The proliferation of payments and payments innovation has also opened up fresh opportunities for perpetrating payment fraud, resulting in an upswing in fraud attempts last year.

“Examining the payments fraud landscape in 2023, we see an uptick in fraud activity from the previous year, with 80% of organizations reporting they were a victim of an attempted or actual fraud attack”, as per  the Association for Financial Professionals® (AFP) 2024 Payments Fraud and Control Survey Report, sponsored by Truist. The AFP survey polled over 500 treasury  practitioners from organizations of varying sizes and operating across a broad range of industries.

The findings of the 2024 AFP® Payments Fraud and Control Survey Report show that “Despite heightened awareness at organizations about payments fraud and the controls and processes put in place to safeguard organizations’ payment systems and minimize instances of fraud, it is clear that perpetrators of fraud are relentless. They are continuously devising ways to infiltrate payment systems at organizations.”

The survey delves into the nature and magnitude of fraud attacks directed at business-to-business (B2B) transactions, including the impacted payment methods. It also sheds light on the growing significance of business email compromise in payments fraud, along with the strategies organizations are embracing to safeguard themselves against fraudulent attempts. Here are the key takeaways:

Cheques and ACH debits identified as most vulnerable to payments fraud

Cheques and ACH debits were the payment methods that bore the brunt of fraud activity in 2023, accounting for 65% and 33% of impacts, respectively.

Source: 2024 AFP® Payments Fraud and Control Survey Report

According to the AFP study, “The fact that check fraud remains the most prevalent form of payments fraud is not surprising. Checks continue to be the payment method most often used by organizations.”

Source: 2024 AFP® Payments Fraud and Control Survey Report

Furthermore, the AFP survey revealed that “75% of respondents note that checks are being used at their organizations, with 34% reporting that over 25% of their payments are made via checks.”

Among larger organizations possessing fewer payment accounts (annual revenue of at least US$1 billion and fewer than 26 payment accounts), there is a greater inclination towards utilising cheques in comparison to organizations with annual revenue of at least $1 billion and more than 100 payment accounts. Specifically, 83% of the former opt for cheques, while the latter comprises 72% who do so.

The percentage of respondents indicating instances of fraud through ACH debits grew from 30% in 2022 to 33% in 2023, potentially linked to the rise in cheque fraud occurrences. Criminals are generating ACH debits using stolen cheque information.

Instances of payments fraud via wire transfers reduced from 31% in 2022 to 24% in 2023. There has been a consistent decline in the proportion of organizations falling prey to wire transfer frauds over the years. The AFP survey findings suggest that this is because companies have honed their ability to detect wire fraud attempts facilitated by business email compromise (BEC) scams, underscoring the effectiveness of their ongoing efforts to combat wire transfer fraud.

Organizations impacted by fraud attacks through corporate/commercial credit cards witnessed a notable decline, dropping from 36% in 2022 to 20% in 2023 – as did attacks via ACH credits decreased from 30% in 2022 to 19% in 2023.

Furthermore, the survey report goes on to state that “Respondents from organizations with annual revenue of at least $1 billion are more likely than those from other companies to report cheques were subject to attempted or actual payments fraud in 2023 (72% compared to 52% for organizations with annual revenue less than $1 billion).”

Payment fraud controls to safeguard cheque frauds

Given that three-fourths of organizations persist in their use of cheques, it’s imperative for treasury professionals to prioritize protection against cheque fraud, particularly considering their awareness of the fraudulent risks inherent in cheque usage.

The AFP survey report highlights several control measures that offer strong safeguards against cheque fraud:

• Positive pay or daily reconciliation, along with other internal processes, has been put in place by 93% of the respondents’ organizations to deter cheque fraud.
• Segregation of accounts by function for single purpose, endorsed by 87% of survey participants, serves as a preventative measure against cheque fraud.
• Payee positive pay, backed by 85% of treasury practitioners, stands as an important measure in mitigating cheque fraud.
• Another effective cheque fraud control measure is the adoption of tamper resistant features on cheques, supported by 85% of treasury respondents.

The AFP survey further indicates high satisfaction among survey participants regarding payee positive pay and positive pay, with 94% and 97%, respectively stating that these services are “Effective or very effective in mitigating check fraud.” Additionally, 90% of respondents consider “Post no checks” restriction on depository accounts and reverse positive pay to be “Effective or very effective” in combating cheque fraud.

Payment fraud controls to protect against ACH debit frauds

A significant majority of organizations (87%) employ ACH debits, favouring their reliability and efficiency over paper cheques because of their automated and digital functionality, as per the AFP survey. Nonetheless, the use of ACH debits exposes organizations to the risk of fraud. To reduce the likelihood of fraud via ACH debits, as found in the AFP survey report, organizations deploy various effective controls:

• Blocking all ACH debits except on designated account(s) set up with an ACH debit filter is reported as “very effective” by 79% of respondents.
• Debit block on all consumer items alongside a debit filter for commercial ACH debits, as noted by 68% of treasury practitioners, acts as a significant ACH fraud mitigation strategy.
• Blocking ACH debits on all accounts, cited by 63% of treasury professionals as a prominent control in minimising ACH debit fraud.
• Reconciling accounts daily to identify and return unauthorized ACH debits, as reported by 62% of survey participants, emerges as a “very effective” measure in curbing ACH debit fraud.

The AFP survey report additionally recommends that “For a company that receives ACH debits, it is imperative that it knows the origination of the debit amounts ahead of time, that the debits are fully authorized and have the proper debit filters and blocks on the company’s accounts so only preapproved company IDs are allowed.”

To conclude, payment fraud is on the rise, and with 70% of organizations using cheques having no plans to discontinue their use over the next two years, as indicated by the AFP survey, cheques and ACH debits are likely to remain the two payment methods most susceptible to fraud.

The 2024 AFP® Payments Fraud and Control Survey Report advocates that this vulnerability of cheques to payments fraud underscores the importance for treasurers to gradually phase out their usage and adopt alternative and safer payment methods to safeguard against fraud risks.

In the interim, it is crucial for treasurers to stay focused on payment security and fraud prevention, keeping an eye out for the next cheque or ACH debit fraud attempt, and implementing adequate controls to protect against payment fraud. These measures are vital for treasurers to fulfil their role as the superintendents of payment security, particularly since treasury departments are often the first to uncover payment fraud.