Protecting Your Business from Cyber Threats and Payment Fraud

Cray Kaiser managing principal, Deanna Salo and principal Brian Kot discuss the cyber fraud risks facing companies, including spoofed executive emails, ACH fraud and check-washing schemes. They share practical safeguards, from multi-factor verification and positive pay to segregating bank accounts and tightening internal procedures, to help manufacturers protect their payments and vendor relationships in an increasingly targeted environment.

Transcript:

Deanna: I’m Deanna Salo, and I’m the managing principal of Cray Kaiser Limited CPAs. And today I’m here with one of our other principals, Brian Kot. And we’re going to be talking about our manufacturing clients. Cray Kaiser performs a number of services and has for our tenured period of time over 53 years with our manufacturing clients here in the Chicago area. And we want to talk about today some of the key indicators, the key challenges, some of the key observations we have when we’re performing our auditing, advisory, review, tax planning procedures with our clients.

In terms of internal controls, I mean this would speak to manufacturers and even any other industries. You know we’ve seen our fair share of cyber security defaults and breaches this year with our clients and really it’s the money handling, right. It’s payable checks getting washed, getting stolen in the mail. It’s ACH wires that are not getting double and triple confirmed. I guess, Brian, speak to some of those examples.

Brian: Cybersecurity is not new and we’ve been facing with it for many years, but it’s still ongoing. And the intruders are getting more aggressive and they’re getting better at what they’re doing. And they’re using AI now to create these emails and try and go after you. So one thing I have seen, very recently, is internal emails that are spoofed. You know, maybe I get an email from Deanna. It says dsalo at craykaiser.com. And it says, Brian, will you please wire $100,000 to a vendor that I would know. And I might just go ahead and do it because I think it’s coming from Deanna. So, these emails are very sophisticated. We have seen that happen.

So, what are some controls we want to put around place of ACHs? ACH is a good way to go. We don’t want to be doing paper checks. So, what would you put around an ACH to help control that?

Deanna: Yeah, absolutely. So, a lot of the financial institutions even have new programs to help customers, help companies kind of play alongside your banking transactions. You provide limitations for an amount of an ACH. You may have two or three people within your organization that might have to call in or multi-factor authentication, or pick up the phone. You know the old adage of picking up the phone to verify it and talking to the person who actually requested the payment or the vendor or the bank is you know still today is still a best practice. You know verifying, verifying, verifying. But we do see a lot of financial institutions helping companies providing extra services which are worth it in the long run. Because it only takes one check, one ACH to go to the wrong player and then you not having that money and those funds are now confiscated. And it’s going to take more than just the bank to try to find out on how to get it back.

From an internal control perspective as well, making sure clients have a segregation of duties as auditors. Here, we’re always looking for segregation of duties and accounting is usually pretty lean, right? Our clients don’t necessarily have infrastructure for three to five to seven people to segregate their duties. So, we find that even just some double checks, cross checks, laying on top of your banking and financial transactions, especially in today’s environment where clients are buying goods from China, they’re having to pay different gatekeeper fees and things like that, ports fees, and they’ve got ACH money. You definitely need to up your game in terms of your procedures. You may not need to add people to the tally of adding internal controls, but you’ve got to add the other P, and that other P is procedures. Adding some procedures, whether it’s coming alongside with the bank to getting some additional procedures performed there to help you with your banking transactions or even your internal procedures. Accounts Payable is going to issue a check to a vendor. The vendor requires a paper check. You really need to make sure that you can get some ACH availability to them in order to get their money faster. I think vendors on the other side should be pretty excited about getting their money faster.

Brian: And if your vendors are requesting paper checks and it’s the only way they’ll take it, you check with your bank on what’s called positive pay. It’s a process where it matches up the check number and the amount to the checks when they clear the bank.

Deanna: And that helps defray some of those cyber attacks and fraudulent funds getting moved from company to company. Just ask your banker, how often does your banker see a fraud or a cyber check that’s happening with them at the bank. They probably used to maybe be one a day or two a day that they might see it’s probably dozens a day. So the better you can create some internal controls, add a few procedures, talk to your bank about some of the processes they have, the positive pay and the like. And there’s fees to that but the fees you know the cost and the risk you may outweigh the insurance. An insurance on getting those checks processed accordingly. And the other thing, too, is, you know, we see a number of clients having multiple checking accounts. They use a specific checking account just for their bill pays, and they keep a limited balance in there. And they may have what is otherwise a sweep account that sweeps money in and out of it to ensure that in the account that might have exposure to the public, their vendors, or ACH, that those are limited in terms of the balances that are there. So keeping the rest of your residual funds in a separate bank account and then just moving that bill-paying function back and forth to that bank account. Again, just continuing to limit your risk of exposure with respect to losing funds in those situations. Manufacturing has an extra layer of that because our clients are typically sending money all over the globe for their purchasing of their raw materials, transit costs, transportation costs and the like. So they are paying a broader group of people. They’re getting the best prices on raw materials. So they may have hundreds and hundreds of vendors other than maybe a different type of a company that might have, you know, 20 to 30 vendors. And that’s who they all work with. You know, the more vendors you have and the more payments you’re drawing every month. And then lastly, just protecting your bank accounts, making sure that those wire transfers, ACHs, vendor payments that are going all over the world are hosted in a place that has some best practices within your company.

Brian: And if you have any questions, please contact us.

Deanna: And you can contact Deanna Salo or Brian Kot at Cray Kaiser at www.craykaiser.com. And we’re here to help. Thanks so much for listening in.