An email comes in from an existing client that asks for a wire transfer. The funds appear correct, and the email relates to work you’ve already done together.
The only difference is that they want the funds wired to a different account number.
Will your staff notice?
For small businesses in Cape Coral, Fort Myers, and throughout Southwest Florida, ensuring cash flow involves monitoring where funds go. If you wire funds to a client or their supplier, even a brief phone call will help you prevent a mundane transaction from turning into a very expensive problem.
How Wire Transfer Fraud Works
Not all scammers send you outlandish-looking emails loaded with typos. Some scammers hack a legitimate email account and read previous communications to gain information. Then, they send out new wire instructions from an email address you recognize.
In some cases, they will provide an address that seems nearly identical to the actual one. Even a single letter difference can escape detection.
According to the FBI, this kind of scam is known as business email compromise. The idea is to create such a request so that it appears routine enough to receive money without questioning.
Spot the Signs of a Fake Wire Request
A sudden change in bank details
Any new payment instructions are suspicious and deserve a closer look. That includes a new bank, a new account number, or payment to another person.
There may be an explanation for the change. However, it should be verified before any money is sent.
Pressure to move fast
Watch for emails with urgent payment, requests to keep everything in confidence, and the demand to skip routine verification procedures.
This is the perfect time for a hastily written message to sneak in. Allow yourself to pause and assess.
Verify Wire Transfers With a Phone Call
Contact your client with one of the known numbers you have on record. Never use an unknown number from an email you received.
Ask them if they actually sent the request and ask how much they need, who should get the payment, and what are their bank account details through your agreed process.
The FBI’s Internet Crime Complaint Center advises using another mode of communication for any account verification. Sending an email reply to the same email address is not considered an independent verification because the scammer may respond to the questions.
If you fail to contact the correct person, do not transfer any funds.
Make the call a normal part of business
Make sure clients know in advance that your team will check wire transfers by phone. This way, an additional measure becomes a natural part of the process.
You can phrase it as follows, “We always check your wire requests at the number provided in our system.”
Be sure to maintain up-to-date contact information and validate any changes to it separately.
Know Your Clients, but Check Every Time
Good relationships with clients may assist you in recognizing suspicious behavior.
For example, a sudden change of the communication channel or an unusual request from a regular client who called you previously.
These cues are important. Trust your intuition if things feel wrong.
But even an appropriate request needs verification. Names you recognize and pleasant messages can be easily replicated. Ensure your employees verify all wires before they send them out instead of waiting for red flags.
Give Your Team a Clear Wire Transfer Policy
An simple written procedure will ensure your employees know how to act in suspicious situations involving money:
- Verify each wire request through a trusted contact.
- Verify any changes in the banking information prior to transferring money.
- If possible, ask for another person’s approval.
- Document who verified the wire and when.
- Pause any transfer that has not been verified yet.
Ensure your employees will face no consequences if they spend some time verifying their requests. After all, a good policy holds true even if the owner is busy or not around.
Protect the Email Accounts Behind Your Payments
Use strong and unique passwords, along with enabling multi-factor authentication, which requires one more login apart from a password. Keep your software up-to-date as well.
The cybersecurity guide for small businesses provided by the FTC provides free guidance regarding email security and employee training.
Card data security of businesses that accept credit cards is covered by Card Systems’ PCI compliance information. However, wire transfers require a separate process. Read our articles related to payment security for some more information.
What if You Already Sent the Money?
Contact your bank right away and tell them that there might be a fraud attempt and inquire about recalling the money. There are no guarantees here.
Keep the emails and the transfer receipts as evidence. Report the case to the Internet Crime Complaint Center of the FBI and alert your client through a trusted channel.
Make Payment Security Part of Your Routine
Checking wire requests is one way to protect your business. Keeping customer payment data safe matters, too.
Reach out to Card Systems to learn about secure payment processing and PCI compliance for your business. Our local Southwest Florida team can help you understand your options before a payment security problem puts your money or customer trust at risk.
