How to Prevent Check Fraud

Kathy (host):
Hello there and welcome back to another episode of Help! My Business is Growing, a podcast where we explore how to grow and build a business that is healthy and sustainable. I’m your host, Kathy Svetina, a fractional CFO and founder of NewCastle Finance, a company where we believe that everything that you do in your business is eventually going to end up in your finances. And to get to healthy finances is to have a healthy business. But the question is, how in the world do you get there? Well, this is where this podcast comes in.

Kathy (host):
One of the worst things that can happen in your business is if it becomes a victim of financial fraud. And in this episode, specifically, we’re going to focus on check and ACH fraud because fraudsters and scammers are getting even more creative these days, and it’s becoming a major concern for banks and the authorities. So we’re going to focus on how can you protect your business? And why is check fraud currently running rampant? What are the signs or the red flags to watch for? And what makes certain companies vulnerable to check fraud? And if unfortunately, you become a victim of this type of fraud, what can you do to try to get your money back?

Kathy (host):
As a quick reminder, all of the episodes on this podcast, including this one, come with timestamps for topics that we discussed, and each one has its own blog post. It is there for you to revisit the podcast episode should you want to scan through it or if there are specific topics that you want to dive deeper into, and you actually want to go and read it. So it’s there for you as a resource. Just go ahead and use that. You can find all the links and the detailed topics in this episode’s show notes.

Kathy (host):
My guest today is Courtney Olson. She is the Senior Vice President and Managing Director of First Bank Chicago, and she is responsible for supporting the bank’s growth and expansion through developing strong business relationships with the local marketplace. She utilizes her background in sales, lending and deposits to assist clients and prospects in designing a holistic banking strategy. It is going to be a fabulous conversation. So please join us.

Kathy (host):
Welcome to the show, Courtney.

Courtney (guest):
Hi. Thanks for having me, Kathy.

Kathy (host):
Yeah, thanks so much for being here. Today, we’re going to be talking about a really important topic in finances, and that’s financial fraud – what are the different types and how to avoid it. And I will say that you are my first banker on this podcast. So I’m super excited. The way how we connected was, obviously we knew each other from networking stuff that we have done, networking groups, but you posted an interesting article on LinkedIn. And it was about check fraud. So I want to go deeper into the check fraud, because I think this is really relevant, especially for small businesses. But before we go into that, what are the types of financial fraud that you have seen on your side as a banker?

Courtney (guest):
Yeah, so and just to kind of back up a minute, I gotta give my legal disclosure, you know, since I am your first banker. So everything that we talk about here is a general discussion in nature. It should not be considered regulatory, tax or legal advice. Always consult with your attorney or your accountant if you need that kind of advice. And this content here is presented for informal purposes only for our discussions.

Courtney (guest):
So yeah, the different types of fraud that we’re seeing these days – and it’s sad, it’s sad for me as a banker, to get that call from a client that says, “Oh, geez, I don’t recognize this transaction.” And it really stops not only my day, but the client’s day and our team’s day so that we can, like, stop the bleed, if you will, right away. So what we’re seeing is, as you mentioned, check fraud. Even though writing checks has decreased over the years, check fraud has increased. So check fraud is still one of the number one financial frauds that we see. We’re seeing ACH fraud growing, and wire fraud as well. So any way a fraudster and a criminal can transfer money, we’re seeing it. So that’s check, ACH and wire.

Kathy (host):
So I do want to talk about the specifics of how fraud looks like. So let’s start with check fraud. What exactly is it? And how would someone recognize check fraud?

Courtney (guest):
Yeah, so fraudsters have gotten very creative, and their technology has gotten very good. So it is hard to spot a fraudulent check. I mean, it looks almost identical to a regular check. But what we see generally happens is a check is mailed. Every time I say this, I usually get like a jaw-drop reaction because I’ll get a phone call from a client that says, “You gave out my account number.” And I remind them that on the bottom of their check is their account number and their routing number.

Courtney (guest):
So anytime – and this is for consumers or businesses – anytime a check goes out, your account information is right there for the world to see. So what we see in the stories that we hear are that checks are still being mailed and criminals go and break into even those blue mail bins that you see right out on the streets.

Courtney (guest):
I moderated a panel for the Illinois Bankers Association a couple months back. And we had one of the postmasters from Chicago, from the US Postal Service in the Chicago area. And he told some really sad stories about how the postmen, the delivery men, are being held up for their keys for those blue boxes. So you know, where we thought our poor postmen had to fight the elements, like they’re fighting crime at this point.

