Banking on KC – Stephanie Mallory & Sheila Stratton of CCB
Listen Now, or read the transcript below:
Kelly Scanlon:
Welcome to Banking on KC. I'm your host, Kelly Scanlon. Thank you for joining us. With us on this episode are Stephanie Mallory, the senior vice president and treasury services manager, and Sheila Stratton, the senior vice president, digital banking and operations, at Country Club Bank. They're here with us to discuss various forms of business and consumer financial fraud, how to avoid it, and what to do if you become a victim. Welcome, Stephanie, and welcome, Sheila.
Sheila Stratton:
Thank you.
Stephanie Mallory:
Thanks.
Kelly Scanlon:
This is a growing challenge, and I'm sure some of our listeners have had firsthand experience with this. So before we really get into the nuts and bolts, why don't you just give us an overview of the current landscape and how it's impacting people and the economy? Sheila, go ahead.
Sheila Stratton:
Sure. So financial fraud, it's really very vast, especially when you think about the multitude of ways that consumers can get caught up in this type of fraud and the different methods that fraudsters try to trick consumers. FTC did a study in February of 2022, and they found out that $8.8 billion was lost to consumers over fraud in that year. And that was the previous year, it was up 30% from the year before that. So as you can see, that's a big number and a lot of loss.
Kelly Scanlon:
It really is. Do you have anything to add to that, Stephanie?
Stephanie Mallory:
Yeah. So on the business side, over the past year, there's been about 40% of companies that reported a financial loss from fraud. Of those, only about 27% were able to recover 75% of the funds, which means that there were about 44% that were unsuccessful in retrieving any of their funds back.
Kelly Scanlon:
So especially with the smaller businesses that are really hit hard by those kinds of things, it can be even the difference between a profitable year or not.
Stephanie Mallory:
Absolutely.
Kelly Scanlon:
You mentioned Sheila, that there just, there's so many different kinds of fraud. Can you talk to us about some of the more prevalent ones, especially on the consumer side?
Sheila Stratton:
So that could be anywhere from your online scams that you run into. Imposter scams is a big one right now.
Kelly Scanlon:
What do you mean by imposter scams?
Sheila Stratton:
So people that are contacting us via text or email, posing as someone else, maybe even somebody that you think that you know, but they're asking you to either click on links, provide some either personal or financial information, and that's really how they start tricking you and getting that information to carry out their fraud.
Kelly Scanlon:
And I imagine it's pretty similar on the business side, but the person that you may know may be your supervisor that they're impersonating. What do you see on the business side, Stephanie?
Stephanie Mallory:
On the business side for sure, the biggest threat is business email compromise. So just like you were saying, either impersonating, maybe impersonating your boss, wanting you to send a wire out, or a vendor's email that gets hacked and is trying to get payment information, those types of things. So definitely business email compromise is the most prevalent.
We've seen an increase in ACH fraud as well as digital payment methods. That type of fraud has been increasing since 2021, and while we've seen increases in those types of fraud, checks actually continue to be the payment method most vulnerable because it's just a low-tech and low-cost kind of fraud to perpetrate.
Kelly Scanlon:
How are these fraudsters exploiting psychological and emotional vulnerabilities? I know you mentioned, Sheila, that they often imitate somebody that you know, or is there language that they use? What is it that they're exploiting that gets people to click on these links?
Sheila Stratton:
Right. A lot of times it's just playing on their emotions, creating fear and a sense of urgency. For example, we've all heard of the classic scene where someone gets a text or a phone call and it's from the IRS or maybe it's from law enforcement, and either something you've done, maybe you have back taxes, or maybe you've got a loved one that's landed themselves in some trouble and you've got to make this payment in order to help this person or avoid going to jail. And so they're really pressuring you. There's a sense of urgency with it. There's a fear factor that's going into it that's causing your emotions to get high, and you're not thinking, "Does this sound rational? Have I heard from the IRS before?" Those types of things. And that's how they continue to carry out this fraud.
