It’s easy to feel a false sense of security in a company where everyone knows each other. Why would fraudsters steal from your small business when there are much bigger fish in the sea? And how could Amanda from accounting pose an insider threat when your kids play on the same youth baseball team?

The truth is fraud doesn’t discriminate based on company size. Small and midsize companies are just as vulnerable to schemes like business email compromise, wire fraud and insider payments fraud. It’s important to learn how to prevent fraud with a few proactive measures.

Best practices to help protect your business from fraud

Switching to digital payments solutions and fraud prevention services like Chase Connect® with Cashflow360^SM can help enable faster fraud detection and offer better protection against future threats. But it’s also very important to implement strong internal controls and best practices. Here are a few ways to get started:

Assess risk

• Educate your employees about different types of payments fraud that can threaten your business.
• Prioritize your organization’s fraud risks.
• Identify accounts most susceptible to fraud and reduce the opportunity for theft.

Establish internal controls

• Establish documentation requirements to support a request for a payment.
• Use dual controls and separation of duties to ensure oversight of all transactions and changes in vendor information.
• Perform callbacks to a vendor’s number in your system of record before processing all nonstandard requests for payments, as well as changes in payment instructions or contact information.
• Identify unusual behavior through key transaction reports.
• Use fraud protection services to help minimize risk.

Test controls

• Perform regular fraud prevention trainings to ensure payment fraud controls are being used properly.
• Identify areas of weakness by conducting mock phishing emails or business email compromise tests.

Learning about business fraud—the hard way

Let’s take a look at one household goods importer with around 25 employees that fell victim to fraud. The actions it took after insider fraud demonstrate how other companies with limited resources can combine online banking products with strong internal controls to better detect and protect against future losses.

You think you know somebody…

When the longtime president of this household goods company retired, the new leadership team began auditing financial records to identify changes and updates it could make. What they found instead was evidence that their bookkeeper, working there for more than a decade, was using the corporate credit card for personal expenses and writing checks to herself.

The leadership team uncovered around $100,000 in fraudulent transactions going back two years. Since the company was using paper statements and checks, the investigation process took a long time. The situation revealed the need for a couple essential safeguards:

• Multitouch approval controls mean that no one person—like a bookkeeper—can process a transaction on their own without another set of eyes reviewing transactions.
• Regular reviews of expense claims by leadership can validate the authenticity of transactions and catch fraud sooner.

Learning from a loss

Working with its Commercial Banking team, the household goods company began reevaluating its payments strategy.

First, it migrated all its accounts into Chase Connect® with Cashflow360^SM. These digital banking platforms helped expedite processes such as check-writing and took much of the time-consuming work out of the hands of the small finance team.

Beyond simplifying the treasury management services, JPMorgan Chase provided the company additional tools to improve payment approval controls.

• The company’s new management team expanded risk controls by requiring two separate individuals—including one from the management team—to digitally initiate and approve transactions.
• By automating reconciliation processes, the company made sure it could quickly account for and record funds accurately. If it suspected something was awry in the future, it likely wouldn’t have to manually sift through years of paper records.