Hello, everyone, and welcome to today’s webinar, Stop Payment Fraud in its Tracks, Strategies for Verifying International Bank Accounts. Today’s webinar is sponsored by Vendor Info. My name is Mark Brousseau. I’ll be your co-presenter for today’s webinar.
Today, payment fraud is at an all-time high. Organizations are under siege from high-tech hucksters determined to rip them off. It’s harder these days to be able to determine which bank account change requests are legitimate and which of those are phonies. Artificial intelligence is making it easier for fraudsters to rip you off. And one of the hardest bank account change requests to determine the ownership of is those for international bank accounts.
During today’s webinar, we’re going to share with you strategies for verifying the ownership of bank accounts, whether you’re domestic or global. And to help me do all of that, I’m pleased to be joined by Phil Binkow, the Chief Executive Officer of VendorInfo. Hey, Phil, how are you today?
Hi, Mark. I’m doing well, thank you. I appreciate the opportunity to be here and to talk to this group of folks.
We have just a few housekeeping notes to go over before we officially get started. To ensure call quality, everyone’s voice lines have been muted today. We encourage you to ask questions throughout the webinar. To do so, use the Q&A tool on your screen to submit your questions to me. We’ll answer your questions at the conclusion of today’s webinar. And finally, an on-demand recording of today’s webinar will be made available to all of you within the next few business days. There’s no need for you to request it. We encourage you to share that on-demand recording with your peers and your coworkers.
Today, the risk of payment fraud is the biggest concern of accounts payable and finance leaders. During today’s webinar we’re going to talk about why it is that AP and finance leaders are so concerned about fraud. We’re going to share with you some challenges of verifying international and domestic bank account details and how it is that traditional processes for supplier onboarding and vendor information management may be leaving your organization vulnerable to fraud.
We’re also gonna provide you with best practices for bank account verification and key considerations when evaluating automated solutions for verifying the ownership of bank accounts. And as I said, we will leave time for your questions. We encourage you to ask them throughout the webinar.
So if the threat of fraud has got you nervous these days, you’re not alone. The fact is that 25% of AP leaders identified the risk of payment fraud as the single biggest issue facing their department, topping operational issues, lack of visibility, or even pressures to do more with less. There’s a good reason for this. Today, fraud schemes are becoming far more sophisticated. Fraudsters are using technologies such as AI to make their schemes harder to detect. And in many cases, these fraudsters are well-financed as well.
One recent fraud scheme that was broken up turned out had 500 employees, including an IT department and a marketing department to sell their ill-gotten data. What’s more, this fraud scheme was actually backed financially, at least in part, by one country’s government. It’s not just about paper checks anymore.
Fraud schemes are sophisticated. And if you do business internationally, well that creates even more vulnerabilities and complexities. The fact is, international payments involve more complex processes, and that makes it easier for fraudsters to manipulate and exploit gaps in our verification protocols.
And if you fall victim to fraud, the consequences could be dire. A successful fraud attack can result in significant financial losses, strained supplier relationships, and irreparable damage to your organization’s reputation in the market. It could even cause a decline in the value of your company. What’s more, there’s also compliance implications to ensuring that you don’t fall victim to fraud. In some regions compliance with anti money laundering and know your customer regulations requires verifying the identity of beneficiaries, and that makes account verification even more essential.
So why is it that the risk of international bank accounts in particular is so high? Well, for starters, fraudsters are focusing on tricking organizations into changing legitimate supplier bank accounts to their own, and that’s especially true when it comes to international payments. They know that in many cases, those gaps and processes can create some vulnerabilities for them to exploit.
What’s more, cross-border payments introduce complexities such as varying regulations and multiple intermediaries and even less robust verification systems. Not every country has the same databases that we have available to us here in the United States and all of that creates more opportunities for fraud. It’s also high stakes when it comes to international payments with large sums often involved in these international transactions – just one fraudulent payment can cause severe financial harm and potentially interrupt your critical supply chains.
So what is it about the way that most organizations verify bank account ownership that create these complexities? Well, for starters, different countries have different banking systems, and there’s often limited access to real-time verification tools. And we know that when things aren’t real-time, that’s moments that fraudsters can exploit. Without unified banking systems and real-time verification, it also makes it difficult to confirm bank account ownership.
PD
continue
There’s also limitations of traditional bank account verification methods when it comes to international payments. Manual methods or maybe the outdated systems that many of us rely on might not provide the accuracy or, again, the speed needed to prevent fraud and that leaves you exposed. We also find that there’s limitations in manual verification methods. These inefficiencies mean that fraudsters can exploit delays and gaps, successfully intercepting payments that were probably meant for a legitimate supplier.