Kelly Scanlon:
So really when you get an email or a text or phone call that you're not expecting, before you just jump in and start clicking on things or divulging information, you really should just take a deep breath and like you said, just consider is this really logical or is this something that I really should be taking action on immediately?
Sheila Stratton:
Right. Just take a deep breath, stop, think about it. Oftentimes, if you can maybe reach out to someone else, especially if it's one of those loved one type situations, if you can reach out to someone else in your family and ask them about this particular loved one, it could maybe stall enough time, and then you come to realize this doesn't sound logical, this is probably a scam that's happening.
Anytime anyone reaches out to you, especially if it's through a text or an email, trying to get you to provide the information, if it's a legitimate company, they're going to be okay with you stopping, calling a known number for that company, and verifying that they are actually reaching out to you, get ahold of you. Maybe you do have a payment or something that you're needing to make right.
Kelly Scanlon:
Yeah, and you make a good point there. You said a known number. Don't use any numbers or click on any links they provide in the communication. Go to the web, do your due diligence on the company, and find their customer service information and use that.
Sheila Stratton:
Correct. Yes, because more than likely, if it is a fraudulent email or a text that you're receiving, the information within there, including the contact information, that's going to be information for the fraudster. So if you call that number within that compromised email, you're just going to get the fraudster. So that's why you need to go to... Maybe it's a past bill that you have for this company that has their contact information. Maybe go out to the internet and put in the company's name and pull up their website and find the contact information there and call them that way.
Kelly Scanlon:
Exactly. And they're getting really good at these emails, too. They can make it look just like it came from the company.
Stephanie, I want to ask about the business side of this. Are you seeing similar types of things? Are there different sorts of schemes that they're running?
Stephanie Mallory:
On the business side, very similar with the email. So it may be that someone gets an email that looks like it's from the CEO of the company saying, "We need to get this wire out. It's an urgent matter," and a good employee wants to do what their boss wants them to do, and just like Sheila was saying, taking a breath and kind of thinking, "Do I usually get these kind of requests from the CEO of our company? Would he or she really be asking me to send a wire out like this?" So just kind of taking a beat, taking a breath, and listening to your gut a little bit.
Kelly Scanlon:
I find it fascinating that checks are still the most common way that financial fraud occurs, but we live in a digital age now. Technology is advancing all the time. So how have technology and digital banking transformed the methods, the ways that these fraudsters are targeting consumers, Sheila, and businesses, Stephanie?
Sheila Stratton:
Well, I think it just adds an additional element to the situation. It allows fraudsters to carry out scams through social media, online marketplaces, through text, those types of things. Online marketplace scam is you're selling goods or services on an online marketplace, you've got a buyer, you think. It happens to be a fraudster. So you're communicating with this person, they've sent you a check, let's say, for those goods that you've sold them, you deposit the check, and then all of a sudden that fraudster is saying, "Oh, I overpaid you." Maybe they overpaid you by $500, whatever it might be, and they need you then to send them that money back.
So you send the money back, and you send that back prior to the check that was deposited, that's going to come back to you as a fraudulent item. So now you are out the full amount of that check. That situation really plays on urgency. It also plays on, you want to think the best of people, that you're dealing with someone that is good-natured, you have this transaction, you want to make it right, so you're going to satisfy this person that you've been dealing with, and they've passed you a bad check. And then by the time it comes back, you actually end up to be the one out the money.
Kelly Scanlon:
So that's one example on the consumer side, and the online marketplaces are so prevalent that it's not surprising that they have found that as a really easy way to prey on people. Stephanie, on the business side, how is technology increasing some of the opportunities for fraud?
Stephanie Mallory:
So on the business side, generative AI has been a great thing for all of us and a lot of great advancements, but also it kind of fuels the fire for fraud on the business side. So things like voice cloning will be something that will be leveraged by fraudsters. So talking to someone-
Kelly Scanlon:
Tell us more about that. That's a new one. I haven't heard of that one.
