Fraud and payment security

Fraud attempts are becoming increasingly sophisticated and may target organisations through email, telephone calls, messages or other communications. Being aware of how fraudsters operate and maintaining appropriate controls can help protect your organisation.

Fraudsters may attempt to obtain payments or sensitive information by impersonating employees, senior executives, suppliers or other trusted parties. Being alert to unusual requests and maintaining appropriate payment and verification controls can help protect your organisation.

Protecting your organisation from payment fraud

• Verify new or changed payment instructions.
  Confirm changes to payment or beneficiary details with a known contact, using contact details already held by your organisation.
• Be alert to unusual or urgent requests.
  Take particular care where a payment is unexpected, confidential or differs from your organisation’s normal payment activity or processes.
• Use appropriate payment approval controls.
  Where possible, payments should be reviewed and approved by more than one authorised person.
• Protect access and security credentials.
  Never disclose passwords, authentication codes or other security credentials, and ensure access to payment systems is appropriately controlled.
• Check before you act
  Do not rely solely on an email, telephone call or message requesting a payment or change to payment details. If anything appears unusual, verify the request independently before proceeding.
• Make sure employees know what to do.
  Employees involved in initiating or approving payments should understand common fraud risks and know how to escalate concerns promptly.

Common types of fraud

Fraud can take many forms. Organisations should be particularly alert to:

• Business email compromise,
  where a fraudster impersonates a supplier, client or employee, or compromises their email account, to request a payment or change payment details.
• CEO or executive impersonation,
  where a fraudster appears to be a senior executive and requests an urgent or confidential payment.
• Invoice and payment instruction fraud,
  including fraudulent invoices or requests to change beneficiary or bank account details.
• Phishing and impersonation,
  where emails, telephone calls or messages are used to obtain security credentials, payment information or access to systems.