Bill fraud tips

Shame and anger. Those are often the feelings of customers when they find out they have been victims of bill fraud. This is not always justified. In fact, criminals are becoming increasingly sophisticated, making invoice fraud sometimes extremely difficult to spot. Yet the risk of invoice fraud can be greatly reduced by a number of (simple) security and precautionary measures.

In this article, I discuss i) the most common forms of invoice fraud ii) tips to prevent invoice fraud iii) what you can do if you are faced with invoice fraud and finally iv) who bears the loss in invoice fraud.

Forms of invoice fraud

The most common form of invoice fraud is sending a fake invoice for a payment obligation that does not exist or an invoice from a nonexistent company. This form - with some acuity - is often easy to spot because there is generally no relationship with the billing party or no work performed.

It becomes more risky when an invoice from a (regular) supplier, for example, is intercepted and the supplier's account number is changed to the criminal's account number. This form is significantly harder to spot, especially if the forged invoice is accompanied by original attachments such as packing slips.

Nowadays, many invoices are sent by e-mail. However, invoice fraud can also occur digitally. The criminal then hacks into the supplier's system and sends a false invoice or a false message about a changed account number from there. For the customer, it is as if this message came from his supplier.

I have also encountered in practice that internally at the supplier there was a mole who changed the account number to an account number of himself or a criminal friend. This is the most difficult form of invoice fraud to prevent.

Finally, there is invoice fraud in which an employee - often from financial administration - supposedly receives an e-mail from the very top boss requesting that a hefty sum be urgently transferred to an account. This is also known as CEO fraud.

Tips to prevent invoice fraud

With all forms of invoice fraud, prevention is better than cure. Here are some tips to prevent invoice fraud.

1. Always check before paying invoices to see if the account number has changed. If it has, contact the supplier. If you have a good accounting package, it will alert you if the bank number of an existing relationship has changed. Is the relationship unknown? If so, be sure to check the invoice carefully!
2. Check whether payment deviates from the usual patterns. For example, if invoices used to be sent to you by mail and now they are sent by mail and e-mail, that is cause for extra caution. The same goes for a shorter payment period than usual, a different layout of the invoice, a different contact person or legal entity to whom payment should be made, etc.
3. Virtually all banks now use name account number verification (again). This prevents the risk of invoice fraud considerably. If a report comes in that name and account number do not correspond, do not transfer but inquire first.
4. Follow your intuition. This sounds woolly, but almost always I hear from victims that they already had a gut feeling that something was not right. When in doubt, don't pay!
5. Have your internal control systems, your administrative payment processes and your IT security in order, and work with clear procedures and set control steps where, for example, payments above a certain limit must be approved by several people.Don't deviate from this, even if a higher-ranking person urgently requests payment.
6. Inform your employees that invoice fraud is a current and common problem and make them aware of suspicious circumstances. In short, get them to recognize red flags .

What to do about invoice fraud?

You can reduce the risk of invoice fraud. Unfortunately, however, you cannot eliminate it. What should you do in the unlikely event of invoice fraud?

Most important tip is that speed is of the essence. Time is of the essence. The faster you act, the more likely you are to see a return of the money.

1. Inform your bank and the fraudster's bank. Try to undo the payment and, if possible, get the fraudster's account blocked.
2. Contact a lawyer who can place a prejudgment attachment on the fraudster's bank account to which the money was transferred (especially if the bank does not block the accounts on your report). This attorney can also try to obtain the fraudster's identity information through the bank so that civil proceedings can be initiated against the fraudster.
3. Report it to the police immediately. Do this yourself and also have your supplier do so.
4. Conduct research within your own organization. Is the cause of the fraud internal or external? Look critically at your control systems, your administrative payment process, and your IT security.
5. Be prepared for a lot of frustration and a long wait. Banks, without pressure from an attorney or proceedings, will not cooperate much, if at all. Police cannot or will not provide relevant data so as not to frustrate the ongoing investigation.

What is the legal situation?

Of course, you can (have) the criminals dealt with either civilly or criminally. Unfortunately, experience shows that if you do not act quickly, this has little chance of success. First, because it often involves criminal gangs from (far) abroad. Second, because the money is often transferred directly to foreign accounts.

The key question is who bears the loss in that case: the supplier, the customer, both or perhaps another party such as your bank or the bank where the fraudster banks?

The main rule is that the customer - especially in Business-to-Business situations - bears the loss. After all, a money debt is a bring debt. This means that the customer must ensure that the payment actually reaches the supplier. Specifically, this means that, in principle, the customer will have to pay the invoice again.

Under circumstances, this may be unreasonable and a different outcome is possible. This may be the case, for example, if it is clear that within the supplier's organization there is a rogue employee who falsified the invoice. In the past - especially when banks did not yet perform name account number checks - attempts were made to hold banks liable as well. At first glance, there was a lot to be said for this, since invoice fraud could often have been prevented if banks had performed name and account number checks. Thereby banks (under circumstances) have a duty of care not only towards their own customers, but also towards third parties.

Nevertheless, the vast majority of claims against banks have been rejected. In a few cases - under special circumstances, where in particular the suspicious nature of transactions was recognized by the bank, but nonetheless no action was taken - claims have been allowed. Even then, deep pockets and a long breath are needed to get right.

Conclusion

Invoice fraud is a major and current problem. Prevention is better than cure. So make sure the chances of this happening to you are as low as possible. If it does happen, take immediate action and hire an attorney. Then you will have the greatest chance of recovering (some of) the amount paid.