Courtney (guest):
So a check is actually stolen out of the mail. And then the criminal can wash that check, so remove the ink that is on there, or they’ll alter it. You know, if the check is for $20, they could change it to $20,000. So we’re seeing checks being stolen out of mailboxes. And that’s really the start of check fraud, and then these criminals will actually sell your account number to other individuals. So that’s what we’re seeing on the check side and how it originates.

Courtney (guest):
As far as ACH or wire fraud, that gets a little bit more technical in technology. And it’s usually through email. So we have seen where a vendor – so here’s a true story: One of my clients called and said, “I got this email from my vendor. They told me they changed their account number. So I changed my ACH information. And I originated an ACH to this new account number that was provided.” Well, then, a couple months later, what they found out is when they actually got a call back from the true vendor saying, “Hey, you’re past due, like 60 days on your payments, this is not normally like you.” And she goes, “Oh, wait a second. I ACH’d you two months ago.” Well, that’s because the vendor was hacked, their email was hacked. And they received this email saying, you know, “We have new account information.”

Courtney (guest):
So the ACH – or this is the case for wires as well – the funds were sent to the fraudulent account. In those cases, there is nothing the bank can do. You as a business authorized the money to go to that account information. So that’s what we’re seeing.

Courtney (guest):
I’ve even seen – and this is a personal story – one of my clients, I thought, emailed me and said, “Hey, I need a check. And here’s my UPS code. And could you please email a cashier’s check to this address for a closing we’re having?” And luckily, it was stopped. Because here at First Bank Chicago, we make sure that we turn every email request into a phone call. So I get an email, I do not email back, I pick up the phone and I call and verify with clients. So that’s how we’re seeing the criminals start to originate these types of transactions. It’s mind blowing.

Kathy (host):
Some of these stories, it’s just baffling. Looks like they’re getting sneakier and sneakier. And I know, you know, we bank with Chase, and one of their things is that you get a secure message from the bank. And you have to reply to a secure message, especially with the wires and the ACHs. And the other thing, I would think that your bank is doing that too. You have to – before you wire something out, they will ask you, “Have you actually picked up the phone and called that person and verified those numbers that they gave you?” And I think that is such a good security measure. It’s tedious. But you know, especially when you’re working with big numbers, you want to make sure that you have the right account.

Kathy (host):
So I do want to ask you, what are some of the things that consumers and businesses can do to prevent ACH and wire fraud? Would it be again like picking up the phone, security messages? What else?

Courtney (guest):
Yeah, so our team – myself and the team here at First Bank – what we love doing is stuff like this podcast, because we need to get the message out to the consumers and the businesses about how this is happening. So yes, number one, always, always, always verbally verify the information where you need to send money. And do that – don’t do it with the phone number in the email that you received, even if you need to Google the business or the company or the vendor. So you can get their office phone number and make that phone call and say, “I just received a request to wire XYZ money. I need to verify that this is coming from you.”

Courtney (guest):
So absolutely yes, always, always verify. I would say “never trust, always verify” instead of “trust but verify,” because we have seen it so many times. I mean, that client that I told you, the vendor emailed – my father is an accountant. And he called me with almost the same identical story of one of his clients who sent money to the wrong vendor, and the vendor was hacked. And he goes, “What can they do?” I said, “I hope they have insurance because the money is gone.”

Courtney (guest):
So absolutely, always verify that you’re putting your account information into the correct site, into a secure site. So if the site is not secure, there is – you could be liable for having your account number out there.

Courtney (guest):
One thing for an end backup: So consumers and businesses actually have different standards that they’re held to. So a consumer has 60 days to respond once they see a fraudulent transaction; a business has 24 hours, because they fall under the Uniform Commercial Code. So once that 24 hours is up, the liability and loss transfers from the bank to the business.

Courtney (guest):
So my tip number two, besides verifying, is you need to watch your account as a business owner every single day. And whether that’s your eyes on it, an employee’s eyes on it, some sort of tool that you are using to monitor your account, like an alert tool or a positive pay tool, you have to be watching your account every day for some sort of fraudulent transaction. And just a reminder, because I think a ton of nonprofits – nonprofits fall under businesses. So that goes for nonprofits as well.

Kathy (host):
And you mentioned positive pay. Can we talk about what exactly is positive pay? And how can companies use that?

Courtney (guest):
Yeah, positive pay is a great tool for catching fraud. And what it is – it’s only available for businesses. And what it is, is every time you would do a check run or an ACH run, whenever you’re making payments, you would create this file. That file then gets uploaded to the bank site. And then as transactions come in, they match up to that file. They’ll match the amount, they’ll match the check number, and they’ll even match the payee.