And when we think about the way it is that most of us go about verifying bank account ownership details, there’s no surprise that fraud is on the increase. Paper approaches to verifying bank account ownership leave us vulnerable to forgeries. When we have manual processes, they’re susceptible to human error or oversights or things slipping through the cracks. And as a result of recent turnover in many finance and AP departments, many of our seasoned employees, those who we relied on to just intuitively know when something didn’t seem right, they might not work for us anymore.
That lack of real-time verification creates lots of room for fraudulent activities. And the limited authentication we discussed creates opportunities for fraudsters to swoop in. The fact is, security questions can be guessed at, or in some cases, socially engineered. Fraudsters have been known to make use of LinkedIn, newsfeeds, and even Dun & Bradstreet databases to glean information on our organizations. If we rely on email verification, well, now we leave ourselves open to manipulation or deception. In other cases, fraudsters can slip themselves into an email thread once they’ve hacked a supplier or maybe a senior manager’s account.
Limited data accessibility in many of our manual approaches to bank account ownership verification can hinder comprehensive verification and make it nearly impossible to monitor things on an ongoing basis. And the penny tests that many of us have used for years, well, they’re no longer valuable now that phishing schemes have become so prevalent. Who do you think it is that’s gonna verify those microtransactions if your supplier has been hacked?
There’s several best practices that organizations can use to help ensure their bank account verification processes are keeping their payments secure. The first, of course, is to train staff on fraud awareness. Many organizations take what I call a set it and forget it approach to training staff. They sit new employees down, tell them about the do’s and don’ts for fraud, pat them on the back and send them on their way, and never bring up the subject again.
The fact is, fraud schemes are constantly evolving and fraudsters are constantly adapting their tactics against individual companies as gaps are plugged. So you want to make sure that your staff is aware of all the new fraud schemes and all the things they ought to be on the lookout for. And this is harder now that many of our staffs are working remotely at least part of the time. Back in the day, we used to be able to rely on the water cooler talk – “You’ll never believe what I saw in my email box today” or “You’ll never believe what somebody tried to pull today.” Everyone hears that and then knows what to be on the lookout for.
If we’re not all in the office at the same time, well, we don’t have those opportunities to share those best practices. So we need to create mechanisms, whether it’s virtual lunch and learn sessions or sharing tips and tricks on our corporate internet, and we need to make sure they’re engaging. We also wanna make sure we have strong access controls all across our invoice to pay lifecycle. Look for accounts payable solutions with user access permissions, with automated segregation of duties so the same person can’t approve an invoice and initiate a payment.
With systematic workflows, we can make sure that somebody can’t cut a corner on a workflow that you’ve set in place. And you also want to make sure that there’s audit logging of all actions taken on a supplier onboarding file or on an invoice that we’re approving for payment. You also wanna make sure that you encrypt any sensitive data whenever possible.
You also wanna use multi-factor authentication. If you’re like me, this is a headache in our personal life, right? It’s another step that holds us back from getting stuff done. But the fact is, multi-factor authentication is a valuable tool for authenticating someone is who they say they are. So, whether it’s built into your ERP system, your AP system, your bank portal, or any other system you use in your AP department, you want to make sure everyone is using multi-factor authentication all the time.
This next step might surprise you, but I want you to prepare for the worst. I want you to develop a fraud response plan, because the fact is, despite all of best intentions, despite the best automation, we still might be the victim of fraud. And the sooner we act, the less the losses could be. So we want to make sure we have a plan in place of what we’ll do when we see an attempt or maybe even an actual case of fraud. Who will be notified? What measures will take place? What systems will be adjusted?
And finally, we want to regularly review and update all of our security policies. As I said, fraud is constantly evolving. So we want to make sure that our policies and procedures evolve with them. These are all a great step to ensuring that the way you go about verifying bank account ownership won’t leave your organization vulnerable to unnecessary risks.
But the best way to mitigate your risk of falling victim to fraud is to automate the process. And that’s true not just of domestic bank account ownership, but international bank account ownership as well. New international bank account verification solutions address the types of challenges we’re talking about today by enabling accounts payable departments to ensure the authenticity of a supplier’s bank details ever before the payments are processed. And the process is simple. And yes, it’s secure.
It all starts with buyers sending an invitation to a supplier. The supplier then registers through a self-service online portal. They input their bank account details. At that point the bank account ownership is verified. These bank account verification solutions use a combination of technology and validation processes to check both account and payee related information.
