Advice summary from CFOLC regarding Phishing and Payment Scams-
SEE BELOW…
Â
We ALWAYS verify any kind of change in payment or banking information with a phone call to our existing contact (not the one provided in the same email). I think that is the only way to be sure, and most companies have appreciated the follow up/confirmation.
Â
Regarding fake invoices – obviously if you are matching up to a PO that is the best way to be sure it is legitimate. For services, there should be an owner/approver required so there is a second set of eyes.
Â
I also stress to my team to ask or check if anything seems off – always better to be safe than sorry.
Â
We are in the life science industry and we are literally constantly bombarded by phishing attempts – and we are a small company. But the attempts are sophisticated and surely we would be used as a stepping stone to hack into our clients – hospital systems, government agencies, universities, healthcare labs, etc.
Â
That said, we have had success (knock on wood) protecting ourself by beefing up our security – we are on the Microsoft E5 platform and if you review our logs, hundreds of attacks are filtered out each day.
Â
If your system is already allowing attachments. Etc. to be processed as bills then you already are exposing yourself, but then even in bill.com there is an approval chain for vouching bills before they would even hit your accounting system (if I remember correctly).
Â
It’s definitely a tough-to-navigate landscape with fraudulent activity: I even caught a guy stealing mail out of our office complex’s mailbox – he somehow had the postmaster’s key!
Â
The attached should get you started (on policy, best practice to have one with sign off). But, particularly for phishing/cyber fraud prevention you’ll see in the following:
Internal Payment Request Controls
In all cases, the authenticity and accuracy of funds transfer requests must be verified and must be obtained from an original source document received from the person(s) requesting the transfer or disbursement.
— A source document is the document received (i.e., bill or commercial invoice) from the person that requests payment and contains all relevant information about the funds transfer.
— Scanned (.pdf) instructions with a written signature provided by an authorized employee and/or e-mailed instructions of these documents are acceptable substitutes for original documents, but only when also confirmed by verbal approval via telephone on a predetermined phone number (or in person).
— If an original source document cannot be obtained prior to payment execution, the payment must be either approved by a callback to the CFO and/or Principle requesting payment to verify payment details. Such verbal authorization must also be documented in writing.
— Any wire transfer request submitted for accounts payable, payroll, investment or tax must be validated and approved by a callback to the originating individual to ensure that the individual is aware of the transaction and is authorizing payment.
Â
Depending on your Ops, this might be a little overkill.
Â
We have encountered the same increase in fraudulent attempts. I think the best defense is really in just having the team always follow a good process to setup vendors and/or to make any change in their remittance bank information or pay to address. We require approval from two users inside of the vendor organization and then also require a secondary form of confirmation in addition to the first request. That usually looks like an initial email with two members of the company validating the payment change information (or initial setup) and then a secondary confirmation via phone or text to confirm the change request. We’ve had the same thing where vendors are compromised and you get authentic looking requests, but the secondary verification via phone/text with your known party blocks that 100% of the time. Too bad all those smart people don’t put that brain power to good use!
Â
Only make payments using information that is already been entered in our ERP
Any change request to banking information needs to be verbally validated
Verbal validation needs to be initiated by my AP person, and by calling a number we have on file for the company
We use POs for everything. (Well…just about everything.) no match, no pay. That really restricts the ability of a vendor to send a fake.
Â
On a related scan note….
Â
One of my clients recently had 3 checks to the same vendor total a 6 figure value fraudulently cashed.
It appear that they were stolen(on three different occasions) from the incoming mailbox in the lobby of the vendors office.
They were deposited through ATMS into bank accounts not belonging to the vendor.
Â
Its scary out there.
Â
We also use Bill.com and we try to do verbal confirmation with all vendor payment changes
Â
We use Bill.com for AP as well. We always ask whoever is responsible for the vendor relationship to approve the invoice before going through two rounds of approvals on the accounting side. Whenever we receive an invoice that looks suspicious, we always check with the vendor independently, too. There was an instance recently where a scam invoice came in and we asked the vendor’s accounting team for verification. They immediately told us that the invoice was not valid.