CMIT Solutions helps small and midsize businesses protect themselves from cybersecurity threats, including vendor payment fraud, which can happen when an employee receives what appears to be a legitimate request to update banking information.
Think about how your accounting department handles invoices. You probably have vendors you’ve worked with for years. Their invoices come in regularly, payments get scheduled, and unless something looks unusual, nobody gives it much thought.
Now imagine one of those vendors emails your accounting department saying they’ve changed banks and need their payment information updated.
The email comes from the address your company has always used. It references an actual invoice, the amount is correct, and the person sending it appears to be someone your employees know.
Your accounting department updates the information and sends the payment.
A week later, the vendor calls asking when they can expect their money.
That’s when you find out the vendor never requested a banking change. Someone else sent that email, and your payment went to a fraudulent account.
It’s the kind of situation that can catch even a careful employee off guard, especially when the request comes from someone they’ve been doing business with for years.
What Is a Business Email Compromise?
Business email compromise, often called BEC, is a type of cyber crime where criminals use email to trick employees into sending money or sharing sensitive information.
You may have heard that one way to spot a suspicious email is to look for misspelled company names, unusual email addresses, or links that don’t look right. That’s still good advice, but it doesn’t always work with business email compromise.
In some cases, the criminal has actually gained access to a legitimate email account.
Maybe a vendor’s password was stolen, or someone entered their login information on a fake website. Once the attacker gets into the account, they may be able to read past conversations, see which invoices are outstanding, and figure out who handles payments.
They don’t necessarily send a fraudulent request right away. They might wait until an invoice is due and then send an email asking for the payment to go to a different bank account.
Since the message comes from a familiar email address and includes accurate information, there’s often nothing obvious to make the employee question it.
How a Routine Vendor Payment Can Turn Into a Problem
Let’s say you own a construction company and regularly purchase materials from the same supplier.
You’ve worked with that supplier for several years, and your office manager handles the invoices. Most months, the process is pretty straightforward. The invoice arrives, the amount gets checked, and payment is scheduled.
One afternoon, an email comes in from the supplier explaining that they’ve switched banks. The message includes the new account information and asks that the next payment be sent there.
Your office manager recognizes the sender, sees the correct invoice number, and makes the change.
Nobody calls to confirm it because there’s never been a problem with this supplier before.
Unfortunately, the supplier’s email account was compromised. The person requesting the change wasn’t the supplier at all.
By the time anyone realizes what happened, the payment has already been sent.
This is just one example of how vendor payment fraud can happen. The business doesn’t necessarily have to experience a ransomware attack or have its own computers hacked. Sometimes the problem starts with an email account belonging to another company.
Why Smaller Businesses Need to Pay Attention
Large companies aren’t the only ones dealing with invoice fraud and business email compromise.
In fact, smaller businesses may have fewer procedures in place for verifying financial requests.
Think about a company with 15 or 20 employees. The office manager might handle payroll, answer phones, process invoices, schedule appointments, and take care of whatever else comes up during the day.
When an email arrives from a familiar vendor asking for a banking change, it may seem like just another item on an already busy to-do list.
There’s also the issue of trust.
If you’ve worked with the same supplier for ten years, you probably know the people in their office. You recognize their names and email addresses, and you’ve handled hundreds of transactions without a problem.
Most people aren’t expecting someone to be secretly reading those email conversations or waiting for an opportunity to redirect a payment.
Having a verification procedure takes the guesswork out of deciding whether a request is legitimate.
Five Ways to Help Prevent Vendor Payment Fraud
At CMIT Solutions, we encourage businesses to think about cybersecurity beyond protecting computers and files. It’s also important to look at the everyday procedures employees follow, particularly when money is involved.
Start by reviewing how your company handles these five situations.
- Pick Up the Phone Before Changing Banking Information
This is probably one of the simplest ways to avoid a costly mistake.
If a vendor sends an email requesting new banking information, call them before making the change.
And don’t call the number listed in that email. Use a phone number your company already has on file or one you’ve previously verified.
