Fraudulent Account Takeover

Protect your business from corporate account takeover by following these best practices and avoid becoming a victim of opportunity.

• Do not open suspicious emails, open attachments, or click links on emails from unknown senders
• Never connect an unknown USB device to your computer
• Be cautious with emails or phone calls claiming to be from your financial institution, vendors, or government agency that ask for any type of nonpublic information (account information, online banking credentials, personal identification numbers, etc.)
• Install and maintain anti-malware, anti-virus, and anti-spyware programs

Monitor your business' account for vulnerabilities and in the event of a security breach, you'll be prepared to take steps to keep your business safe. 

• Reconcile deposit accounts daily and monitor activity regularly
• Contact your financial institution immediately if you suspect any transactions to be unauthorized or fraudulent
• Set up email or text message alerts for online banking administrative functions such as: New user added, new payee account(s) added to ACH or wire external transfer list, changes to payee account numbers or routing numbers, password changes on existing users, security feature changes (being disabled), etc.
• Immediately investigate unusual or unplanned activity

If your business becomes the victim of corporate account takeover, a quick and sound response plan will be the key to recovering funds.  

• Have an incident response plan written and tested ahead of time (do not wait until there is an actual attack). The plan should include how you will recover any unauthorized fund transfers and stop future occurrences.
• Identify key employees that will be involved in the event of an attack:
  • Management: Oversee and coordinate process
  • IT Department (may be outsourced): Identify and mitigate further attacks
  • Bookkeeping/ACH Officer: Work with financial institution on recovery
  • Insurance Company
  • Attorney
  • Corporate Security: Contact law enforcement
  • Public Relations: Work on press release if needed

Having a list to guide you when responding to a business security incident can make all the difference.

Learn More about Incident Response Checklist

Stay one step ahead and know the warning signs so you can spot a corporate takeover from a mile away.

• Inability to login to online banking system (cyber criminals may block access during an attack to distract the user and hide the theft)
• Strange message that online account is not available
• Sudden request for the user to input password (or security token) in the middle of the online session
• Creation of new online user account(s) or new payees
• Unusual user activity, such as login from a different IP address or at unusual times of the day
• Password or security token information suddenly not accepted
• External transfers to new payees (through ACH, Bill Pay, Wire)

Each day, Positive Pay compares the checks and electronic debits you’ve presented for payment against those you’ve issued to help prevent unauthorized or fraudulent transactions from clearing your business account. Ultimately, your business always decides whether to accept the check or not. 

Fraud Identification
Dramatically reduces the chances of fraud by identifying fake or altered checks and filtering fraudulent or unauthorized ACH transactions. It’s like having a set of robotic eyes reviewing your payments.

Verification
Every check or electronic payment presented is automatically verified. Prevent payment of duplicate checks & protect against lost or stolen checks. Authorized transactions will clear your account while unauthorized items are flagged for approval or returned 

You're in Control
If a mismatch occurs, you’ll receive an alert. You can decide whether the item is legitimate or fraudulent and can reject the item before any money leaves your account. You have the final say with Positive Pay.