Stephanie Mallory:
So they can kind of clone your voice. So even on the phone it's kind of sounding like maybe this sounds like my boss who I'm talking to, that type of thing. So I think, sadly, we're probably going to be seeing more of that type of thing. And then with things like ChatGPT, so when we were talking about business email compromise, it used to be that it was pretty easy to spot an email that was fraudulent because maybe the-
Kelly Scanlon:
Lots of typos.
Stephanie Mallory:
Lots of typos, the grammar wasn't right, things just didn't sound right. Now you can put something in ChatGPT, and it sounds really legit, and so it makes it a lot harder to identify emails that are not good emails.
Kelly Scanlon:
Well, with that in mind then, how can you spot signs of fraud? I mean, I know you, Sheila, had mentioned earlier that if something just sounds too good to be true or this really doesn't sound like something one of my family members would be calling me about. You've got those kinds of things, but what are some of the other red flags and warning signs that you can look out for that kind of tip you off that probably not a good thing to get involved with this?
Sheila Stratton:
I think as a consumer, number one, if I'm getting an unsolicited text or email from maybe a company, or maybe it might be a company I've dealt with in the past but I haven't talked to recently, and all of a sudden I'm getting a text or some communication wanting me to click on a link or telling me I have a payment due, I'm going to want to verify that information. I'm not going to just send my financial or personal information by clicking on a link within that.
So being aware that this is how the fraud is carried out is really big, and then also making sure that you're aware of those fear tactics and of those sense of urgency type tactics that are used to carry out the fraud from a consumer perspective.
Kelly Scanlon:
Yeah. Someone once told me that you can actually click on the email address. It may look like it's come from a reputable company, perhaps that you've done business within the past, but then when you see that hidden email address, it's from something that it's just a lot of gibberish in a lot of cases.
Sheila Stratton:
A lot of times that is true, hover over the link, it'll pop up where that link is going to, and a lot of times it won't be going to the place that you think you are going to. With the email address, you really want to pay attention to the spelling of it. Something maybe is typically spelled with two S's and they leave off an S. Okay, that's an indication because a lot of them are just a slight variation of the legitimate email address. So making sure that you're really looking at that information.
Kelly Scanlon:
What are you seeing on the business side, Stephanie? Are there other kinds of warning signs, red flags that business people should be paying attention to?
Stephanie Mallory:
I would say just looking at your transactions regularly. Something that looks, "I don't recognize this transaction. Where's it actually coming from? Have I seen that before? It's larger than usual," those types of things. So to be really familiar with the kind of account activity you see and when something doesn't look right to take the time to research it a little further.
Sheila Stratton:
One thing I'd add to the consumer side is if you happen to receive, maybe it's a bill from a vendor that you didn't purchase anything, that could be a red flag that you need to check out your credit report, see if someone has gotten ahold of your information there. So it's really important to monitor not only, as Stephanie said, your account information for suspicious activity, but your mail as well.
Kelly Scanlon:
In terms of prevention, what are some of the strategies and tools that you recommend, especially businesses, but also consumers, that they can use on a regular... Just good practices, tools that are available to them that they can use that are really working in the background in some cases to help protect against fraud.
Stephanie Mallory:
Yeah, there are lots of things businesses can do. Things like separation of duties, so having one person handle accounts receivables, somebody else is handling your payables. Using dual control on your transactions, so someone sets up a payment, someone else approves that, so you've always got two sets of eyes on things. Setting up account alerts, so if you're thinking I don't have time to be looking at my account every day, maybe you want to set up a text or an email to come to you if there's a debit over a certain amount or something like that that you want to be alerted to.
Kelly Scanlon:
So you can set up parameters.
Stephanie Mallory:
Exactly.
Kelly Scanlon:
And if they go outside those parameters, you get a notice.