Things like whether the bank account actually exists, in what country it exists, whether the account can be accessed by the owner, whether it’s free of liens and restrictions, whether the account owner is a legitimate business entity, what is the business ID, whether the account holder’s name matches the intended payee, what the account owner’s business address is, and even when the business was established. These are the types of information points that will help give you the confidence that this is a legitimate bank account.
And when things don’t quite align, well, the solution will provide configurable workflows for you to take action. Ensuring that bank account details are accurate and that they’re legitimate, protects you from falling victim to payment fraud. And that is gonna safeguard your financial assets. But secure and timely payments do a lot more than just that. It also strengthens the trust with your suppliers. They’re gonna know that their information is safe with you, that you’re the type of business they want to do business with.
Automating the verification process also reduces manual intervention. All those manual processes for checking on bank account ownership, they’re time consuming, they’re error prone. Automating this process also speeds up payment cycles. It helps ensure that your suppliers can get paid sooner more accurately, and that your supply chain can keep humming. And bank account ownership verification also frees up your staff to focus on fulfilling higher value tasks.
So rather than be bogged down with paper shuffling and manual keying, now they could do things like data analysis. You better believe that’s the type of thing AP staff want to do these days. Automation enables real-time accurate verification of bank account details. That is going to significantly reduce the time it takes to confirm ownership and detect fraudulent accounts. It also provides consistency. There’s less room for human error and for somebody to think that this just isn’t their job or maybe that they’ve had a bad day and they cut a corner.
And all along the way, those audit trails that the solution is going to create, that makes it easier for you to identify any suspicious activity and to keep people accountable. Also, by integrating automation into your AP systems, now you can be sure that every payment is verified automatically, and that reduces the burden on your team, and that’s going to enhance your security and make them happier in their jobs.
The question you might be wondering is, “All right, well, how do I find a solution that’s gonna do everything that you just described, Mark?” There’s a couple of key factors that I want you to keep in mind. First, I want you to look for solutions that offer real-time verification. You wanna know instantly of any potential issues. You also wanna make sure a solution uses things like multi-factor authentication and continuous monitoring of transactions for any suspicious activity.
I also want you to prioritize solutions that provide robust protections against payment fraud. What does that mean? Well, I want you to choose solutions that are scalable, adaptable to international payments, not just domestic ones, and those that are designed to meet the specific needs of your organization and the types of suppliers that you do business with. You also want to make sure that prospective solutions cover both international and domestic payments. So you want to see how it is that they do this and if they do it in a way that’s streamlined and efficient.
So what’s the message I want to leave you with today? Well cyber attacks and payment fraud are increasing and traditional processes in accounts payable are likely leaving your organization vulnerable to fraud. The good news is the best practices and automation can mitigate your organization’s risk of fraud, but don’t take my word for it. Phil is now going to share with you a demonstration of vendor info solution for verifying the ownership of both domestic and international bank accounts.
So, just talking about bank account verification and then especially international bank account verification, there’s a couple of ways to actually make this happen automatically for you and for your team. One is you can have if the vendor is already registered with your portal, you can have them go and log on. If they’re not, you can send them an invitation.
Invitation would look something like this, but it would be customized around your operations and to meet your requirements. They get a link in an email that tells them to fill out the bank account verification form. They get a link and they click on the link and the link will bring them back to this site where if they’re not registered, they can register and we can certainly go through all the security in a more detailed dive if you all are interested in that. Or if they’re already a vendor, then they can obviously click at that spot as well.
So they come over here and then they start basically filling out the forms. Let’s just say it’s a new vendor and they’ll fill out their name, any DBA information, their street address. And then when it gets to the bank account information, it’s going to ask if they’re US based or a non-US bank. If they’re a US bank, then they will click on that and they’ll enter the appropriate information.
For example, is this an ACH account? Is it a commercial or an individual? Is it checking or savings? And then they’ll enter the routing number and the account number, the company name, the TIN, and also the address on the account, city, street, city, state and zip, and then they’ll select state.
And for a U.S. entity, then what would happen… well, let me go back and I’ll actually show you what happens if it’s not a U.S. entity because the data is a little different. We will say it’s a non-U.S. bank, in which case the banking information form comes up here and it asks for the appropriate SWIFT. You can click on the country, it’ll ask for the appropriate account numbers and the right information for that country and if you have an intermediary bank and click yes then it’s going to ask for the intermediary bank information as well.
When your vendor is finished with this they sign here and they submit the form. Now, once they do that, everything is verified either in real time or sometimes a little bit longer depending if it’s international, it might actually take a little bit longer. And I’ll explain that in just a second.
