Picture this: It’s the end of the month and your company’s accounting team works to close the books. One member of the accounts receivable team gets an email from a known vendor indicating the company changed banks. The employee quickly makes the change and continues the day’s work.
The problem is, though, that the vendor didn’t change banks, and the employee just fell for ACH fraud.
Greg Gatzke, founder and chairman of ZAG Technical Services, joins the “Tip of the Iceberg” podcast to discuss ways to prevent ACH fraud.
“It is very intriguing, because criminals can actually hack into the vendors’ emails and actually send the e-mail from the vendors’ address,” he said. “It could also just be the setup of a fake account with a new, different e-mail address and [then] send in the request. It’s something that’s happening a lot, and it’s continuing to happen.”
Gatzke said, of course, these ACH fraud attempts happen while accounting teams are under stress. But such incidents often impacts large sums of money, he said, and accounting teams need to be aware of the potential for fraud.
“The criminals are doing a shotgun-type approach, and what they’re looking for is the weakest link, and in reality, anybody, any day could be the weakest link. You could just have them make a mistake; you could not follow processes and just set the company up for a significant loss,” he said. “It’s something that takes due diligence and just a lot of rigor and how we how we operate.”
Gatzke said these crime rings have become more sophisticated with the use of artificial intelligence to craft emails and inquiries to make them less detectable. So, gone are the misspellings and the things that might make someone wonder if it’s fraud, he said.
“Because of that, we just need to up our game,” he said.
Gatzke said ZAG Technical Services is currently changing banks, and because it’s a huge process, companies don’t do it often. The fact that it’s an unusual event should alert an accounting team to something being off.
From there, Gatzke said someone in the accounting team needs to verify whether or not the bank change is valid.
“You’ve got to just pick up the phone and talk to somebody, and that’s hard especially you know when you’re dealing with overseas vendors,” he said. “Don’t [reach out] with the phone number in the e-mail that it comes in, because the criminals answer those, [instead] do it manually do it every time. Verify they’re not making a mistake, because [the] one time [your team] skips it you’ll be out money.”
If not, it could be months before the accounting team catches on, he said. Multiple payments may go out to that new account before the real vendor calls to inquire about missing payments.
“If you think you’re a victim of it, call your bank immediately and get advice from them,” Gatzke said. “They may be able to pull it back, but they may not. Call the FBI. Just do everything you can to reclaim the money.”
