Ecommerce Accounts Payable Fraud

Welcome to the Ecommerce Finance Podcast. I'm Stephen Brown with LedgerGurus. With me I have Rachel Wright. She is one of our accounts payable and accounting experts. We want to talk about some of the things we've experienced and how to prevent them.

Rachel, welcome to the podcast.

0:32 Rachel Wright

Thank you. Happy to be here and talk about fraud.

0:36 Horror stories

Stephen Brown

Let's talk about some horror stories.

The worst I've experienced, this wasn't actually an ecommerce business. Years ago we supported this company, and there was this thing called business email compromise. You'll get a phishing email, you'll click on a link, it asks you to put in your credentials, and you're basically giving away your login to your email.

Then the hackers get in and they're able to snoop around. The hacker got in and saw they were doing some large construction projects. They started spoofing the vendor to this company. They started talking to us as if they were the vendor. They started talking to us as if they were the CEO of this company. And they created this elaborate fraud where they injected false invoices into the system.

They asked us to change bank information, and they were able to get a decent amount of money out of the customer because the customer went along with the ruse.

This is one example of accounts payable fraud, but it demonstrates how these fraudsters, how these hackers, will go about trying to extract money out of you. And paying bills is one of the best ways for people to get money out.

Rachel, what are some of the examples you've seen over the years where people are trying to get money out of a business?

1:57 Rachel Wright

Yeah, so one example that I've seen. I think fraudsters often try to mimic something you might be familiar with and change it a little bit.

For example, we got one invoice that was for $60,000, so it was a lot of money. All the company information on it was correct. I researched it myself. The company address, EIN, everything was correct. A real company. The only difference is that they changed the pay-to name and the email, and they had it going to a CPA name, which didn't make a lot of sense.

But it's a subtle thing, and if you're not really paying attention, you might just go ahead and process the invoice, and then this fraudster would be getting this $60,000 payment.

I think it's important to really pay attention if something is that high. A $60,000 bill is not going to come through often, so it's something you really want to keep an eye out for and just verify that everything's correct before you process it. Fortunately, our team caught it. It looked off, and we found out it was fraudulent, so we didn't process it.

3:19 Stephen Brown

Yeah, and a couple of things there. Accountants usually aren't going to receive payments for their customers. Usually when you're working with an outsourced accountant, we're going to have you make the payment, not send it to us. Why would we want to take somebody's money just so we can pass it along? It doesn't make any sense. So that's an interesting red flag.

I've got another story, and you've probably seen some of these. I met with a customer a couple of years ago. It was their CFO or their controller, and he had had one of their Chinese suppliers email him and say, hey, we need to change our bank information.

It was right before Chinese New Year, when a lot of these manufacturers go offline. We need to get this payment in before Chinese New Year. Can you please process it? By the way, this is the new bank information.

So he went ahead and sent the payment to this new bank information. Turns out it was fraudulent.

Now, I don't know how they got in. Again, I described earlier how a lot of these fraudsters get in. They'll compromise your email, or maybe they even compromise the email of one of your vendors. And so they know how to communicate in a way that you might respond to.

They'll put on this urgency around changing bank information. And the challenge with an ecommerce business is that their biggest payments tend to be overseas payments for inventory. They're huge numbers. So beyond $60,000, you can get orders that are hundreds of thousands or millions of dollars depending on the size of the business. And it's often going overseas, so you have even fewer controls and protections than if there was a fraudulent payment done in the United States.

So there are a couple of patterns there, like changing bank information. You've seen this too. Do you have some examples where people were trying to get them to change bank information quickly?

5:21 Rachel Wright

We've definitely seen invoices, or emails with invoices, where they included bank information that wasn't previously provided. And again, they have this urgency where they try to make us think that this should have been paid a month ago.

Clients especially tend to get really concerned about those things and just want to push them through. That's really where you have to take a step back and evaluate: is this inconsistent with what we've seen before? And then go through the proper channels to verify whether this is legitimate.

6:03 The psychology of urgency

Stephen Brown

Oftentimes what these criminals will do is prey on human psychology. They'll say things like, if you don't pay me tomorrow, we're going to cut off services, or we're going to hold this order.

They'll find ways to give you a sense of panic, which, if you know a little about psychology, pulls us out of our rational brain into more of a primitive brain where we don't always think things through. We're like, oh my gosh, I'm in trouble. I need to do something to make this trouble go away.

I had a phone call years ago. It was really early in the morning, around six AM. They said they were from the IRS and that we had problems with a payment. They caught me out of my sleep, saying, you had a return issue, you need to get this payment processed right away, and so on.

