Protecting Your Organization against Payment Fraud

Defining Payment Fraud

Typically, payment fraud is synonymous with writing bad checks. But electronic payment fraud is on the rise. Electronic payment fraud typically targets wire fund transfers and ACH originations, which are used by financial institutions to handle transactions such as direct deposits, checks, bill payments and cash transfers.

How to Protect Your Business from Payment Fraud

Training everyone in your organization, not just financial personnel, to be alert and aware is your best defense against payment fraud. Use and share these simple tips.

Defend against check fraud:

• Use only secure mailboxes to send checks
• Keep as much identifying information as possible off checks
• Provide a safe place for authorized personnel to store all checks
• Monitor billing schedules. When any payment appears later, or any check remains outstanding, check with the party in question to ensure payment fraud is not the reason for the delay.

Defend against wire and ACH fraud:

• Do not store login information on your computer
• If possible, consider dedicating one computer solely to online banking business financial purposes. Avoid using it to visit any other website, engage in social media or check email. If that is not an option, be sure to close the browser after each online banking session.
• Ignore spam email – one of the most common ways that fraud occurs is through phishing schemes, such as spam emails sent from a hoax IRS address.
• Avoid emotional responses to emails. Many criminals send scam emails that try to manufacture “crisis situations” and to prompt employees to circumvent normal processes and controls.
• Cross-check emergencies to verify they are “real.” If you receive an unexpected, urgent message, call the person allegedly in crisis, and never wire money before reaching the recipient “live.”
• Review all credits and debits daily. If you see any inconsistencies in your records, notify KeyBank by calling 800-821-2829 or the relevant financial institutions immediately.

Information security:

• Install and monitor computer security programs, including firewall, anti-spy, anti-virus, spam filter, and pop-up blocker software. Keep these up-to-date and install all related updates to ensure maximum information security.
• Update all system software programs as new versions are released. Revised programs are better designed to withstand the latest forms of malware.
• Note any suspicious signals of phishing or email scams. When there is any reason to doubt the sender's identity, delete the email immediately and alert others.
• Do not share sensitive business information, particularly employee identification numbers and financial records, with anyone if you are not certain who they are and why they need the information.

When you initiate an interaction with KeyBank, we may ask for your information, such as the last 4 digits of your Social Security number, login ID, or a one-time passcode to verify your identity. However, be cautious of unexpected requests by phone, text, or email for full Social Security number, login ID, or other personal information when the communication was not initiated by you. Verify these requests by contacting a known KeyBank resource (e.g. a local branch, 1-800-KEY2YOU^®) before providing any sensitive information.

• Do not share confidential business information online. Emails and text messages are not secure and can be intercepted. When it is necessary to share information online, ensure that the website is secure.
• Create strong, unique passwords, user IDs and login combinations using numerals, capital letters and special characters for each account. Do not store this information on the computer.
• Place shredders in convenient locations throughout the workspace, and require that all paperwork with sensitive information be shredded before recycling.
• Identify regular opportunities to routinely discuss security best practices such as staff meetings or other group check-ins.