In a time of tightened budgets and spending cuts at many organizations, more treasury and finance practitioners are expecting their companies to boost spending on fraud prevention than anytime in the past eight years, per the 2023 Treasury Fraud & Controls (TF&C) Survey Report.

The survey, underwritten by Bottomline and powered by Strategic Treasurer, polled over 300 respondents on their experiences and practices surrounding fraud and security.* In a webinar accompanying the release of the results last week, Chris Gerda, Risk & Fraud Prevention Officer at Bottomline; Omri Kletter, Global VP of Fraud & Risk Mgmt. at Bottomline; and Craig Jeffery, Managing Partner of Strategic Treasurer, discussed implications of and responses to the data.

High levels of fraud experience driving perception of rising threat level

This year’s survey found that 78% of respondents believe the threat level has increased or significantly increased in the past year. Just a single percent thought it decreased.

While this statistic is subjective and perception-based, Kletter noted that a similar percentage of near three quarters (73%) had experienced either fraud (29%) or suspected fraud (44%) in the course of the past year. “The individual feeling”, says Kletter, referring to the perception of increased threat, “is actually backed by data.”

The human element

Business email compromise (BEC) was once again the most common fraud type, with only about one in every five companies not experiencing any attempts in the past twelve months. Social engineering was second, at 65% experiencing it. “The weakest link is actually the people, to a certain degree”, Kletter commented on the top fraud attempts, both of which are methods that rely on convincing employees to act. “We’re seeing a shift for attacks that are targeting our lack of ability, many times, to differentiate between genuine and fraud activities.”

In addition to being a weak link at times, staff are also becoming a source of concern for internal threat as remote work continues. At the beginning of the pandemic, the problem was adjusting current staff to remote work safely. Now, however, as remote work remains elevated, the problem is shifting to hiring remotely in a safe manner.

“We’re starting to see organized crime trying to hire into financial institutions and key positions in treasury, and especially in big corporations, because they know that actually hiring in is easier today”, stated Kletter. As a result, more companies may be seeking solutions that mitigate internal threat.

Translate to action

Loss is often what drives taking steps to improve security, but this is reactive. The speakers from the TF&C webinar shared several action items recommended for treasury in light of the current fraud environment and the statistics the survey brought to light on security practices:

1. “How can you protect what you don’t know about?” asks Craig Jeffery. Nonetheless, it appears that many companies are unaware of the existence of many of their payment flows. “In our practice, we oftentimes find 60% to 100% more payment processes in an organization than is expected by payables, treasury, IT.” Take inventory of your payment flows so you know what to work on protecting in the first place.
2. Most companies lack an incident response plan. This is not a particularly costly or time-consuming measure to implement, and it could be the difference between permanently losing funds and being able to get them back. A rapid response that includes contacting banks and groups such as the Recovery Asset Team (RAT) in the US can allow you to freeze funds before criminals can get them out of the banking system or out of the country. According to Chris Gerda, the RAT has “an extremely good recovery rate, but you need to be very fast. You have to have a response plan that’s devoid of red tape… You have to be able to say, ‘This is fraud. We have to recall it now. We can’t dance around it.’”
3. Craig Jeffery notes that certain areas seem small and are often overlooked, but proper controls and practices in those areas can make a significant difference in protecting organizational assets. One of these is securing network drives that store payment files. While there are several ways of protecting these drives, none of the methods have high use, according to the survey. Recommended methods include full audit trails of records and access, active monitoring and regular review of access rights to the directory, and not giving administrators who can assign rights the ability to cover their tracks by deleting or editing log files.
4. If you have experienced fraud, share what happened with others in your company. This can help them recognize the vulnerabilities and respond.

Be proactive. Translate what you learn into action by looking around and asking what you can do now and what you can fix. Consider both how the human element could be strengthened and how technology could help, from monitoring behaviour to enforcing controls. Reverse engineer how fraud might happen at your organization and shore up defences before the criminals act.

To watch the full webinar replay, click here.

*Disclosure: Strategic Treasurer owns CTMfile.