Tips on how to protect your business from fraud

Data security and fraud prevention are two of the biggest challenges facing small business owners.

Scammers can steal credit card information, PINs, and security codes to make unlawful transactions. A data breach at your small business can also lead to identity theft, tax ID theft, data mining, and even a loss of control over your accounts.

Some might believe larger organisations are the only ones at risk for a data breach, but small businesses are just as affected. In fact, according to the Association of Certified Fraud Examiners, small businesses lose almost twice as much money per year compared to larger companies.

4 warning signs of threats from scammers and hackers

When a scammer is looking to hack into your small business, they may try one of more of these four common methods: 

1. Sponsored ads or links: Scammers often list advertisements for their “support services” on search engines, such as Google and Bing. These links usually appear identical to trusted vendors and may even be accompanied by a phone number.
2. Phone calls: Scammers will make unsolicited calls claiming to be a trusted company requesting access to your computer, personal information, or online services. Fraudsters request remote access to run tests or virus scans, claiming your systems or accounts require unnecessary updates, upgrades, or repairs.
3. Unfamiliar emails: Scammers send emails and invoices using the brands of trusted companies to try and trick recipients into paying illegitimate invoices, sharing personal information, or downloading attachments with malware to gain unauthorised access to data sources.
4. Pop-up windows: Pop-up windows and messages that look like an error message on your screen may actually contain a virus or direct you to call a fraudster. These pop-up messages warn you of a fake security issue and usually provide a phone number for you to contact. They try to fool you by claiming to be a trusted company or using logos you might recognise.

Examples of small business fraud:

Insurance fraud

One of the most common types of fraud is when scammers disguised as a customer claim a “slip and fall” accident at your business. Of course, those injuries will never show up on an X-ray. Or, if you display your business name on a vehicle, another driver may suddenly slam on their brakes in front of you, causing a rear-end collision and more suspension injuries.

Office supply scam

A scammer may pose as your regular supplier; this hacker may email your business to “remind you” that it’s time to place your standard order of office supplies, such as printer paper or copier toner. If you fall victim to this fraudulent scam, you’ll likely receive an order for overpriced merchandise. It’s also a good idea to also let employees know of this type of scam. 

Payroll fraud

Payroll fraud occurs when an individual maliciously alters a payroll system to manipulate employee compensation. It’s a crime that employees and employers can commit. While employees do this by clocking hours they don’t work, employers can commit payroll fraud by withholding wages and benefits that employees are owed.

Bank account takeover

When scammers send fake emails or use fake websites to deliver malicious software, hackers can have access to IDs and passwords for online bank accounts and make withdrawals from these accounts.

Vanity awards

This occurs when a business falls victim to a scheme claiming they have been selected for a prestigious publication that features their small business as outstanding within their industry. This type of fraud always has a “fee” to consider.

4 common ways employees can fall for data breach tactics

It’s crucial that you train your employees to know the common ways data breaches occur, and the tactics these scammers may try and use. Some of the most frequent ways cyberattacks and data breaches occur include the following:

1. Phishing emails: This scheme is when a hacker sends an email to an employee that looks to be legitimate but has been designed to ask for account passwords, banking information, or even company credit card numbers. When an employee clicks the link in a phishing email, they’re taken to a website that is practically a replica of the legitimate site. Once the information is entered, the scammer steals this data.
2. Fake boss text messages scams: This type of scam is similar to phishing, but it’s in the form of a text message. An employee may be sent a text claiming to be their boss or CEO, asking that they send money or sensitive information to them immediately. 
3. Insider threats: Insider threats occur when someone who works for a company purposefully steals data, gives someone unauthorised access, or leaks passwords. They usually occur by an unhappy, disgruntled employee, or someone who is leaving the organisation.
4. Poor password practices: When an employee has a weak password that’s easy to guess, a hacker can access their account and a wide variety of sensitive information in seconds.

4 ways to protect your small business against data breaches

Thankfully, there are multiple ways you can protect your small business from falling victim to data breaches:

1. Reduce the risk of falling victim to sponsored ads and links: Only work or partner with companies you know and trust. Be sure to verify all unsolicited contacts with your support team, and pay close attention to spelling in fraudulent links and URLs.
2. Reduce your risk for phone calls: Always question whom you are speaking with as soon as the party on the other end starts speaking. Or, play it extra safe and simply hang up. Then, call a trusted number for the appropriate company and relay the information.
3. Reduce your risk of unfamiliar emails: Just like you would be wary of a suspicious URL, pay close attention to the sender’s email address. Is it one you recognise? Double-check the domain and see if it directs to a site you are familiar with, then look for obvious signs of fraud, such as poor spelling or bad grammar. If there’s a phone number within the email, do an Internet search to see if it’s legitimate.
4. Reduce your risk of pop-up windows: Closely examine the message within the pop-up window. Similar to email fraud, check for poor spelling or bad grammar. Then, conduct an Internet search for the phone number to see if it’s legitimate. Don’t follow the pop-up window's instructions, such as clicking on a call to action. If you suspect the pop-up has compromised your computer, use another device to contact trusted support services.

