6 ways businesses protect themselves from financial fraud

By: Meline Gasparyan: Head of Business Banking Treasury Solutions

Small and midsize businesses strengthen their defenses against financial fraud by using multiple safeguards. Account security, payment verification and approval procedures, transaction monitoring and employee training help address fraud risk at different points.

Small and midsize businesses face many forms of financial fraud, from account takeovers and executive impersonation to fraudulent changes to vendor payment information.

AI and other technologies are making some fraud attempts harder to recognize, but businesses also have more ways to protect themselves. Almost all businesses with $5M+ in annual revenue in a recent survey say they use fraud detection tools or expert advice to reduce financial fraud risk. Smaller companies are taking precautions, too. 89% of those with less than $5 million in annual revenue have fraud protections in place.¹ AI is also playing a role in fraud prevention. Roughly half of businesses of all sizes use AI-powered cybersecurity tools.²

In my work with businesses, I've found that effective fraud prevention doesn't rely on just one safeguard. Here are 6 ways small and midsize businesses are protecting themselves against financial fraud. 

1. Protect access

A criminal who gains access to a financial account, email account or payment system may be able to use that access to commit financial fraud. That's why controlling access to business accounts and systems is an important part of protecting against current scams.

Businesses should limit access to accounts, systems and sensitive information based on an employee's responsibilities. It's also important to regularly review who has access and remove it when an employee leaves or no longer needs it. These practices are part of a systematic approach to protecting a business account from unauthorized access.

Multifactor authentication adds another layer of security beyond a username and password. Citizens research found that 59% of $5M+ businesses that have not experienced financial fraud use multifactor authentication.³

2. Safeguard payments

Many fraud attempts are designed to trick a business into sending money, so safeguards to help protect payments are essential. Some businesses require a second "check" before approving a payment or changing where or how payments are sent. For example, a request from a longtime vendor to send payments to a new account should be confirmed using contact information already on file.

Fraud prevention services provide another layer of protection. Positive Pay helps identify potentially fraudulent checks, and ACH filters may help businesses control which ACH transactions are allowed to post to an account. 30% of $5M+ businesses that haven't experienced financial fraud use Positive Pay or other fraud detection services.³

It’s also important for employees who handle payments to understand how their actions may inadvertently put businesses at risk and how to take quick action to report fraud if it occurs.

3. Monitor activity

Keeping a close eye on account activity helps businesses identify and stop potential fraud, and automated alerts may help. Monitoring tools are particularly important now because scams have become more sophisticated and harder for even the most careful employees to spot.

Businesses use real-time alerts to identify unusual account activity and AI-powered tools to analyze transaction patterns and flag activity that needs review. More than half of $5M+ businesses that have not experienced financial fraud use automated alerts for suspicious transaction activity.³ A recent Citizens survey found that 48% of businesses with $5M+ in annual revenue use AI-powered cybersecurity tools to detect fraudulent transactions, payments or account activity.³

Businesses also need to decide who receives alerts, who reviews them and how suspicious activity is investigated. A clear procedure for reporting scam attempts may also help businesses identify and address potential weaknesses.

4. Standardize payment processes

Businesses make fraud harder for criminals by establishing standard procedures for making payments and changing payment information. Employees should know who can approve payments, how payment information should be verified and what steps are required before a vendor's payment information is changed.

Changes to established payment procedures deserve particular attention. New payment instructions from an established vendor, a request for a different payment method or pressure to skip an approval step should prompt additional verification. Criminals may try to make an exception seem reasonable or urgent, so employees need to know which steps are always required.

This matters for small businesses too. In a recent Citizens survey, 12% of businesses with less than $5 million in annual revenue said approving fraudulent payments or changes to payment information without adequate verification had created a cybersecurity risk or incident for their business.³

Dual approval can add another layer of verification for outgoing payments. With dual approval, one person initiates a payment and a second authorized person reviews and approves it before funds are released. Separating these cash management responsibilities may help prevent an unauthorized or fraudulent payment from going through.

Standard procedures don't need to complicate every transaction. They give employees clear steps to follow and make it harder for a fraudulent request to succeed. Financial fraud often results in lost time, money and reputation, so I tell businesses that the extra time spent following these procedures is well worth it.

5. Prepare employees

Businesses help protect themselves from fraud by preparing employees to recognize and respond to potential threats. Employees are typically the ones who receive payment requests, communicate with vendors and have access to financial accounts or sensitive information. This puts them on the front line to spot potential fraud before money or information is lost.

Employees should understand current scams and the fraud prevention procedures relevant to their job. Regular training should reinforce when to verify a request, which procedures should always be followed and how to report concerns. Businesses should also make it clear that employees have permission to pause and question a request, even when it appears to come from an owner, executive or trusted vendor.

6. Review protections

I encourage businesses to review their fraud protections regularly to keep pace with changes in the business and evolving fraud and cyber threats. New employees, vendors, payment methods or technologies may create risks that existing processes were not designed to address.

Citizens research found that 39% of $5M+ businesses that have not experienced financial fraud have a relationship with a business banker who can help identify fraud vulnerabilities and implement protections.³ A business banker may also help businesses review payment processes and understand available fraud prevention tools.

Next steps for stronger fraud protection

• Review account access and remove permissions employees no longer need.
• Identify where payments require additional approval or verification.
• Consider dual approval for outgoing payments so one person initiates a payment and another reviews and approves it before funds are released.
• Set up transaction alerts and assign responsibility for reviewing them.
• Document payment procedures so employees know how changes should be handled.
• Train employees on when to pause and verify a request and how to report concerns.
• Regularly review fraud safeguards and talk with a business banker about potential vulnerabilities and available fraud prevention tools.

How businesses strengthen their fraud protection

Businesses fighting financial fraud recognize the need for multiple safeguards rather than relying on a single solution. They control access to accounts, vigilantly monitor payments, establish clear procedures and train employees to look for and report potential fraud. Regular reviews with knowledgeable advisers help businesses keep these protections current and identify areas that need more attention.

Check out these business fraud resources or schedule time with a Citizens Business Banker to discuss ways you can protect against financial fraud.

Explore Fraud Resources

Frequently asked questions

How often should businesses review their fraud protections?

Businesses should review fraud protections regularly and when changes may create new risks, such as giving employees new financial responsibilities, adding payment methods or changing financial technology. A business banker may also help identify potential gaps and fraud prevention tools that could provide additional protection.

Which financial transactions may need additional verification?

Businesses may want additional verification for changes to vendor payment information, unusually large transactions, new recipients or requests that fall outside established payment procedures. The business should establish those requirements in advance so employees know when they apply.

When should a small or midsize business talk with its bank about fraud prevention?

Businesses do not need to wait until fraud occurs. A conversation may be useful when payment methods or the number or size of transactions change, more employees gain financial responsibilities or the business wants to understand which fraud prevention tools are available.