Courtney (guest):
So in some cases, we will see checks or ACHs, you know, where they want that – you just take the check and wash the name off, and then they’ll go deposit it into a different name account. So positive pay can actually look at the payee on that check.

Courtney (guest):
So as the transactions come in, they match up. If one comes in and it doesn’t match up with the file that you have uploaded, you will receive – you or someone on your team, whoever you designate – will receive an alert. And that alert can either come via text or email. Then by a certain time in the day – at our bank, it’s by one o’clock – you have to decision whether that item can still be paid. Like, “Oops, maybe I forgot to enter that transaction in that pay run.” Or maybe something happens as it was being processed by the other bank where maybe the check number wasn’t quite encoded correctly. But you know it is an item that should be paid. You can then just say, “Yes, please pay that item. It was an error.”

Courtney (guest):
Let’s say it’s a fraudulent item. You get that alert, you can immediately push it back and say, “Nope, that is a fraudulent item. I do not approve that going to my account.” Banks will set up positive pay so that if you don’t make a decision by that one o’clock deadline, it will automatically reject the item. Some people get a little frustrated with that, because they’re like, “Oops, I just missed the deadline. And that check should have been paid.” Well, for your protection, we returned it anyways. I’m sorry, it’s an inconvenience, but just rewrite the check or resend the ACH.

Kathy (host):
And have you seen – is there any way that even with the positive pay, you could still have a fraudulent check happening? Or is it basically once you have the positive pay, and if you’re really looking at this, there’s a tiny, tiny chance that something might have gone through that you didn’t approve?

Courtney (guest):
I actually just had a case a couple weeks ago, maybe three, four weeks ago, where one of the businesses approved the check. It matched the positive pay. And what had happened is that check was stolen. Actually, what had happened was the business moved that they sent the check to. So it showed up – it was a very small business. I think it was out of someone’s home. So whoever moved into that space took the check and deposited it. So nothing on the check was altered. The depositing bank didn’t verify the identity of the individual depositing that check. And really mobile deposit then comes into play here a lot.

Courtney (guest):
So there’s millions of mobile deposits made probably every day. Well, the banks aren’t looking at each and every single transaction. This was a lower dollar amount. I think it was a couple hundred bucks. So you know, whatever bank it was deposited in, they’re not going to look at that. So the check itself wasn’t altered at all. The individual that received it deposited it where it shouldn’t have been.

Courtney (guest):
So in a case like that, the client, my client, contacted me and said, “I received a call from this vendor. They didn’t receive the check, but we see the check cleared, and nothing was changed on it.” So in that case, we work with the depositing bank to say that the endorsement was altered, and it should not have been deposited where it was. That process takes months, months and months, especially with the larger banks, because they get these types of requests all the time. So they’re processing through a mountain of these requests. Eventually, it does get ironed out. But yeah, it is a long process.

Kathy (host):
So what happens if it’s a bigger amount, and the bank didn’t verify the endorsement? And the money went out? Let’s say it was $100,000. Would the bank that did not do the endorsements send the money back? How does that work?

Courtney (guest):
Eventually, yes, they do. Their own case – the liability falls on them for not verifying that endorsement. So the business would still get the money back. But it would just take months and months, a very long time. Yeah, depending on the amount, us as the processing bank could, you know, we could do provisional credit. But in that case, even with provisional credit, it’s not really dollars in their bank account. So you do kind of have to work through that process with the depositing bank. And of course, we were the ones working with the depositing bank, not the client themselves.

Courtney (guest):
In all of these cases, in all of these stories, we always, always recommend to our clients, no matter the dollar amount, no matter if reimbursed, please file a police report with the local police of wherever you’re located. Because that panel that I alluded to earlier, we did have someone from Secret Service and FBI on that panel as well. And they do try and work with the local police departments. And they do try and track down if there is like a ring, an operation ring that is going on. So please always do – I know it’s a pain, it’s more paperwork, it’s another step. But please always do file something with your local law enforcement. And the US Postal Service actually has a link and a website as well, where if you know it’s check fraud, and it was stolen out of the mail, that you should file with them too because they are tracking those cases.

Kathy (host):
And you know, when we were talking about this before, one of the things that was really interesting to me, and I did not know this, is that these rings, the criminal rings that do this, actually operate as a real company.

Courtney (guest):
Oh, they like hire people, like they hire people that give them benefit. Yeah, I found that out from that panel, too. It was a very insightful panel. And yeah, it is run like a business. And unfortunately, I think you know, the people on the low rung that they hired, they don’t know that they’re doing anything illegal. Once you get to that middle or upper, you know, maybe they could probably figure it out. But you know, this generation that’s coming into the workforce, they’re a little naive, and they have an open mind and an open heart to everyone. So it’s the you don’t know what you don’t know. And so unfortunately, yeah, they are hiring individuals right out of college, or maybe community colleges that just don’t know that they’re doing something illegal. Sad.

