Protecting Your Business From Cyber Fraud: Habits That Help Safeguard Your Money

Cybersecurity may sound like an IT responsibility, but for businesses, a cyberattack can quickly become a financial problem.

A fraudulent email can lead to an unauthorized payment. A compromised password can provide access to sensitive financial information. A convincing phone call can persuade an employee to change payment instructions or share information they normally wouldn't.

For businesses of every size, protecting data and protecting money increasingly go hand in hand.

This Cybersecurity Awareness Month, take the opportunity to review how your business identifies suspicious activity, verifies financial requests and uses available tools to help protect its accounts.

Phishing Is a Business Risk, Not Just an Inbox Problem

Phishing occurs when a fraudster impersonates a trusted person or organization to convince someone to share sensitive information or take an action.

For a business, the impersonated person could be a bank representative, vendor, customer, executive or even another employee.

Fraudsters may use email, text messages or phone calls to request things such as:

• Login credentials or security codes
• Changes to vendor payment information
• Wire transfers or other payments
• Sensitive employee or customer information
• Access to financial accounts
• Urgent purchases or payments

These attempts can be particularly convincing when the fraudster has researched the business or the people involved.

That's why cybersecurity isn't only about having the right technology. Your employees are an important line of defense.

Teach Employees to Recognize the Red Flags

One employee recognizing that something doesn't look right could prevent a costly mistake.

Train employees, especially anyone with access to financial accounts or authority to make payments, to be cautious of requests that:

• Create an unusual sense of urgency
• Ask them to bypass normal procedures
• Request an unexpected change to payment instructions
• Ask for passwords, PINs, or security codes
• Contain unfamiliar links or attachments
• Come from an email address that is slightly different from the expected address
• Request confidential financial or customer information

Employees should know that it's okay to stop and verify a request, even when it appears to come from an executive, longtime vendor or trusted organization.

Verify Payment Requests Using a Trusted Contact Method

A request to change where money is being sent deserves additional scrutiny.

For example, if a vendor emails your business with new payment instructions, don't simply respond to the email to verify the request. If the sender's account has been compromised, you could be communicating directly with the fraudster.

Instead, independently contact the vendor using a phone number or contact method you already know and trust.

Businesses can also establish internal procedures requiring additional verification before certain payments or account changes are authorized.

That extra step may take a few minutes. It can also prevent a much larger problem.

Strengthen Access to Your Financial Accounts

Protecting the way employees access company accounts is another important part of reducing risk.

Use Strong, Unique Passwords

Employees should avoid sharing passwords or reusing the same credentials across multiple systems. Unique passwords can help limit the damage if credentials for one account are compromised.

Enable Multi-Factor Authentication

Multi-factor authentication, or MFA, requires an additional form of verification beyond a password. Businesses should enable MFA wherever it is available, particularly for financial accounts, email and other systems containing sensitive information.

Review User Access

Not every employee needs access to every financial function.

Periodically review who has access to your company's accounts and whether their permissions still match their responsibilities. When an employee changes roles or leaves the company, access should be updated promptly.

Use Banking Tools to Add Another Layer of Protection

Good cybersecurity practices can be strengthened by financial controls designed to help businesses identify potentially fraudulent activity.

Heritage Bank business customers have access to tools and services that can provide greater visibility and control over their accounts.

Set Up Account Alerts

Digital banking alerts can help your business stay informed about account activity and identify transactions that deserve attention.

Determine which members of your team should receive alerts and establish thresholds or notifications that make sense for your company's normal activity.

Use Card Controls

Business card controls can give authorized users greater oversight of company cards and help manage how they're being used.

Consider Positive Pay

Businesses that issue checks can also consider Positive Pay, a Treasury Management service designed to help identify potentially fraudulent checks.

With Positive Pay, your business provides information about the checks it has issued. When checks are presented for payment, that information can be compared against your records so exceptions can be identified and reviewed.

It's another layer of control between issuing a payment and money leaving your account.

Create a Plan Before Fraud Happens

Knowing what to do before suspicious activity occurs can help your team respond more quickly.

Your plan doesn't need to be complicated. Establish:

• Who employees should contact when they receive a suspicious request
• Who has authority to approve payments
• How payment changes should be independently verified
• Who should contact the bank if fraud is suspected
• How compromised passwords or account access should be handled
• How incidents should be documented internally

Make sure employees know the plan, and revisit it periodically.

Cybersecurity training shouldn't be a one-time conversation during onboarding. Fraud tactics change, employees change roles and new technology creates new risks.

What Should You Do If You Suspect Fraud?

Speed matters when you believe your business's financial information or accounts may have been compromised.

Contact your financial institution as soon as possible if you notice an unauthorized transaction, believe account credentials have been compromised or suspect your business has acted on fraudulent payment instructions.

You should also secure affected accounts and systems, change compromised credentials, review recent account activity and follow any additional steps recommended by your financial institution and appropriate cybersecurity professionals.

The goal is to identify what happened, secure access and limit additional exposure as quickly as possible.

Make Cybersecurity Part of Your Financial Controls

Businesses invest significant time in managing cash flow, approving expenses, reconciling accounts and establishing internal controls. Cybersecurity should be part of that same conversation.

Technology can help, but effective fraud prevention also depends on informed employees, consistent procedures and financial controls working together.

This Cybersecurity Awareness Month, review how your business protects its financial information and accounts.

Log in to Heritage Bank digital banking to review your alerts, card controls, security settings, and other available tools. If you're interested in adding protections such as Positive Pay, connect with your Heritage Bank Treasury Management team to learn more about the services available to your business.