As technology continues to help businesses become more efficient, this same advantage also benefits cybercriminals carrying out fraudulent schemes. The Association of Certified Fraud Examiners (ACFE) conducted a study to measure financial loss by company size, which revealed that companies with fewer than 100 employees had the second-largest reported financial loss among organizational size categories. While smaller organizations often have smaller budgets and revenue, this can be detrimental.

The ACFE report highlights another startling statistic: this type of fraud often goes undetected for a full year. With sophisticated financial crimes costing businesses billions of dollars, it’s imperative to know how to detect and prevent fraud, and to ensure your colleagues and employees follow suit. Here’s what to watch out for, and how to protect your organization’s financial security.

Playing on emotions

Cybercriminals are constantly finding new ways to persuade people into unveiling compromising information. Thieves thrive on the ability to rush or scare people into action. From spoofed emails to phony phone calls impersonating a trusted source, cybercriminals use social engineering to uncover sensitive data. Sometimes, even a seemingly harmless question can help unlock key information.

“When you receive an impersonation call, the cybercriminals are instilling fear and anxiety by making you believe you’re going to lose something,” explains Tim Murphy, Director of Fraud Transaction Monitoring at Wintrust Financial Corporation. “Then they’re right there to ‘help’ fix their manufactured panic.”

Murphy explains they’ll use a variety of tactics—pretending to be your bank, the government, or a company you work with, often asking if you’ve made a specific transaction they’ve created. When you inevitably don’t recognize this transaction, it’s easy to be caught off guard. Then they’ll often say they just need your username and password, or they’re going to send you a one-time passcode. It’s important to remember you should never share your one-time passcode or password. Once scammers receive this information, they’ve successfully achieved access to your account.

“I try to coach people using a three-step process: pause, think, and verify,” says Murphy. “Don’t just react. If you didn’t initiate the call, hang up and call your bank directly.”

Red flag recap

You know that feeling when, for a split second, something feels off? Never ignore that—it’s always better to take the time to confirm information. Scammers are relying on people to panic and succumb to their tactics.

• Immediacy: If you feel rushed, it’s likely manufactured in an effort to disorient you
• A request for confidential information: Do not share your one-time passcode or username/password if you did not initiate the call. Banks—including ours—will never ask you for your login credentials
• Specific modes of payment: Your guard should be up if you receive a request to pay via Bitcoin or gift card

Fake, fake, fake—listings, invoices, checks, and more

Just because you receive an invoice doesn’t mean you ordered the product or service. Scammers often create phony invoices, knowing the person paying the bills is often not the person who has made all the purchasing decisions. Scammers also may attempt to confirm an “existing” order that doesn’t exist, offer to send something for “free,” or include your information as a “free listing,” only to bill you later. If you receive merchandise you did not order, you are not required to pay for the item.

Another common scheme is posing as tech support. Whether it’s a pop-up message or a call, scammers can pretend to be from a well-known company, telling you there’s a problem with your computer security. They’re looking for access to your computer to procure passwords, customer records, credit card information, and other sensitive data, or to enroll you in a fake maintenance program.

Verifying information is key. Call your tech company directly and never give out information before confirming who is really on the other end of the line. Don’t act solely on an email, or call a number listed in an email. Scammers often provide numbers impersonating a company, feeding directly into their elaborate measures to pose as a credible institution.

Take a proactive approach

Provide your staff with training, and not just the staff handling books. Remember, scammers often play the long game through social engineering tactics, and any employee can play a role in accidentally helping them to uncover pertinent information. Fraud awareness training is linked to faster detection and lower losses, as the ACFE notes that organizations that did not provide training lost nearly twice the amount of money. 

“It’s so important for small businesses to educate themselves on regulations—particularly Regulation E—and to know the difference between a push and pull payment, and be aware of the lack of protection for businesses,” says Brian Mivelli, Vice President, Senior Manager Fraud Investigation at Wintrust Financial Corporation. “Make sure you’re taking advantage of the security suites offered by your bank.”

These types of tools can help to protect your company, such as dual control, ACH origination, and robust i-BusinessBanking®¹ products. Wintrust offers Positive Pay and Reverse Positive Pay to stay ahead of fraudulent checks, as well as ACH Positive Pay to block unauthorized ACH debits. With a suite of business banking solutions, we can help you keep your business safe.

“Wintrust really provides white-glove treatment,” says Mivelli. “You’ll know exactly who you’re working with and can call your banker directly if you’re ever concerned about an unexpected transaction.”

Wintrust knows what it takes to run, protect, and grow your business—explore the Business Banking solutions that make a difference.

Find out more about keeping your accounts safe and secure.