If someone has compromised the vendor’s email account, they could easily include a different phone number in the message.
It only takes a few minutes to confirm whether the vendor actually requested the change.
- Have Someone Else Approve the Change
In a small business, it’s common for one person to handle most of the accounting work. That doesn’t mean the same person should be responsible for every part of a payment change.
For example, your office manager could verify the request with the vendor, but the business owner or another authorized employee would need to approve the updated banking information before a payment is released.
You don’t necessarily need expensive software or a complicated approval process to do this.
You just need a procedure that employees understand and follow every time, regardless of how familiar the vendor is.
- Make Sure Business Email Accounts Have MFA Enabled
Multi factor authentication, or MFA, is one of the security measures businesses should already be using.
If someone steals an employee’s email password, MFA can make it harder for them to access the account because another form of verification is required.
It’s not foolproof. Attackers have developed ways to get around some types of MFA, particularly through sophisticated phishing attacks.
But using MFA, preferably phishing-resistant methods where available, is still much better than relying on passwords alone.
This is especially important for employees who have access to invoices, financial information, or sensitive business records.
- Pay Attention to Unusual Email Activity
One thing business owners may not realize is that criminals sometimes get into an email account and quietly monitor it before doing anything else.
They may look through conversations with vendors, search for invoices, or set up forwarding rules that automatically send copies of messages to another address.
Your company might not notice anything unusual unless someone is monitoring for that activity.
Having the right email security tools and monitoring in place can help identify suspicious login attempts, unexpected forwarding rules, and other changes that deserve a closer look.
If an account is compromised, finding out sooner can make a big difference.
- Talk to Employees About Financial Email Scams
Most employees have heard about phishing emails, but their training may focus mainly on suspicious links and attachments.
Vendor payment fraud can look very different.
An employee might receive a perfectly written email from a familiar contact asking for a routine banking change. There may not be a link to click or an attachment to download.
That’s why employees who handle accounting, purchasing, or payments need to understand what these scams look like.
Go over a few examples during a staff meeting. Explain how banking changes should be verified and who needs to approve them.
Most importantly, make sure employees know it’s okay to question a request, even when it appears to come from the owner, a manager, or a longtime vendor.
What Should You Do If a Fraudulent Payment Has Already Been Sent?
If you discover that money may have been sent to a fraudulent account, contact your bank immediately.
Explain what happened and ask whether the transfer can be recalled or whether there are other options for recovering the funds. The sooner you report it, the better.
You’ll also want to contact the vendor directly using a phone number you know is legitimate.
If the suspicious email came from one of your company’s accounts, your IT provider should investigate whether someone gained unauthorized access. That may involve reviewing login activity, checking for forwarding rules, securing the account, and determining whether other information was exposed.
Businesses can also report these incidents to the FBI’s Internet Crime Complaint Center at www.ic3.gov.
Unfortunately, there’s no guarantee that stolen funds can be recovered. That’s one reason it’s worth spending a little time putting preventive measures in place before something happens.
Is Your Business Verifying Vendor Payment Changes?
Most businesses already have procedures for paying invoices, but not all of them have a clear process for handling changes to vendor banking information.
It’s worth asking your accounting department a few questions.
What happens if a supplier emails new payment instructions? Does someone call to verify the change? Is another person required to approve it? And would your employees recognize a suspicious request if it came from an email address they already trusted?
If you’re not sure how your company handles those situations, now is a good time to find out.
CMIT Solutions helps small and midsize businesses strengthen email security, implement multifactor authentication, monitor suspicious activity, and identify potential weaknesses in their IT systems.
You don’t need every employee to become a cybersecurity expert. But anyone responsible for company payments should understand how to verify a banking change before money is sent.
Contact CMIT Solutions to learn how managed IT services and cybersecurity solutions can help protect your business from vendor payment fraud and other email-based threats.
https://cmitsolutions.com/
#BusinessEmailCompromise #InvoiceFraud #EmailSecurity #SmallBusinessCybersecurity #ManagedITServices #CMITSolutions