For a domestic account, there is color-coded green, yellow, and red icons that tell you whether the bank account has been verified or, in some cases, where it hasn’t been verified. This is one that’s verified and what this shows is that it’s an account at Wells Fargo, it’s an opened account, and everything matched completely. The organization name, the address, the city, the state, the zip, and the TIN. There’s also a Google Map functionality that shows you a picture of the facility at that address and a map as to where it is just for a check.
If it’s international… well let me go here first. If it didn’t match then like for here “Crazy Jim’s Pizza” which is in yellow, what we can see here is that it truly is a valid bank account but there’s something wrong with the other information. Crazy Jim’s, the name and the street address and the zip and the TIN, they all have alerts by them and alert means it’s not quite the same information. It’s a couple of characters off. City and state have warnings, which means what the bank has on file for these account numbers is significantly different than what the city and the state are here.
And what you can do with this is it can automatically go to a second tier of validation where without using any of your resources, a mini transaction can be sent to this account when the transaction comes back, the information with regard to who this account belongs to and their address and their TIN all comes back for verification as well.
For international, the system works a little bit different. For domestic, it hits a U.S. database. For international, there is no one database, so it will hit various countries’ databases for those countries that actually have databases of their banks. If it doesn’t hit one of those, if it’s not on one of those, then a mini-transaction can be made and the information to verify the bank account can be gleaned from the return of the mini-transaction.
Once you have seen this and then you review it, the system can go through a review and approval workflow that is customized to your operations. You can have multiple paths based on, for example, if it’s domestic or international or if it’s verified or if it didn’t get verified, you can have multiple paths and multiple levels at each path. The system has complete reporting capabilities and audit trail capabilities so you know who did what when and those are all certainly available in real time and online.
Mark: Indeed, this brings us to the Q&A portion of this webinar. If you haven’t already submitted your question for Phil or if you’ve thought of another question for Phil, go ahead, use the Q&A tool on your screen to submit your question to me now. We’ll answer as many questions as time allows.
Vivian’s wondering, so what countries does this work in?
Phil: Yeah, Vivian, that’s a really great question, and Mark’s going to show the screen that’ll give you some contact information for us, too. It works in every single country. Any bank account in any country can be verified with this application.
Mark: Lorraine is wondering, what’s involved in implementing this solution?
Phil: Yeah, it’s a great question, and this can be implemented pretty quickly. You know, it certainly would depend on what your workflow requirements look like, but we have folks where this has been implemented in a week or two, so it’s easy to do. It’s very straightforward.
Mark: A couple questions here about integration. Tomas is wondering, have you integrated with Concur and Edgar’s wondering about whether you’ve integrated with SAP?
Phil: Sure, so the system is for integration purposes, it’s neutral. I’d say about 40% of our customers use SAP or some version of it. Another 40% use Oracle or version of Oracle, the other 20% are just a wide range of ERP and other applications, including invoice processing applications.
Mark: Another attendee is wondering, what’s to stop your platform from being hacked?
Phil: Yeah, great question. Well, we take every preventative measure known to protect the data. It’s certainly encrypted. The system goes through what’s called penetration testing that actually has ethical hackers try to break into it. I mean, it’s an ongoing process to keep everything up to date. Certainly we have certifications that demonstrate the tools and the protocols that are used in order to make sure that your data is safe.
Mark: Another attendee is wondering whether you do TIN matching and sanction screening as well.
Phil: Yeah, great, great question. And we didn’t go into that at this point, but you know, as long as you’re having the vendor fill out some information, TIN matching and sanction screening, and there’s about 50 other lists that are at this point that’s growing, it’s growing, but all of that can be part of the application as well. Because a lot of people are going to the IRS site and doing TIN matching or they have another application where they have to look up for OFAC or EU or UK, other sanctions list, and this will do it all for you automatically.
Mark: Yeah, really free up that AP staff’s time. We do have a question about pricing, and I’m sure Phil and his team would be happy to address that offline. That’s all of the questions we have received here. Phil, if folks want more information or if they want to take a deeper dive into the solution, what should they do?
Phil: Sure, just feel free to either shoot us an email at my address on the screen, pbinco at vendorinfo.com or info at vendorinfo.com, we’ll get to one of our guys. You can feel free to call me directly. That’s my direct line, 678-894-4599. You’re happy to answer questions or if you’d like set up a time to do a deeper dive.
Mark: Thank you so much, Phil, for an excellent presentation and for sharing your insights with us today. And thank all of you for taking time out of your busy days to join us. On behalf of VendorInfo, this is Mark Brousseau. Thanks so much for joining us, everyone. Hope to speak with you all again soon.