Concerns about Payments Fraud

With seventy-one percent of organizations having experienced attempted or actual payments fraud in 2007, according to the 2008 AFP Payments Fraud and Control Survey, companies need to remain vigilant and increase the use of sophisticated tools to confront criminals intent on committing fraud.

Large organizations were more likely to have been the targets of payments fraud than were smaller organizations. Eighty percent of organizations with annual revenues over $1 billion were victims of payments fraud in 2007 compared with 58 percent of organizations with annual revenues under $1 billion.

Checks were the most vulnerable payment instrument. Almost all organizations (94 percent) that experienced attempted or actual fraud were victims of check fraud in 2007. Organizations were much less likely to be subject to fraud from electronic payments than from checks, including: ACH debit (26 percent), corporate cards (13 percent), ACH credit (four percent), and wire transfer (three percent).

Still, even among organizations that were subject to financial losses from payments fraud, the financial damages were relatively small -- the median financial loss was $13,900.

The battle against payments fraud requires innovative technical tools and high alert to guard against the new technical capabilities and practices of criminals, said Arlene Chapman, CTP, AFPs Senior Consultant, Technical Services. Fortunately, as this survey shows, many organizations are successfully fighting back.

Effective defense against payments fraud calls for a two-pronged approach: 1) implementation of tight internal controls, and 2) use of financial institutions anti-fraud services. Among the most effective fraud-fighting tools are positive pay and ACH debit blocks and filters.

To avert hacker attacks, data breaches, and internal fraud, organizations have put into place a number of practices to protect their online payments and cash management data, including:

• Segregating responsibilities among different employees for payments template maintenance, payments entry and payments approval (88 percent)
• Using multi-factor authentication tools, e.g., tokens, digital certificates, smart cards (87 percent)
• Deleting online user IDs as part of the exit procedure when employees leave (83 percent)
• Assigning dual system administrators for online cash management services (82 percent)
• Requiring that online passwords be changed periodically (82 percent)

Organizations should also be on guard against internal payments fraud, as well as fraud from external sources. Almost two out of five organizations that suffered financial losses from ACH fraud report that internal fraud (e.g., employee responsible) was the reason for the loss. Half of organizations that experienced corporate card fraud indicate that employees were responsible for at least some of the fraud.

The survey includes responses from 552 corporate treasury and finance professionals including assistant treasurers, controllers, cash managers, analysts, and directors. The survey was underwritten by the Electronic Payments Network (EPN).

To obtain a complete report of the 2008 AFP Payments Fraud and Control Survey, please visit http://www.AFPonline.org/research.