What to do if your business has been breached

If your business has been breached, there are specific methods you can use to try and rectify the damage. After a data breach, consider the following methods:

• If someone at your small business has given a scammer remote access to their computer, disconnect the computer from the internet immediately to stop their access.
• If you or one of your employees has paid a scammer or given them credit card or banking information, contact the financial institution and ask that they stop or reverse the charges, and cancel the credit card immediately. 
• If a scammer has convinced you or an employee to download or install a third-party application, uninstall it right away and call a trusted IT company. Then, make sure you have antivirus software and that it’s up to date. Have this software run a system scan and delete any program identified.
• If you or an employee has given access to any device or account to a hacker or scammer, change all passwords as soon as possible. Remember that trusted companies and legitimate organisations will never contact your small business and request passwords of any kind.

But what if it’s internal fraud? Here are 3 warning signs 

In a perfect world, you want to trust all of your employees. Unfortunately, that isn’t always the case, so it’s crucial that you know these three red flags to watch out for regarding employee theft and internal fraud.

1. Working long hours: An employee who comes in early, stays late, and works on the weekends isn’t always ideal. An employee committing theft may work on a holiday because there’s no one around to check their work or detect fraud.
2. Living beyond their means: If an employee suddenly shows up to work in a very expensive vehicle or with a luxury handbag that you know is outside their salary range, this may be a red flag. The same can be said for an employee who is always on lavish vacations.
3. Being overly stressed at work: Is an employee in your Finance Department extremely stressed about an upcoming audit? It could be because they have something to hide.

7 ways to protect your small business against internal employee fraud

Even with all the different types of threats and scams your employees can fall victim to, it is possible to protect your small business from this type of fraud. Follow these seven steps for fraud detection as you defend your business, and your employees, from scammers.

1. Know your employees

You place a lot of trust in your employees; therefore, it is helpful to take time to get to know them. Before hiring, consider background checks for all employees, especially those who have access to money or payments accounts. Taking this small step could lessen the likelihood of employee fraud taking place.

2. Verify invoices and payments

To lessen your business’ risk of fraud, establish clear procedures for approving invoices and expenditures, and consider who should be authorised to place orders and make payments. When you receive an invoice, go over the pricing details to make sure you ordered and received the items – and they’re not fake charges.

3. Know your vendors

When working with new vendors, research each new company properly, and continue to monitor their processes and behaviour. Ask for referrals and make time to check them. Do a quick online search listing the company’s name, along with “scam” or “fraud.” Finally, search social media to see what other people say about them. Reading reviews can be extremely beneficial in protecting your small business.

4. Dividing accounting duties

Split up the duties of sending invoices, collecting payments, making deposits, and recording transactions, so it’s not up to one employee with complete control over your business’ finances. And of course, always check financial statements for charges that don’t look familiar. 

5. Train your employees to identify and prevent fraud

It’s critical to teach your employees how to identify and prevent fraud, and report suspicious behaviour. Your employees are often your first line of defence against fraud, which provides a great opportunity to catch fraud in real time. Hold a staff meeting and go over the tips included in this article. If your company ramps up hiring, repeat this meeting as often as you see fit to ensure that new employees get this information, too.

Another proactive way to prevent and identify fraud is to use a dark web scanner that identifies and searches the dark web for your information on websites that buy, sell, and share stolen data. 

6. Give whistleblowers various ways to report fraud

Whistleblowers – individuals who learn of suspicious activity and report it -can be employees, customers, or vendors.

Almost half of the whistleblowers use hotlines to report suspicious activity. However, it’s a good idea to have multiple methods for a person to report fraudulent activity to increase the likelihood of potential fraud being uncovered. These can include:

• Email
• Web-based forms
• Mailed letters or forms

Make sure employees, customers, and vendors know these places exist should they experience suspicious activity. 

7. Stay vigilant

Stay aware of potential scams and be proactive in preventing identity theft. By watching for red flags and knowing how to respond in the event of a scam or data breach, you can help prevent your dream of owning a successful small business from turning into your worst nightmare.

What to do if your business has been hit by employee fraud

Once you’ve discovered your business is the victim of fraud at the hands of an employee, it’s best to take action fast. But it’s also smart to be careful. Obviously, the longer you wait, the more harm this employee can do, but there may be HR procedures in place that you need to follow.

If an employee wasn’t caught in the act, you first have to gather evidence. When you have enough documentation of the crimes, meet with the employee, lay out the case with all the information, and see if any other employees were involved.

Then, terminate their employment. Taking further legal action is up to your discretion.

Protection is possible

It can be daunting knowing there are so many types of fraud affecting small businesses. The first way you can safeguard all of your hard work is to educate yourself on the warning signs of fraud, and what you can do to mitigate your loss.