Kathy (host):
And they are based in the US? Are they based like outside of the US?
Courtney (guest): They’re all over the world.

Kathy (host):
Wow.

Courtney (guest):
They’re all over the world. I believe, again, back to that panel, they gave us a case of like a ring in Jamaica.

Kathy (host):
So that just blew my mind.

Courtney (guest):
It’s crazy. There’s a lot, you know, there’s a lot of money in fraud. Unfortunately, I did have what I thought I had a statistic somewhere. But there are like billions of dollars lost every year in fraudulent transactions. And it just breaks my heart because I always think, you know, if these fraudsters would put their effort into something good, like we could do something great, like cure cancer or something.

Kathy (host):
Yeah, yeah, I agree. So if we go back into the check fraud, and to summarize it, to avoid the check fraud, really, you do a couple of things. Set up your positive pay with the bank. And I would assume that most banks offer this type of service to the small businesses at this point.

Courtney (guest):
Yeah, most banks offer positive pay. You can have positive pay for just checks. You have positive pay for the ACH transactions. You can up your game and have that check payee positive pay where it is actually reading the payee name line. Combination of both. First Bank, we bundle our check and ACH package together and sell it as one bundle. So yes, most banks are offering that to their businesses. And I would, for me, you know, if there is a cost to positive pay, but for me, it’s low-cost insurance for keeping an eye on your account.

Kathy (host):
And then the thing would be, always make sure that you’re checking your bank balance every day, if you can.

Courtney (guest):
Check those transactions every day somehow, whether it’s by person, or using one of the tools like an alert or positive pay.

Kathy (host):
And then the third thing would be, I think we didn’t mention this, but using the right type of pen when you writing these checks, so not something that can be easily washed, correct?

Courtney (guest):
Yeah. So it’s interesting, because I think there was a big push for these pens, fraudsters really are getting smarter and smarter. They’re figuring out how to alter these checks, even if it is with a pen that these security patterns, I believe my parents bought one too. But just a reminder, that check, they get a hold of it, they have your account number. So it doesn’t matter what ink you use, there’s really sophisticated printers that they have. And they’ll just recreate your checks. And you know, the consumer versus business, a business check is going to be more valuable to a fraudster because generally, businesses have bigger balances in their accounts. So and then they get really tricky. So they’ll get the account number, and then they’ll start with small transactions that like you might kind of gloss over and then once they know that they’re in, they’ll go for bigger and bigger and bigger transactions.

Kathy (host):
I think another thing that I have seen too is if they have a specific business that they’d like to steal checks from, you could set up a similar business who would be like, I don’t know, like blue LLC, and it will be b blue C Corp or something like that. So very similar, but it’s different.

Courtney (guest):
Correct. So where the name is super similar, very close to whatever they the check that they stole. Or they’ll go set it up, you know, maybe an online bank or you know, there’s a lot of online setups through the larger banks these days. So they will they’ll set up a similar type of organization, corporation, similar name, deposit the check, get their money, and then they close the account out, money’s gone. They’re definitely getting sophisticated with their stuff. Yeah.

Kathy (host):
We talked about, you know, the positive pay, we talked about checks with the positive pay, but how about ACH positive pay? How does that work?

Courtney (guest):
Same way. So you would do an ACH run, if you’re using ACH origination to pay your vendors. So you’ll have that file that says, okay, I paid all of these people today, and then it’ll come in and match the other thing. So you know, a lot of businesses and consumers are paying like their electric bill or their gas bill, maybe rent is something that is done via ACH transaction that is originated from the third party and debiting your account. In that case, you can set up rules within your ACH positive pay, where you say, okay, my electric bill for my office is usually around, I don’t know, $1,000 a month. So I’m going to set my rule that ComEd can debit my account up to whatever it is, you know, let’s give them some room, $1,100. So that debit will go through without an issue, without an alert, where you would have to like say, no, that’s okay to pay until it hits that upper threshold. And then once it hits that threshold, that same sort of alert would be generated. And you would have to make that decision of oh, gosh, it was, you know, January and we had weather that was below whatever or no, this has come out. So you know, it’s the summer months when we have these drastic heats, and I was running my AC and it cost me a little more that month. So you could let that go through.

Kathy (host):
Could you also set the minimum? So because we talked about that maybe the fraudsters are doing some minimum amounts. So they would say your bill is generally about $1,000. And they would push through about 100. Or maybe 50.

