Tip of the Month for: February 2025
Beware of ACH Related Scams
Before we dive into this month's tip (really an important warning), we want to remind everyone that the Enhancement Ballot for 2025 is still available for downloading and voting on our website using the links provided here or by clicking on "Software Enhancements" in the column to the left. Vote to insure your company's voice is heard and part of the enhancement process.
We have seen a noticeable increase in customers using ACH's over the past few years. Some of this seems to be related to the number of checks getting lost in the mail as well as those being fraudulently altered and presented to payment. Due to these issues with paper and mailed checks, paying vendors via ACH has become increasingly attractive for a good reason and may still be safer overall than mailing paper checks. However on the issue of paper checks, keep in mind that we can create a "Positive-Pay" map for you in Answers that can be uploaded to your bank after a check run. Positive-Pay is a feature many banks offer that essentially gives them a way to verify that you have truly written a given list of checks and they can use that list to verify against checks as they are submitted for payment. They verify check numbers, amounts, payee names, etc. before allowing a check to be paid.
However we want to warn everyone that fraud can still occur when using ACH's as well. We have been made aware of scams such as the following described below that can lead to funds intended for a vendor being redirected to scammers and lost (and maybe unrecoverable).
(1) A letter or email is received claiming to be from one of your vendors requesting you update their banking information (i.e. routing # and/or account #). They may even be persistent and send reminders if you don't follow thru with initial requests. This could also occur if a bad actor gained access to your email and contacts and started contacting your customers requesting they change their ACH information for you to a supposedly new bank account.
(2) So you change their information on your vendor record to match their request. Another related suggestion here is to insure the banking information on your vendors is password protected and that only authorized users are given access to to edit this information.
(3) You then submit a payment to them and it is directed to this new bank account.
(4) Some time later you receive word from the vendor that you never paid certain invoices. Upon discussing/reviewing it with them, you find out they not change their bank account and they never sent out such letters or emails. (However some of their other customers may have been tricked into this same scam as well by now.)
(5) As it turns out the letter was a scam/forgery of your actual vendor, however authentic it may have looked, and/or their email may have been compromised making you think they were legitimately emailing you.
(6) By the time an investigation occurs the funds have already been cleared out of the fraudulently requested bank and transferred to a destination that may be unrecoverable.
(7) To make matters worse, this type of loss may not be covered by your current insurance policy. We have been told by some that you need to have a "cyber policy" that insures against attacks such as these (often referred to as "Social Engineering Fraud").
Our point in bringing this to everyone's attention is not to dissuade users from paying vendors ACH (or accepting ACH payments from customers), but to make you aware that such scams exist as you may already be aware. So just be sure to verify any requests like described above, especially those received via a letter or email by calling a known contact at the vendor and verifying such a bank change request is truly legitimate. Companies definitely do change bank accounts, but it is vital to insure any such request for changes are actually coming from a contact you trust and are confident in dealing with at vendors.
Finally, you may also want to warn your customers to never change your bank account for payments being sent to you unless verifying with you that the change is legitimate as you never know who these bad actors will target next. It is not always just large corporations being targeted.