Well, I work with a tax accountant, so I didn't respond. I said, hey, let me talk to my tax accountant and I'll get back to you. They triggered a panic in me. I talked to my tax accountant and they said everything's good. Then as I thought it through, I realised that was a fraudster. They were trying to get me to do something in that moment.

When in reality, the IRS isn't going to call you at six in the morning, even though they're two hours ahead of me. First of all, I don't think they do that kind of thing. They usually send you official letters.

So fraudsters will try to put you in a state of panic so that you do things irrationally. They'll create a sense of urgency. They'll create a sense that there's going to be a problem if you don't do this thing.

7:40 Rachel Wright

Yeah, definitely. It reminds me of those texts from USPS saying they can't deliver your package and you have to go to this link and pay $20 first. I've seen people get all stressed out about it, and I'm just like, that's not how they operate.

You have to ask yourself, is this how things normally operate? And usually it's going to be no.

8:08 Stephen Brown

And for these hackers, it's a numbers game. They only need to get one person, or a certain percentage of people, to bite on the fraud for them to have some success. But businesses are juicy targets because we send around big payments, and an ecommerce business can send around huge payments for inventory.

So we wanted to have this conversation because it's an issue we've seen for years and it keeps coming up.

Do you have any other examples of scenarios where fraudsters have tried something?

8:34 Rachel Wright

Yeah, speaking of going outside the norm. I got an email from a fraudster that was marked urgent, and they made it look like someone from our internal team had told him to send me this email so that we could process it. That's just not our process. We don't handle business that way. So that's another example.

9:08 Stephen Brown

Yeah, they'll fake a thread. They'll create an email that looks like it was a series of emails back and forth, and then you got forwarded the latest version. You weren't on the email chain until the end. A lot of this fraud is going on via email, sometimes via text.

9:23 Rachel Wright

And when you really take time to look at the details, you start noticing inconsistencies. Like the email address it was sent from changed halfway through the chain to a completely different address. There are these little hints that fraudsters can't always avoid. You just have to be willing to take the time to carefully review those things.

9:49 Separation of duties

Stephen Brown

So let's talk about some of the ways we can protect against fraud. These are things we do as we support our customers. We'll work from the basics up to where we see a lot of fraud being targeted.

Let's talk about this concept of separation of duties. What does that mean?

10:11 Rachel Wright

Yeah, so in our accounts payable work, we don't want the same person creating vendors, entering the bill, and approving it. Because then you open that up to fraud. If you don't have a second set of eyes on things, one person might miss something that another person would pick up on.

So best practice is to have someone processing the bills, meaning they take the first pass, they enter the bill and all the information, and make sure we have everything in the system. Then a second person approves it.

In the cases where we need to enter a new vendor or update vendor information, we have another person who does that. They review all the information, make sure everything looks legitimate, create the vendor or update the information, and then it goes to the person who will enter the bill.

Then we have an approver as the last line of defence before the bill goes out to get paid. That's how we try to separate things to avoid fraud and avoid missing those red flags.

11:21 Approvals as you scale

Stephen Brown

And a lot of small business owners will say, I don't need that, I just do it all myself. Which is great until it's not.

You work with me on LedgerGurus finance. I'm usually the final person to touch a bill and pay it. So I'm the one who pays. You all do the prep work, but there are times when we'll go back and forth and have our conversations. The reason we've gotten to this place is that we're bigger.

As ecommerce businesses get bigger, you get more people working on more projects, and there'll be a point where the owner can't have all the relationships with vendors.

In my opinion, it's good to have accounting prepare and manage the process. It's good to have the people who have the vendor relationships be the ones signing off saying, yeah, that was legit. And then it's good to have a final say, whether it's the CEO, the COO, or maybe a CFO, but somebody who's really going to be careful and make sure, hey, did everything get checked off? Was the process followed?

On that note, there's this concept of multiple approvals. You talked a little bit about approval. As you get bigger, you can't keep on top of everything. Your team is doing multiple projects. You're not involved in everything, nor should you be. But it's important to have different people signing off that yes, this was an appropriate bill.

12:51 Rachel Wright

Yeah, I've seen those differences with some of our accounts payable clients. Some of them just don't want to have anything to do with the process. They want us to process it and then they pay it.

Others will have one person from the appropriate department approve that bill, so they have several people approving different bills. That really gives me peace of mind, because we don't know all the doings of our clients. We could pass through a bill that maybe they shouldn't actually be paying, but we'd have no idea because we're not involved in that. So when they're involved, it really helps our process.