Courtney (guest):
Sure, you can even set a peg amount of I’m only paying this vendor $300 a month period. It shouldn’t be above that. It shouldn’t be below that. So you can set those rules to be more general or more specific.

Kathy (host):
Awesome, Courtney, this was a very insightful conversation. And I’m so glad we had this. I asked this question, every guest that comes on this podcast. And you know, we’ve talked about a lot of things here and this is a very serious and potentially devastating topic to a small business. If someone doesn’t have a positive pay and they’re not really sure like what to do and like how do I don’t even know like what to do at this point. What do you think that is the next thing that it can do in their business something actionable they can do in the next week or two to not unfortunately be you know, in the fraud situation?

Courtney (guest):
Yeah. Call your banker. If you are a business and you have not sat down with your business banker in the past year, now would be a really good time to have that conversation. Call your banker, sit down with them, hopefully you know your banker by first name. Most of my clients, do they have my cell phone. That’s just how we are at First Bank. So call your banker, sit down with them, say I’m concerned about check fraud, ACH fraud, wire fraud, I want to make sure that my accounts are protected. What does your bank offer? At the very least, they should offer some sort of alert system, it’s similar to like what you see on your credit card where you can set like, I want to be notified if anything over $100 hits my account. And then you either get a text or an email saying that that transaction hit your account. So at the very least, and usually an alert product is free. So I work with some pretty small businesses and pretty small nonprofits where money is kind of tight. And I tell them, I remind them, you have 24 hours. Period, end of story, or else that loss and that liability falls on you. So what are you doing to watch your account? And they’re like, well, I can’t look at my account balances every day. And I said, well, you do have a phone and you know, mobile app, you can kind of just tap on that app and look at it. But at the very least set up these free alerts to make sure that you are looking at your account so that you are not getting you know not missing anything fraudulent. This is your hard earned money. Please make sure that you know the fraudsters aren’t getting away with that. So that would be my bare minimum. But I really do recommend discussing with your banker positive pay.

Kathy (host):
And also I would think that discussing with your insurance person as well, if something does happen, are you covered for it? How much are you covered for it?

Courtney (guest):
Absolutely. Call your insurance agent, check in on your business liability policy, and make sure that fraud is covered under it. If it is not, I would add it, you know, obviously, there’s kind of that minimum, and did it hit the deductible and all of that, but that’s something your insurance agent can guide you through. Insurance agents and bankers are really now kind of working closely to make sure that our businesses are having that discussion with at least one of us, but really kind of rally your team, your advisory team, talk to your banker, talk to your insurance agent, talk to your attorney. Unfortunately, we’re seeing a lot of inside fraud happened too, so it’s not these big rings that we were talking about. Sometimes it could just be that, you know, employee that was hard up that had never had any issues in the past. I’ve seen it more times than I’d like to, but you know, I always remind businesses employees are good until they’re not.

Kathy (host):
And I always end as a fractional CFO always put this: internal controls are there for a reason. Use them.

Courtney (guest):
Internal controls, dual control, make sure the person that is cutting the checks is not the same person approving your positive pay, because then they can just keep approving all the money they’re stealing.

Kathy (host):
Yep, yep. So don’t put don’t give all the keys to the kingdom to one person. And I’ve seen that happen to so many, just so many small businesses and they get stolen from because they trusted that person. You trust that person, but you gotta verify it, and you have controls in place.

Courtney (guest):
Yeah. And on the flip side, I mean, you as a fractional CFO or I work with a lot of bookkeepers, you know, to protect yourself if they’re giving you any sort of account access, make sure that you are asking either president, Executive Director, whoever, limit me. Don’t let me send money out. Make sure someone internally, whether it is like a president, Executive Director, CFO, internal. Well, you are you wouldn’t be acting as a CFO, but someone who is in ownership is actually approving the money to go out even if you’re doing the administrative side.

Kathy (host):
Yep, exactly. So Courtney, how can people reach you?

Courtney (guest):
Yes. So I am the Senior Vice President, Managing Director of Business Banking over at First Bank Chicago. So you can reach me through emailing me C-O-L-S-O-N@firstbankchicago.com. Or just go to the First Bank Chicago website and you can track down a fantastic team of bankers there. So feel free to reach out with any questions that you might have.

Kathy (host):
That’s all great. And we’re going to have all of that in the show notes too. So if you’re interested, go in the show notes. There’s going to be all of Courtney’s contact information. Courtney, thank you so much. I really appreciate you being on the show. And it’s been such a pleasure.

Courtney (guest):
Oh, thanks for having me, Kathy, and it’s been a lot of fun.