Payroll fraud is more than a “big company” problem. Small firms are also vulnerable. That’s nonsense, you say? Your small group of employees includes the best people you know. And besides, isn’t your obscurity an advantage? Whether you’re known only in your industry or your region, it’s still important to take precautions in matters of payroll.
Why? As bankers, we’ve seen fraud strike businesses of all sizes. Fraudsters and thieves are masters of psychology, so they recognize when your guard is down, and your cash is there for the taking.
The tricky thing about many forms of payroll fraud is that they can slowly drain money from your coffer, undetected. On average, payroll fraud lasts 24 months creating losses of $62,000, according to the Association for Certified Fraud Examiners (ACFE).
Most frequently, the source of payroll fraud comes from the inside, but it can also occur through an outside entity.
Examples of payroll fraud
When we talk about payroll fraud, we often think of the classic buddy punch where a co-worker punches in and out on behalf of an absent employee. But all it takes is one employee with access to the payroll system to make a lot of your cash disappear.
Manipulation of the payroll system
This occurs when an employee secretly changes their wage within the system, effectively giving themselves a raise. Another form of this is padding extra hours on a self-reporting time tracking system, or misreporting an expense or commission form.
Ghost employee
This is similar to a scheme in Shawshank Redemption, where someone from inside the company creates a fictional employee and issues paychecks they cash.
Payroll fraud cases also originate with upper management, where one abuses one’s authority to cash in.
Third-party payroll fraud
Third-party payroll fraud occurs when an outside bad actor gains access to the payroll system. They may achieve this breach through several methods, but it usually boils down to these two elements.
Business email compromise
This is where a bad actor sends an email with a link that downloads the malware right into your system. Including your payroll account, where they can issue payments to themselves undetected.
Social engineering
Social engineering is when criminals deploy psychological trickery to let down the guard of their employees. For example, the malware email could be a fake invoice from a vendor. Because it has all the right elements — contact name, logo and just-right messaging — the employee doesn’t notice the one tell-tale detail that reveals the fakery — an incorrect email address. That’s how they gain access through social engineering.
Read: Cyber thieves are trying to trick your employees into wiring money. Here's how to stop them
Payroll scams that target employees
W-2 phishing scams
During income tax filing season, beware and be aware of cybercriminals trying to unlock access to your employees’ W-2 information, allowing them to fraudulently file on their behalf and cash in on their tax return.
Direct deposit fraud
Payroll gets a call or emails an imposter playing an employee, requesting their direct deposit go to a new account. When payday rolls around, you learn the truth: The employee wasn’t paid, because the direct deposit went to a criminal’s account. (Only to have the funds withdrawn immediately after they appear.)
These would surely destroy an employee’s trust in your company. So investing in safeguards and educating employees and payroll staff is worth your effort and time.
How to fraudproof payroll
Guarding your payroll system against fraud requires cash management tools that verify and secure your payroll and other transactions. But along with that, it also means creating a culture where verification isn't taken as an offense, but one of the practicalities that accompanies business.
Checks and balances
As with any organization, payroll duties should be split between two or more individuals. The same individuals should not be tasked with submitting payroll, processing payroll and reconciling transactions. Having this checks and balances system makes it more difficult to commit fraud and get away with it.
Read: How to Maintain Cybersecurity with Remote Workers
Training
Educate employees on common tactics that bad actors use to infiltrate your system, from inside and outside the organization. Along with that, help them create a system where they feel comfortable verifying requests and flagging questionable transactions without fear of retaliation.
Read: Employees are key to protecting your business from corporate account takeover
Separate accounts
In case of infiltration, minimize your exposure by maintaining a separate payroll account from other banking and checking functions. This makes it easier to detect and identify suspicious transactions, so you can end it before it goes too far.
Positive Pay
This cash management tool keeps your business one step ahead of fraud. When a check is presented for payment, the bank clears it only if the check number, account number and amount are authorized by the business. Pairing this cash management tool with human safeguards (especially dividing payroll duties) creates obstacles to fraud.
ACH payment
Offer employees the convenience of direct deposit. You’ll eliminate the exposures from paper checks, checks that get lost or even doctored. Taking on the above security steps will also minimize the risk of ACH fraud.
Leverage payroll protection with our expertise
Get to know Minnwest Bank’s cash management tools to help you manage your money safely and efficiently. Get started now to help your business run more efficiently and block unauthorized transactions.
Set up an appointment today with a cash management specialist at Minnwest Bank.
