How to Avoid Payment Scams: Sidestep the Lure of Phishing Scams

Ransomware attacks get a great deal of press these days, but misdirected payment fraud continues to be a bread and butter scam for thieves. Often the fraud is perpetrated through phishing emails, texts or phone calls.

The messages typically mimic known vendors, making it easy to fall victim. Artificial intelligence further complicates efforts to identify these scams. However, a few safeguards and keeping a vigilant eye for fraud can help prevent loss.

Local governments are easy targets for misdirected payment fraud, as publicly available board meeting agendas, summaries and minutes contain vendors, items being purchased or bid and payment amounts. MCIT members have been caught by these scams several times in the past few years.

Spotting and Avoiding Fraud

Although MCIT provides misdirected payment fraud coverage, its limit can easily be exceeded. These best practices can help members spot fraudulent requests before releasing funds:

• Train all staff in techniques to identify phishing scams and how to report them. MCIT provides materials to assist members with this in the Resource Library.
• Limit the number of individuals who can make changes to a vendor or payee’s direct deposit or ACH information and train them on policies and procedures (see below).
• Require that authorized staff verify payment changes before making a change. Best practice would be to call the vendor or payee using a known, previously verified phone number. Another option is personally to visit the payee. If the vendor is new to the member and a contact is not already in the system, refer to the contract or connect with a knowledgeable staff member for the legitimate contact information.
• Verification using email is not advised, but if used, start a new message to the vendor or payee and, again, use a known, previously verified email address for the vendor or payee. This should prevent the message from delivering to the perpetrators of the theft attempt.
• Request that the member’s bank call a specific contact at the member to verify a transfer of funds outside the United States before releasing funds. Most local governments do not send money internationally, but misdirected payment fraud is often perpetrated by those outside the U.S.
• Red flag Green Dot Bank in email systems. This online bank is frequently used in misdirected payment fraud scams.
• Require that the vendor or payee complete and sign a new direct deposit or ACH form to provide documentation if an issue arises.
• Investigate unusual requests, ask questions and verify the authenticity of the request. Red flags are sudden, urgent changes. Business payments are routine and common for public entities; any added sense of urgency should be considered suspect.

Internal miscommunication can also contribute to the success of a scam. For example, when asking another employee to “take care” of the payment change, the requesting staff member should be specific with what he or she means by this. Does “take care” mean to make the change, or does it mean to investigate its validity before making the change?

MCIT risk management consultant Richard Miehe can assist members with their cybersecurity risk management efforts. He has a special focus in this area.