Fraud Solutions

[background music]

Narrator:

Preventing check fraud at your business. Today, paper checks are still a regular part of doing business for a lot of companies. Checks can be convenient, familiar, and relatively easy to track. As more companies are “checking out” of paper and adopting electronic payment methods, we’re seeing an overall decline in check volumes as an industry. And though paying by check may be going out of style, fraud remains a serious threat. 

In 2020, nearly two out of three businesses using checks reported actual or attempted fraud events. Old-fashioned as checks may be for making payments, criminals are using today’s technology in order to commit fraud. Why? Criminals only need a few key pieces of information to steal from your business or your customers– all of it available on your printed checks. Even with security watermarks, thieves have several opportunities. 

First let’s start with your stock of blank checks. These list your name, routing number, and account number. Criminals can forge a check from your account by using that personal information, either via a stolen blank check or by printing their own. How can you make sure that this information stays safe? Keep your blank checks and deposit slips somewhere secure, like a locked file cabinet, and never out in the open, such as your desktop. 

When you receive a new check order, make sure all the checks are present and in sequential order. If a check is lost, stolen, or missing, report it to the CB Fraud Support Team immediately at CB.fraud.support@jpmorgan.com. If you need to make a payment by check, use dark, permanent ink that can’t be removed or modified, and don’t leave blank spaces on the payee or amount lines where fraudsters can fill in new text. Make sure the check’s envelope is dropped into a secure outgoing mailbox where it can’t be easily intercepted. For added security, send the mail or package using a tracking number. All checks that aren’t sent as payment should be labeled “VOID” or destroyed.

While the check is in transit to the recipient, there are also opportunities for theft. If a criminal intercepts the check from its intended recipient, they can forge a signature on the back, allowing them to negotiate the check themselves.

With the rise of convenient, mobile deposits through smartphones, people no longer give a physical copy of the check to their bank. That makes it possible for a criminal with a stolen check to deposit or cash the same check multiple times, often with different institutions. When compared with faster, digital alternatives, fraudsters can take advantage of the slower processing times associated with checks. So they can walk away with money before the scheme is uncovered. 

Check fraud doesn’t always come from outsiders. Make sure you have sufficient controls and signing rules to prevent abuse by those inside your organization. Do use available fraud protection tools to help keep your business safe. Always stay vigilant for suspicious activity by setting up alerts and by frequently reconciling your accounts. 

Remember: Commercial Banking clients who experience check fraud are responsible for the losses that would have been preventable using available fraud protection products like Positive Pay and Reverse Positive Pay, which are solutions that are offered broadly to Commercial Banking clients. With Positive Pay, you’ll provide details about the checks you’ve written, and they’ll be compared against any checks presented for payment from your account. If the details don’t match, you decide whether the checks are either paid or rejected. If you activate Check Protection with Payee Name Verification, we’ll verify that the name on the check matches the name you provided to us.

Then there’s Reverse Positive Pay. We’ll show you checks presented for payment for which you haven’t provided issuance information. After reviewing the checks, you can decide to pay, reject, or adjust the amount. Please also take time to consider your encashment settings when using Reverse Positive Pay. Encashment settings can limit the amount of cash that can be paid out at a Chase teller line when items are presented for payment. If you prefer to go check-free on a particular account, enable Post No Checks as a setting to automatically block checks on that account. Remember: If you notice fraudulent check activity, it’s important to act quickly. And for more information, visit: jpmorgan.com/fraud-solutions.

END

Did you know that your email is the number one threat factor inside your organization?

Business email compromise schemes, better known as B-E-C, are one of the most financially damagingcrimes to organizations. In 2020, 76 percent of organizations reported that they had experienced B-E-C fraud and criminals are escalating attacksagainst businesses like yours.

Here’s how criminals carry out B-E-C schemes:

First, they pick a target after conducting research. Criminals use search engines, your corporate website, even checking your social media accounts such as your LinkedIn profile to find personal and employment information.

They're looking for someone with payment access such as a treasury or accounting employee or someone who can direct a payment to be made such as a senior executive.

Once a victim has been identified, it’s time for the criminals to go “phishing”. They send a phishing email that looks authentic, but is fake. There may be anattachment in the email or there may be a link asking for the user to click for more information.

Clicking on that link or opening an attachment could compromise your email account or your computer. And all of this happens without your knowledge. Criminals now set the rules.

They can create inbox email forwarding rules so when keywords such as payment, wire, or invoice appear, the email is automatically directed to an external account controlled by the criminals.

They can also conceal emails from the user. But would you know how to spot the signs of a potential B-E-C scheme?

Let’s see if you can spot the signs.

This email that appears to be a standard request from a trusted vendor asking for a change in banking instructions.

But let’s take a closer look.

First, the email is coming from a lookalike domain that is crafted to deceive the user. The real domain name has two “t's” in it, but the criminal registered a domain with just one “t” to trick the reader into thinking it came from the correct domain.

Second, a criminal may say the valid account can not be used anymore for a specific reason. Other warning signs include: A sense of urgency. You must act quickly or something will happen.

If the criminals are impersonating one of your executives, they may ask for a wire transfer immediately.

Asking for a payment to an overseas destination such as Hong Kong.

Does it make sense for your vendor to ask for an invoice payment to be made to an overseas bank account?

When you receive a request for payment, change in payment instructions, ora change in contact information, you need to validate the request before acting on it. Perform a callback to the actual person making the request directly before sending any payments. Look up the number for the requestor in your internal system of record and pick up the phone.

Never use a phone number from an email to validate a payment. Confirmation with the actual requestor can stop a B-E-C scheme and protect your organization from a potentially devastating fraud loss.

If your bank calls about an unusual payment, treat the call seriously.

Confirm you've followed your internal controls including a callback. This may be your last opportunity to stop fraud!

But what should you do if you are impacted by a B-E-C scheme?

It is important to act quickly. Contact us immediately if you suspect you are the victim of a B-E-C scheme. You should file a report at the FBI’s

Internet Crime Complaint Center at IC3.gov, contact your local FBI office and your local law enforcement agency to report the crime. In some cases, law enforcement can assist with the recovery of funds.

We have created a B-E-C toolkit for executives and payments employees to help keep your organization safe.

Contact your relationship team for information.