13:33 Stephen Brown

Yeah, and I can understand why people want to get out of it. The reality is, for me, paying bills is going in, scanning, and clicking pay.

And I see a lot of people, when we set up these processes, who still want to make sure: did everybody sign off on this? Did so-and-so, who's the one working with this vendor, approve it? Did it go through an accounting review?

That takes seconds. It's not like you have to go in and set everything up. But it's still good for people who care about their money and their assets. This is a good place to care.

14:13 Rachel Wright

Yeah, for sure.

14:14 Vendor management

Stephen Brown

The final area is vendor management. A lot of the examples we talked about were around vendor management. And when we talk about vendor management, what are we talking about, Rachel?

14:24 Rachel Wright

When we talk about vendor management, we're talking about the person or people who make sure our vendors' information is updated, or who add new vendors. We have special permissions for those people, so not everybody can go in and change those things. And we have processes where we verify information to make sure we're getting everything correct.

14:51 Stephen Brown

If you look at big businesses, oftentimes they'll have really slow accounts payable processes, and this is part of the reason why. It doesn't mean they don't have issues.

I saw an article years ago about some guy in Europe who just started sending invoices to Microsoft and they paid them. It was millions of dollars. Or maybe it was, I think it was Microsoft, it might have been another big tech company. All he was doing was sending fraudulent invoices with payment information.

Ideally, when you get a new vendor, you want to go through a process of making sure, hey, is this the person I've been talking to?

We like to use a technique for larger payments called verbal validation, or research validation. We research whether the address on the invoice matches public records. For contact information, I won't call the number on the invoice. I'll go to the website and ask to talk to somebody in accounts payable, and say I need to do a verbal validation.

A lot of companies, when you say that, know what you're talking about. They'll say, okay, let me read it back to you. And if that bank account doesn't match what's on the invoice, something's wrong.

16:04 Rachel Wright

Yeah. And I think these processes we've put in place have been very effective in catching fraud and avoiding it. We've caught a lot of things and avoided a lot of fraudulent payments.

16:17 Stephen Brown

So let's talk about the things you should pay extra attention to. What type of changes should you handle thoughtfully?

16:26 Rachel Wright

You want to know how your vendors are being paid. So if you're sending your vendor a check and you get a message that you need to update their address to a different address, you want to verify that and be careful to make sure you're sending it to their address.

That's something where you can reach out to the vendor using contact information you had previously, or go to their website. Another big one is bank information.

16:59 Stephen Brown

Let me stop you there real quick. What fraudsters could do is set up a business with the same name in a different place. They'll get a bank account, and then they'll redirect a check.

It's not that hard to set up a business and get a business bank account. So they'll redirect a check to a different address. They'll deposit it because the name basically matches what's on the check. Once that money clears, they'll take the funds out, move them to a different bank account, and move on.

So that one we don't see as much, because people are moving increasingly away from checks. Let's go to the next one, where we see a ton.

17:37 Rachel Wright

Yeah, a big one is bank information. We get a lot of invoices that have bank account information right on the invoice, and a lot of our clients really want us to just put in the bank information and pay it.

And that's really something where you have to be really careful, because we've seen these examples where the bank information isn't coming from the vendor.

18:10 Stephen Brown

Yeah, and there are really two points of risk here. There's the first time you're getting a vendor set up. And then, I would say in particular, when somebody asks you to change banks.

Here's the thing: do businesses change banks? Sure. It's kind of a pain. It doesn't happen that often. So if somebody you've worked with for years is asking you to pay a different bank account, that should be a bit of a, I won't say a red flag, but a bright orange flag. This is not something that happens every day. Slow down, check.

Because that's the other thing. We think it's easy to extract funds when you get a check. Well, when those funds drop into a fraudulent bank account, the minute they've cleared, they'll pull that out and it's gone. And when you're dealing with international wire payments, it's even worse. You have no recourse.

Pretty much even in the US, from what I've seen with bank fraud. I've been around a couple of situations and talked to some people who have dealt with this stuff. They said you can bring the FBI in, and there's a good chance you're still not going to get your money back. And worse yet, you might have your business in the news for the wrong reason.

So they said it's got to be pretty egregious for you to want to reach out to the FBI, even though you've been criminally abused. And you go back to the banks and they'll say there's nothing they can do about it.

So these are techniques that they will use, and they'll find ways to work through the grey areas of the system in a way that they can extract money.

What else should you be cautious about?

19:48 Rachel Wright

I think a big thing with communication, especially email communication, is that you really need to pay attention to email addresses.

