ACH Payment Fraud: How SMBs Can Prevent And Mitigate Risks

Stolen credentials

The simplicity of ACH payments is also what makes life so easy for some fraudsters. All they need to do is retrieve your bank account number and routing number. They then use your bank information to send money to an account they control or set up payments for services and goods that you never bought.

These are some of the ways scammers use to get their hands on private banking information:

• Data breach. Your bank information is likely logged not just in your systems but in those of your vendors, service providers, and customers. If any one of those is breached, this could make you vulnerable to an attack. What we’re trying to say is, never keep your bank details out in the open for everyone to see. By the way, a data breach doesn’t have to be the result of hacking. For example, if you keep a sticky note with your bank info on your screen for easy access, then anyone passing through your office could immediately gain access to your funds.

Social engineering

In this scenario, an attacker will impersonate one of your employees or vendors to get you to transfer money to the wrong account. Identity theft often involves the use of some genuine stolen information to increase credibility and make it more likely for you to take the bait.

For identity theft-based ACH fraud, an attacker may use:

• A legitimate but hacked email owned by the person they’re impersonating.
• A fake email with an address that looks similar enough for you to mistake it for genuine.
• Fake invoices with some of your vendor’s real details but the fraudster’s own bank information on them.
• SMS spoofing, which refers to text messages that appear to originate from the person being impersonated.

Kiting

The illegal activity in which the criminal utilizes the time it takes banks to process transactions to fraudulently gain credit or steal additional money is known as kiting.

Kiting inflates a fake balance by shuffling money between accounts. The cycle repeats until the fraudster is caught or cashes out. If your payment lands at the end of the cycle, you take the loss.

Kiting was originally done with paper checks but can also be implemented with ACH transactions that typically take a few days to process.

Here are two scenarios to explain how ACH kiting may affect your small business.

Scenario 1: The fraudster uses ACH to pay from one account with insufficient funds. Before the money is deducted, they use a second account with insufficient funds to send another ACH transfer to cover the first one.

Doing so, they convert the ACH payment into short-term credit without the necessary financial backing.

Scenario 2: A customer makes a purchase and pays using an ACH bank transfer. They then claim there’s an issue with the product, requesting a full or partial refund in cash, via debit or any other immediate method while the ACH transaction is still being processed.

The unsuspecting business issues the refund only to discover a few days later that the original payment was rejected due to insufficient funds, as the scammer already drained the account.

1. Keep bank details on a need-to-know basis

Your account and routing numbers are all a fraudster needs, so sharing them too widely is a security risk, allowing criminals to pull funds from your account. So, it’s important to minimize the number of people who are exposed to this sensitive information.

Your bookkeeper obviously needs to have them, but not every employee that comes through the door should have this access. Use your good judgment to decide who really needs this information to do their day-to-day job.

2. Use 3-way matching

One way to fend off invoice-based ACH fraud is to perform 3-way matching to make sure you’re paying the right person for the right thing. This process includes comparing the contents of the invoice you received against your purchase order and order receipt. The most important details that need to be matched are the sum, the goods provided, and the vendor’s payment information.

3. Don’t click on random links

This cybersecurity best practice isn’t limited to preventing financial fraud. Malicious links are one of the most common ways hackers use to infect your devices with malware and spyware. These malicious programs can be used by an attacker to cause substantial damage to your business through fraud.

So, always be wary of links and only click them when you’re 100% sure you know who sent them and why and that they are reliable.

4. When in doubt, call

Whenever anything looks suspicious, for example, an email riddled with typos or just an out-of-the-blue request to update the payment details, pick up the phone to double-check with your vendor or employee before sending a payment.

Don’t be tempted to simply text back as you could find yourself conversing with your attacker. With a call, you’ll have a much better chance of knowing you’re talking to the right person. Also, make sure the number you’re calling is the one in your files, not in the suspect invoice or message.

5. Educate yourself (and your team)

As technology advances, attackers are constantly getting more sophisticated so it’s important to stay up to date on the threats relevant to your industry. It’s also crucial to periodically train your team on potential threats and ways to detect them.

6. Make sure you’re covered

If you do fall victim to ACH fraud from an insider threat, having fidelity insurance can help significantly cut your losses. This type of insurance covers your company against monetary and physical damage caused by fraudulent or otherwise dishonest activity by someone on your team.

7. Keep an eye on your money

While Nacha and the bank offer protection against unauthorized and fraudulent ACH payments, it’s your responsibility to monitor the movements in your account and promptly report anything suspicious. So, it’s very important you know exactly what’s going on in your account at all times.

Check with your bank to see if it offers notifications via email or text whenever a transaction is made. This can help make sure no transaction goes unnoticed without requiring daily logins to your account.

8. Use digital payment platforms

A digital payment platform like Melio hides and encrypts your bank details, so you never share account numbers with customers or staff to send or receive a payment. You no longer have to give out your details to customers in order to get paid or to your employees to allow them to pay.

When you input your payment and bank details, they are kept hidden and encrypted to ensure your money stays yours.

These platforms also allow you to establish payment approval workflows so you get the final say on every payment before it goes out.

Can ACH payments be traced?

Yes. ACH payments can be traced. Your bank can file an ACH trace request to follow the transaction, though the process can take several business days.

What can someone do with your bank account and routing number?

With your account and routing number, a fraudster can try to set up unauthorized debits or payments. That is why it is smart to limit who has access to these details.

Is ACH safer than paying by check?

ACH payments avoid the mail theft and check washing that affect paper checks. Both methods carry risk, so controls and monitoring matter more than the method itself.

How long does an ACH payment take to clear?

A standard ACH payment usually takes a few business days to clear. That processing window is one reason fraudsters try schemes like kiting.