What Utah Business Owners Don’t Know About Payments Fraud

If a stranger called you on the phone and asked for your name, your business address, which bank you use, your account number, your routing number, how long you’ve banked there, and a copy of your signature, would you give it to them? Every time you write a check, that’s exactly what you’re doing.

For this reason, many business owners avoid writing checks, but if you’re relying on electronic transactions to keep your money safe, there are some troubling recent developments in payments fraud that you should also be aware of.

When we refer to payment fraud, we’re talking about unauthorized ACH debits, wire transfers, real-time payment fraud, impersonation, and traditional check fraud. These types of schemes move fast, and once your money is gone, it’s usually gone forever.

Unfortunately, the businesses that get hit aren’t always the ones paying the least attention. Sometimes even the savviest business owners fall prey to a well-organized scam. And lately, these types of scams are getting more sophisticated and difficult to catch.

Fraudsters Know More About You Than You’d Expect

The modern fraud operations we’re seeing today aren’t lone hackers. They’re organized groups that are staffed, specialized, and methodical in their techniques. Amy Foulks, President and CEO of First Utah Bank, has dealt with them directly. “These are very sophisticated groups,” she says. “We’ve spoken to them, and we’re often dealing with huge operations.”

Before these groups make a move against you, they’ve done the legwork to build an extensive profile about you and your business. Through public information like deed filings, PPP loan data, and lien filings, they can find out which bank you use, how large your business is, and who signs the checks. Dark web data originating from breaches into other companies fills in any details they might be missing. By the time they contact you or walk into your bank, they have enough information to sound convincing.

“It’s like robbing a bank, only much more sophisticated,” Foulks says. “They don’t wear a mask. They don’t have a gun.”

Fraudsters use specificity to manufacture credibility and a strong sense of urgency to short-circuit your instinct to verify their identity. For example, they might call you just after you’ve finalized a huge real estate deal, armed with knowledge about your bank and the deed transfer, trying to convince you to move funds. When these kinds of payment scams unfold involving ACH and wire transfers, it’s often impossible to recover the money.

Types of Payment Fraud

ACH Fraud: Someone obtains your account and routing numbers, sets up an ACH origination through a legitimate-looking platform, and pulls money from your account. No forgery required. The debit posts like any other transaction until you notice it isn’t one of yours.

Impersonation: Someone calls your business pretending to be from your bank’s fraud department and talks you into handing over your online banking credentials. Or, someone walks into a bank branch with a fake ID, pretends to be a customer, makes a transaction, and if it goes through, comes back for more. In both cases, the fraudster is impersonating someone with fake credentials or a fake ID, claiming to be someone they’re not.

Wire Transfer Fraud: Fraudsters use impersonation to convince you to move funds via wire transfer, like a bank employee flagging suspicious activity, or a vendor requesting that you update payment instructions.

The Clock Starts the Moment It Happens

For business-to-business ACH transactions, you have one business day to flag and return a fraudulent debit—this is a rule that’s consistently enforced at banks. Fraudsters know this, which is why they act quickly and move the money they’ve taken from you immediately, sending it through multiple accounts, across institutions and out of the country. If you can catch this kind of fraud early, there’s a real path to recovery. If you find it three weeks later, your path to recovering those funds is largely closed.

Wire transfers have no return window at all. The sooner First Utah Bank learns about a fraudulent wire fraud, the better. But in many of these cases there is nothing we can do.

How Positive Pay Helps Fight Payment Fraud

First Utah Bank’s Positive Pay creates a daily checkpoint between a fraud attempt and your money leaving your account for good.

To protect ACH transactions, Positive Pay allows you to whitelist every entity that’s authorized to debit your account and set strict parameters for each, like an authorized dollar amount and expiration date. For example, if your lender is set to pull $2,000 a month for 60 months, that’s exactly what will go through. But if a transaction is attempted in month 61, or a draw of $2,001 or more is made, it gets flagged.

Anything outside the whitelist triggers a morning alert, where you’ll be asked to decide whether to pay or return the transaction. If you don’t respond, the default can be set to automatically return unrecognized items.

For checks, you can upload a list of every one you’ve issued, and Positive Pay will instruct the bank to pay them according to your issued check list. If there is information that doesn’t match up, like an altered payee, changed amount, or a check you never wrote, you’ll know before it’s too late. This feature also doubles as a reconciliation tool—if a vendor claims they never got paid, you can look it up on the spot.

Building in More Protection

You can also protect yourself even further by pairing Positive Pay with a configured alert system. By setting up a morning summary of cleared checks, an alert text when transactions exceed a set threshold, and restrictions on accounts that should only ever receive credits, you can keep a close watch on what’s coming in and out of your account.

For wire transfers, dual control is one of the most effective and overlooked protections available. By setting up dual control, you’re creating one login for the wire, and a separate login that approves it. Even if you’re a one-person business with zero employees, you can still set up two separate logins. That one extra step can save you tens of thousands of dollars.

The One Thing Fraudsters Can’t Fake

There’s one layer of protection that security software and alerts can’t give you, and that’s a banker who knows your business well enough to recognize when something is wrong.

At a large national bank, they don’t know what normal looks like for your accounts. At a community bank, that relationship is the best defense you can have against payment fraud. Your banker knows your habits and your accounts and can spot an anomaly before it becomes a loss. They can also help you structure your accounts based on how your business actually operates and keep close tabs on anything unusual.

“Preventing fraud has become a ground game,” says Foulks. “We have all the tools that other banks have, but we also happen to know you pretty well. That’s a huge differentiator when it comes to protecting your business.”

Don’t Wait Until It Happens

Most businesses don’t think seriously about payments fraud until they’ve experienced it, and by then, the window to recover their funds has already closed. Positive Pay, account alerts, dual control on wires and ACH, and a community bank account are all easy to set up, and you can do it today.

Check Positive Pay is free to all First Utah Bank customers, and ACH Positive Pay carries a nominal monthly fee. Account alerts cost you nothing. Get a head start on fraud prevention by scheduling a conversation with our team, where we can chat with you more on how best to protect the balances in your deposit accounts.

Talk to a First Utah Bank business banker today.