Stephanie Mallory:
Yes. And then you can log in and take a look at that and make sure that everything's legit. When you get an email requesting that payment instructions be updated, verify it with a phone call, always verify with a phone call. And as Sheila mentioned before, not the phone number that's in the email you received, the phone number that you have for that individual.
Kelly Scanlon:
So when you say payment instructions, you mean from a vendor?
Stephanie Mallory:
Yes, could be a vendor, or it could even be sometimes we see that HR departments are kind of vulnerable to this, so they'll get an email that looks like it's coming from an employee needing to update payment information for direct deposit, and then payroll comes around and that employee didn't get their pay. So even that, even if it's a small organization, maybe just pick up the phone and call the employee and, "Just want to make sure you wanted to update that direct deposit information." So even HR departments can look for that.
And then positive pay are tools that you can use on the business side for check and ACH debits that can help prevent fraud.
Kelly Scanlon:
And positive pay is available through your bank, right?
Stephanie Mallory:
Correct.
Kelly Scanlon:
And Sheila, on the consumer side, similar kinds of things?
Sheila Stratton:
Right, so very similar. Make sure you're taking advantage of online and mobile banking, transaction alerts, setting those up as well. Card controls, that's another one on your debit card. You can set up card controls to be able to turn your card on and off and also set up those alerts for when your card is used. You can get an alert, you can set thresholds on that as well. Even things like setting per merchant or location type alerts along the lines of monitoring your account using online banking. Make sure you use online bill payment. Really take advantage of that along with online e-statements. Rather than having your statements go out via paper mail, always enroll in e-statements. That's a good prevention.
Kelly Scanlon:
That way nobody can intercept your mail and get your information.
Sheila Stratton:
Correct. And similar with payments. So take advantage of online bill pay that's offered through the bank or go directly to the biller. That way helps to reduce any kind of check fraud.
Speaking of check fraud, you really want to make sure that if you are going to send a payment via mail, that you walk that into the post office. Don't put the mail that might have a check in it in your own personal mailbox or in a blue postal box. We've seen a lot of fraud that's happened over the last year or so with regards to check fraud being carried out that way.
If you're a person that writes a lot of checks, and when you're monitoring your account activity through your online banking, make sure that you check on the check image on the cleared check so that you can see that the check actually was cleared and made payable to the payee that you intended. So we do see, especially how check fraud is carried out, especially if you're sending those payments and they happen to get intercepted, the check will be washed or altered in some fashion and made payable to a different payee. You don't always catch that if you're reviewing your account statements or your online activity because the dollar amount and the check number are the same. It's just the payee information has changed.
So for businesses and consumers alike, they really need to double check, click on that check image little link next to your check number and confirm that the payee is the same payee that you made it out to.
Kelly Scanlon:
Yeah, that's great advice because that would be easy to... You're just looking at the number and you're looking at the amounts and they match up, and they really went to somebody else and you still owe the money to the real person.
So Stephanie, we talked just a very little bit about small businesses a few minutes ago. When it comes to some of these preventative measures, a lot of times, the accounting department is one person. It might even just be the business owner themselves who has all kinds of other responsibilities, too, so they don't have the same resources as some of the larger corporations. What are some just very basic ways or advice that you can give for reducing fraud?
Stephanie Mallory:
At Country Club Bank, we work with lots of small businesses, so we get this a lot, where if I recommend separation of duties, just to your point, they only have one person. They don't have anyone else to do the AR and the AP. They're doing everything.
So one of the really basic things is whoever is working in your business, just make sure everybody's educated because the weakest link is really the human element in all of these. So whoever is working with you and supporting your business that they are looking out for all of these things, and really probably the alerts and the notifications are a really simple way, making sure you have the business mobile app, as well as Sheila talked about the mobile app on the consumer side, the business side as well. So for people who are not in front of a computer all day to monitor things, get that business mobile app, and you can review things that way as well.