We've seen a lot of attempts to impersonate an email address with a small change to make it look the same. That's something we've seen a lot. Or they'll have the name of your client, or someone you're familiar with, as the display name, but the email address itself will be different. So you really want to pay attention.

20:18 Stephen Brown

A good example, I'd say, is a .co versus a .com. I would argue that if you don't own the .co for your domain name, you really should, because hackers are going to want to go buy the .co. They'll send it from something like LedgerGurus.co versus LedgerGurus.com, and you may not catch that.

Another technique I saw in a complex fraud years ago: they took a vendor that had an M in the name, and they registered a domain name with the same spelling, except instead of an M they put an R and an N together. When you look at "rn" really quickly, it looks like an M. And it got missed.

So they do all sorts of devious things around technology. It's a lot easier if they break into email, but a lot of the stuff you've seen is them just sending things out into the ether. They'll just send it out. And it doesn't even have to be your email that gets broken into. If one of your suppliers' emails gets compromised, then they can start working it from that angle.

21:24 Rachel Wright

Yeah. And something I've actually done before is, if an email address has a lowercase L or an uppercase I where you could switch those out, I've taken a copy of the email address and made it all uppercase to make sure that it is the correct spelling. When I've been suspicious of something, I've actually done that to make sure it's the right email address.

21:50 What AI changes

Stephen Brown

So bad spelling is one of the things we see a lot. A lot of these hackers are foreign. There's a lot of industrialised criminal hacking coming out of parts of Eastern Europe and parts of Asia, and they're not always the best spellers.

For those of us who have been around this, bad spelling is one of the tells that we see. But in the age of AI, that tell might go away. I want to wrap up on where I think this is going to get even worse.

22:15 Rachel Wright

An uncommon phrase, too. Like, please kindly pay this. That's not something people normally say when we're doing business.

22:20 Stephen Brown

Yeah. What I worry about is spelling and good grammar. AI may be able to spoof that better than a non-native English speaker would.

That said, AI loves dashes. To me, when I see a dash now, I almost always go, okay, that was written by AI. But the grammar errors of these fraudsters may go away with AI.

22:52 Rachel Wright

That's true.

22:54 Stephen Brown

The other thing I worry about, when you talk about verbal validation, is that AI can now spoof voices. You can do AI videos. I don't know if we're quite there yet, but you might get on a video call with somebody and feel like you're talking to a person you know, and it might be a hacker impersonating them.

And one of the things I've heard about how you get around that: we may need to start using safe words that are only communicated when you're sure the person is on the other end. So when you go through some sort of validation sequence, there's a safe word that's used to validate.

I don't know that we're there yet, but from some of the stuff I'm reading and hearing about, that might be the next frontier for hackers, not only spoofing us in emails but spoofing us in video calls and phone calls.

Have you heard, Rachel, about the calls where they'll call older people and say, grandma, grandpa, I got into trouble in Mexico, can you send a wire to get me out of jail? Have you heard about that fraud?

24:02 Rachel Wright

Yeah, I have. My grandpa got something, I don't know if it was a call, about my brother being in trouble and needing money.

24:11 Stephen Brown

Yeah. They'll say, I'm in trouble and I need you to wire this money to get me out of jail. And it's really easy to spoof somebody's voice now with a lot of these AI tools. And then they'll go after vulnerable people and use urgent situations, like I'm trying to save a loved one.

I'm sure these techniques already are, and will probably become more commonly, used against businesses to defraud them.

24:37 Rachel Wright

Yeah, that's definitely scary.

24:37 Stephen Brown

So I think slowing down, double checking, triple checking, some of the same techniques we talked about, you can apply in the AI era.

When you set somebody up to get paid, make sure you're sure that's who they say they are. And then if anything changes, be darn sure, probably even double and triple sure, that those changes are legit.

If you apply those same considerations, especially to larger payments. It might not be reasonable to do that for every payment you have, but when you're dealing with amounts that are really large compared to what you have in your bank account, it's worth slowing down, pausing, and making sure you're doing it right.

25:21 Rachel Wright

Yeah, for sure.

25:22 Stephen Brown

Any final thoughts, Rachel?

25:25 Rachel Wright

Yeah, I just really encourage people to take even 30 seconds to review something, because chances are, if something's off, you'll notice it in those 30 seconds. It's just better safe than sorry.

I always try to push this. This is a big thing for me. I've seen a lot of stuff, and I think in the end it will save you money.

25:52 Stephen Brown

Slow down. Your dollars are hard to earn. Don't give them to the bad guys.

Thanks for joining me today and having this conversation, Rachel.

25:59 Rachel Wright

Yeah, thank you for having me.