Managing the identity information for vendor onboarding and maintenance is extremely challenging (and costly!).

SCAM II: Vendor Email Compromise

While the spoof fraudsters took the time to get some details right, in the end they could have easily been spotted with some rudimentary checks put in place.  With a vendor email compromise,  fraudsters are quite a bit more sophisticated.

It begins by actually infiltrating your vendor’s email (1), usually by way of malware- getting an employee at Acme Plumbing to inadvertently click on a link that grants the fraudster the ability to access and control the email accounts of certain (or all!) employees at Acme.

These types of fraudsters are usually quite patient.  They take their time and read through emails, particularly focused on customer communications and billing inquiries.  When they have gathered enough information, and have the timing to know when a big invoice is due to be paid, they strike, almost always adding an additional touch of urgency. (2)

Everything about this email seems perfectly legit.  The name and address match with you have been corresponding with all along.  The attached invoice is identical.  There is very little, if anything, to indicate this email is not from Marty Jones at Acme Plumbing.

Taking it further, a fraudster may also opt to add authenticity by following up on a previous correspondence. (3)

You will rarely have cause to doubt this correspondence, in particular if your organization relies on email as a primary source of authentic, verifiable information.  The fraudster’s invoice and late fee knowledge, coupled with the email being a response to a previous thread are usually enough to push through a $47,000 payment to the wrong bank account.

 

SCAM III: The Business Email Compromise

There are plenty of accounts payable staff with training in how to spot fraudulent attempts, and with processes in place to verify banking changes, but when relying on humans as a defense, it only takes one moment of human-ness to cost your company dearly. 

One of the most effective means of stealing funds is to have the direction come from within one's own company.

In these cases, much like with vendor email compromise, a fraudster gains access to a company’s email system by getting an unwitting employee to click on a link.  Once they have access, they watch and wait.  When they see a big vendor payment coming due, they strike, as always, adding specific and significant real details to sell the fraud. (1)

Everyone at the firm likely got an email from the CEO letting them know she would be out for the holiday weekend, and that she could only be reached by email.  Everyone also likely knows about her house in the mountains. What we have now is an AP staff who might know that to do this is breaking protocol on the vendor set up and account verification process, but the CEO is asking, and making it not only real, but also really urgent to comply.  

 

  

SCAM IV: The “Deep Fake” Phone Call

Artificial Intelligence (AI) has arrived as a tool recently starting to gain traction with criminals.  In 2019, we all learned about the first big heist using AI to mimic the voice of a company's CEO on a phone call.  The fraudster successfully mimicked the real CEO’s voice in a call to an employee, and was able to direct the employee to immediately transfer funds to a new supplier.  Very few employees would question such a call, leaving a huge potential fraud vector for criminals to exploit.  If you are currently without the proper controls in place for an employee to rely on when he or she gets an unexpected call with directions like this, your funds are in danger of being stolen.

 

Deep Fake: synthetic media in which a person in an existing image, audio recording or video is replaced with someone else's voice or likeness

 

SCAM V: The Fake Invoice 

Perhaps the oldest trick in the book, the fake invoice still is proving to be surprisingly effective at organizations with lax controls for vendor onboarding.  Typically a fraudster will send a fake invoice for a fake company having done fake work, and the

invoice gets paid.  It’s that simple- at least at an organization where invoices are paid out prior to a vendor’s credentials being vetted and a PO being issued, or where existing processes regarding onboarding are simply not followed.  In 2019, Google and Facebook lost a combined $100M to the same fraudster using this method.  They each paid out multiple invoices over a period of months to the same fake company. No one is immune!

 

 

 

---

What You Can Do About It

 

            

 

Vendor Invitations and Approvals

---

Start at the foundation of your vendor onboarding process: inventory who at your organization currently can initiate business with a new vendor, and document (or revisit the documentation regarding) controls in place for adding new vendors.  

 

 

Questions to answer:

• • • • • Do people at your company have free rein to determine who they want to do business with?  
        • Do you have controls in place to limit the number of vendors you do business with in a particular vertical, for example: how many different office supply vendors do you use? 
        • Do you have controls in place regarding inviting or approving new vendors?
        • Can business be initiated prior to an approval and onboarding of the vendor?
        • Is your process followed?

 

Social Engineering: the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes

 

Re-Examine Your Existing Controls

---

You likely already have controls in place that prevent a single person from adding and approving new vendor information and invoices.  We challenge you to re-examine these controls to determine fraud vectors that could be exploited by bad actors, both inside and outside your company walls.  This examination should be done with regularity as new fraud vectors can be discovered and exploited at any time.

 

 

Fraud Vector: a path or a means by which a fraudster is able to exploit a system or process vulnerabilities, including human ones, in an effort to divert funds, aka: an open door to steal your money.

Questions to answer:

• • • • • Who specifically, or which department, owns the vendor onboarding process?
          • Are those owners responsible for gathering the required vendor identity credentials such as W9, Tax IDs, insurance documents, or does that fall to departments?
          • Are those responsible trained to spot obvious fraud attempts, fakes and forgeries?
          • Are those responsible trained in detecting social engineering attempts?
        • Do you have controls in place regarding who has access to vendor identity details?
        • Do you have controls in place regarding who has access to changing vendor identity details?
        • Do you have controls in place for the minimal acceptable standard for changing existing vendor identity elements?
        • Are you using 3rd party partners to verify the authenticity of the submitted credentials?

 

Have an Audit Trail

---

Too often after a payments fraud, or even an attempted payments fraud, companies are often stuck trying to piece together what exactly happened: who approved this vendor, when did the change come in, how was it communicated? 

 

 

Questions to answer:

• • • • • Can you clearly chart the vendor onboarding process, including who invited and who approved the new vendor?
        • If approvals are needed from myriad departments (conflict of interest from HR, sanctions alerts from compliance, insurance documentation from risk), are the approvals time stamped, collected and stored in a centralized location?
        • Are you collecting and storing the required vendor identity documentation with expiration date notifications in place?

 

You can download a pdf of the these five focus areas and the associated questions here:

 

When you have all five of these elements in place:

1. 1. Vendor invitations and approvals
   2. Regular examinations of your existing controls
   3. An audit trail
   4. Identity element verification
   5. Insurance

You can begin to have peace of mind that your previously existing fraud vectors have all been sealed off.  Even so, you should regularly audit your entire process start to finish to apply new learnings and root out previously unforeseen vulnerabilities.  

These sorts of efforts take time, resources and a collective agreement that payments fraud protection is a key objective of your finance department.  If that hill seems too steep to climb, there are three key things you can do right now to fortify your defenses.  Follow our simple plan and have an impact in less than 30 days.

 

 

 

READ MORE:

Email Scams: Still Trendy After All These Years

Business Payments Fraud in Times of Crisis

Targeted: Higher Education and Business Payments Fraud

 

LISTEN TO RELATED PODCASTS:

The evolution of risk and why it's so hard to stop payments fraud