So just really paying attention. Because as far as timeframe, too, if you do recognize fraud on the consumer side, you have a much greater amount of time to notify your bank, and they've got more time on the consumer side to try to get that back. On the business side, the timeframe's really short to try to collect the money back.
Kelly Scanlon:
Talk about that a little more. It would seem like they're all bank transactions. So why is it on the consumer side you've got more leeway as opposed to the business side?
Sheila Stratton:
On the consumer side, Regulation E, which is a consumer protection act, really gives that consumer 60 days typically to dispute an item on their account. So that is not afforded to the business customer. And so when you're speaking of ACH transactions that may be unauthorized, their window is limited to 24 hours from when that payment has posted. So the time limit is a lot shorter on business, and I think businesses are looking at their accounts daily, reconciling them, so the hope is they would see that quicker than maybe a consumer.
Kelly Scanlon:
Let's talk about people, businesses that they've done everything that you've said, but somehow something slipped through, they've become a victim of fraud. What steps should you take if you find yourself in that situation?
Stephanie Mallory:
First thing to do is call your bank. Call your bank. A good, strong banking partner is really important, and they'll know what to do. Sadly, we see this every day, we're dealing with some type of fraud, and we'll be able to help you get that resolved and see what steps need to be taken to try to retrieve the funds.
Sheila Stratton:
From a consumer perspective, if you are noticing fraud related to your debit card and you've enrolled in card controls, there's an option to turn off your card. So you can do that sometimes even before you can notify the bank, especially if it's on a weekend.
I would also, depending on what type of fraud is being carried out, you probably want to contact the three different credit agencies, maybe put some type of a fraud filter on your credit report at that time. FTC is a really good resource for consumers. They also have an area that you can file a claim if you are a victim of fraud and they will work with you on that.
Kelly Scanlon:
Given everything that we've talked about today and really how devastating an impact it can have on an individual or even on a business, what can be done to improve awareness and education to prevent future fraud?
Stephanie Mallory:
So I would say on the business side, getting to know your banker is really important. A strong banking partner is going to know the current trends, best practices. It's going to be something they've seen a lot of times. So to the business, it may be the first time it's happened to them, but we've seen it a lot and we'll be able to give good advice. So having a strong banking partner is important.
Kelly Scanlon:
So they can even proactively alert you to be watching out for new things that they're seeing?
Stephanie Mallory:
Absolutely. Absolutely.
Sheila Stratton:
I think from the consumer end, education awareness is a key. Anytime that you can know more about the fraud types that are out there and what the triggers are with those and how to spot them, prevent them, you're going to be one step ahead. And then really just making sure that you're taking advantage of those tools and capabilities, the online banking, online bill payment, card controls, transaction alerts. Those types of things will really help to prevent and also make sure that you're alerted immediately if there's something that's going on.
So Country Club Bank, we have resources, education, educational content on fraud, fraud tips, fraud awareness on our knowledge center, which is on our homepage on countryclubbank.com. If you scroll down, there's a knowledge center section, where you'll find all of the content and related articles.
Kelly Scanlon:
Yeah, it is a really valuable resource, and I really appreciate both of you coming on to the show today and talking with us about a really growing problem and everything that consumers, businesses can do and some of the tools that Country Club Bank offers to combat this. Thank you so much.
Sheila Stratton:
Thank you.
Stephanie Mallory:
Thank you.
Joe Close:
This is Joe Close, president of Country Club Bank. Thank you to Stephanie Mallory and Sheila Stratton for being our guests on this episode of Banking on KC. Their expertise in the evolving landscape of financial fraud provides invaluable knowledge for consumers and businesses alike. As Stephanie and Sheila noted, vigilance, education, and tools like online and mobile banking, transaction alerts and card controls alongside a strong banking partnership, all play key roles in combating financial fraud. As a community bank, Country Club Bank is committed to working with our customers to help safeguard their financial wellbeing from fraudsters. Thanks for tuning in this week. We're banking on you, Kansas City. Country Club Bank, member FDIC.