Small Business Shared Interest Group

Hi everyone,

Recently, there’s been a significant uptick in fraud incidents targeting small businesses. Fraudsters are becoming increasingly creative and aggressive, posing not only a financial threat but also a risk to our reputations and customer trust.

In addition to the constant barrage of phishing emails, check fraud and ACH fraud have become more prevalent.

Here are my first-hand experiences:

Case 1: A vendor check was intercepted in the mail and altered through check washing. The theft was realized when the vendor reached out to collect the balance, at which point a copy of the canceled check was pulled for review. This occurred before Positive Pay became a standard security measure.

Case 2: ACH information was emailed to a client, who accessed it over public Wi-Fi. A fraudster intercepted this information by creating a lookalike domain—changing the letter "o" to the number "0." The fraudster then sent the client "updated" ACH details, claiming a new bank account had been established. Unfortunately, the client wired a significant sum to the fraudster.

To combat these threats, implementing measures like Positive Pay can help detect and prevent unauthorized transactions. Additionally, using encrypted email can protect against interception and alteration of confidential information.

Let’s share our experiences and best practices to help each other stay protected. I’m curious to hear from other accountants and small business owners: What measures are you taking to safeguard your businesses? Have you encountered any fraud attempts recently, and how did you handle them?

Looking forward to your insights!

------------------------------
Jennifer Pinder, MBA
Controller
Watchdog USA, LLC
Philadelphia, PA
United States
------------------------------

I've used Positive Pay before.  Very effective and well worth the time & effort!

------------------------------
Jason Sellnow CMA, CSCA
------------------------------

I agree with you, Jason!  We use it now and I think it is great. No more worries about stolen checks...  It is easy to upload the check runs into our bank using a CSV file, so a small burden in exchange for a huge safety net.

------------------------------
Jennifer Pinder, MBA
Controller
Watchdog USA, LLC
Philadelphia, PA
United States
------------------------------

Original Message:
Sent: 09-22-2024 02:40 PM
From: Jason Sellnow
Subject: Uptick in check and ACH fraud

I've used Positive Pay before.  Very effective and well worth the time & effort!

------------------------------
Jason Sellnow CMA, CSCA
------------------------------

@Sampada Wadekar Please let us know how your ACH situations turns out, and good luck! 

------------------------------
Jennifer Pinder, MBA
Controller
Watchdog USA, LLC
Philadelphia, PA
United States
------------------------------

Original Message:
Sent: 09-22-2024 02:40 PM
From: Jason Sellnow
Subject: Uptick in check and ACH fraud

I've used Positive Pay before.  Very effective and well worth the time & effort!

------------------------------
Jason Sellnow CMA, CSCA
------------------------------

Thanks for sharing this information Jennifer, its absolutely worth reading. Currently our bank is investigating an ACH that was initiated by our client 10 days ago, which we have not received yet into our bank. I hope all turns out well. I will definitely make sure to implement one of the two measures to safeguard the business.

------------------------------
Sampada Wadekar CMA
Financial Controller
Mississauga ON
Canada
------------------------------

I have had several bad experiences with positive pay that have solidified my opinion to never use that service. When your power company shuts down your account and refuses to accept payment except through a wire because of several denials of payment with positive pay, it's time to rethink the process.

That being said, there definitely needs to be a checks and balance system in place to verify payments. The first thing I do whenever I get new bank information is to call the vendor and verify the information over the phone. Be sure to use a phone number from a different email than the one with the new bank information to avoid fraudulent phone numbers. Another option to avoid fraud is to not use checks at all. If your bank does not offer ACH payments, I have an online one that does, with NO ACH fees.

I have had two separate checks from clients that were washed and attempted to be cashed. One went through but was caught a month later. Another was caught by the bank itself the next day and automatically canceled. Needless to say, I've requested my clients to switch to ACH payments to avoid these problems. I only pay my vendors via ACH or credit card myself. The only check I have ever written in my company was an $0.08 to the IRS. I wasn't happy that I had to buy 200 checks for that single check.

------------------------------
David Belnap, CMA, CSCA, CPA
Belnap Accounting
Hollywood FL
United States
------------------------------

Original Message:
Sent: 10/8/2024 10:09:00 PM
From: David Belnap
Subject: RE: Uptick in check and ACH fraud

I have had several bad experiences with positive pay that have solidified my opinion to never use that service. When your power company shuts down your account and refuses to accept payment except through a wire because of several denials of payment with positive pay, it's time to rethink the process.

That being said, there definitely needs to be a checks and balance system in place to verify payments. The first thing I do whenever I get new bank information is to call the vendor and verify the information over the phone. Be sure to use a phone number from a different email than the one with the new bank information to avoid fraudulent phone numbers. Another option to avoid fraud is to not use checks at all. If your bank does not offer ACH payments, I have an online one that does, with NO ACH fees.

I have had two separate checks from clients that were washed and attempted to be cashed. One went through but was caught a month later. Another was caught by the bank itself the next day and automatically canceled. Needless to say, I've requested my clients to switch to ACH payments to avoid these problems. I only pay my vendors via ACH or credit card myself. The only check I have ever written in my company was an $0.08 to the IRS. I wasn't happy that I had to buy 200 checks for that single check.

------------------------------
David Belnap, CMA, CSCA, CPA
Belnap Accounting
Hollywood FL
United States
------------------------------

Thanks you guys for contributing!

Awesome discussion, so basic, yet so essential!

Hey you guys below members of SIGs? If not, join the Technology and/or the Small Business Groups.

We love contribution. -->

@Paul Napper  @Sampada Wadekar

@Sampada Wadekar  @Paul Napper

------------------------------
Ilya Ilienko, dual MBA, CPA, CMA
Board Member / Director
East Coast - United States
------------------------------

Original Message:
Sent: 10-09-2024 06:17 AM
From: Paul Napper
Subject: Uptick in check and ACH fraud

ACH or wire is ideal.  You need to have procedures in place to independently confirm (use a phone and email address that is NOT in the original notice) and documents who took what steps to verify.

Positive Pay for checks.  Part of that process should include a notice from the bank of any suspect checks.  You should then have the ability to review and clear any checks that may have been rejected in error (ie slight but valid name mismatch).  If your constantly getting a vendor that flags then you should be looking at your vendor setup to make sure you have the correct payee name.

David Napper, CMA, CFM

Original Message:
Sent: 10/8/2024 10:09:00 PM
From: David Belnap
Subject: RE: Uptick in check and ACH fraud

I have had several bad experiences with positive pay that have solidified my opinion to never use that service. When your power company shuts down your account and refuses to accept payment except through a wire because of several denials of payment with positive pay, it's time to rethink the process.

That being said, there definitely needs to be a checks and balance system in place to verify payments. The first thing I do whenever I get new bank information is to call the vendor and verify the information over the phone. Be sure to use a phone number from a different email than the one with the new bank information to avoid fraudulent phone numbers. Another option to avoid fraud is to not use checks at all. If your bank does not offer ACH payments, I have an online one that does, with NO ACH fees.

I have had two separate checks from clients that were washed and attempted to be cashed. One went through but was caught a month later. Another was caught by the bank itself the next day and automatically canceled. Needless to say, I've requested my clients to switch to ACH payments to avoid these problems. I only pay my vendors via ACH or credit card myself. The only check I have ever written in my company was an $0.08 to the IRS. I wasn't happy that I had to buy 200 checks for that single check.

------------------------------
David Belnap, CMA, CSCA, CPA
Belnap Accounting
Hollywood FL
United States
------------------------------