top three takeaways from this electric and informational event.

Think your bank account verification process confirms ownership? Think again.

How procurement and finance departments verify banking information generally falls into these three buckets:

1. Collecting a voided check or account info on bank letterhead
2. Calling the vendor to confirm the change
3. Multi levels of internal approvals for changes

All of these seem, on the surface, to be solid, but are not infallible in defending the vendor master from infiltration by fraudsters.  If your organization is relying on any of these three ways to ensure the validity of your vendor master file's banking info, you are likely leaving holes wide enough for a fraudster to walk right in. 

Let’s break each one down:

Julie-Anne White isn't going to argue that having a clean vendor master file is more important to a company than generating sales and growing revenue. (Because it isn't.)

But that doesn't mean the financial industry veteran thinks companies should penny pinch by failing to devote resources to vendor management. (Because they shouldn't.)

We interviewed Julie-Anne on the importance of accurate vendor information for our Risky Business podcast.  You can listen to the entire interview here.

Cyber criminals stole more than $28 billion through email fraud from 2016-2020, according to the FBI.  Let that sink in.