{"id":592,"date":"2015-08-31T18:43:28","date_gmt":"2015-08-31T23:43:28","guid":{"rendered":"https:\/\/taxprocenter.proconnect.intuit.com\/?p=592"},"modified":"2019-03-05T16:28:50","modified_gmt":"2019-03-05T22:28:50","slug":"how-to-help-your-clients-combat-ach-fraud","status":"publish","type":"post","link":"https:\/\/accountants.intuit.com\/taxprocenter\/client-relationships\/how-to-help-your-clients-combat-ach-fraud\/","title":{"rendered":"How to Help Your Clients Combat ACH Fraud"},"content":{"rendered":"

The Automated Clearing House (ACH) Network is an electronic funds transfer process between bank accounts. ACH is most commonly used for direct deposit of payroll and Social Security payments, although an increasing number of companies make accounts payable and tax payments via ACH. Electronic transactions are governed by the National Automated Clearing House Association (NACHA).<\/p>\n

How Does ACH Fraud Take Place?<\/b> All that is needed to commit ACH fraud is the account number and the bank routing number taken directly from an unsuspecting victim\u2019s check. The most common form of ACH fraud occurs when a cyber thief using banking custom\u00aders\u2019 account data initiates payments over the phone for products or to pay off credit card debt. Another often-used ACH fraud scheme is to gain access to the banking system by posing as a retailer to establish a relationship with a credit card processor or a financial institution.<\/p>\n

Banks set up retail merchant accounts that include the hardware and software to process credit cards and convert paper checks into electronic ACH debits. Be\u00adcause paperless transactions pose substantial financial risk, most banks are careful to thoroughly screen any company that wants to send ACH debits. However, fraudsters still occasionally get through the screening process and victimize others. Banks have liability for al\u00adlowing these network lapses.<\/p>\n

Once cyber thieves are able to establish a credit card or check conversion account, they create bogus checks using inexpensive check writing software and run the phony checks through an automated check-to-ACH converter. The company submits the ACH debits to its bank, the bank sends the file through the Federal Reserve System, and the ACH debits post against the designated accounts. Forgers have learned that most Positive Pay systems do not monitor ACH debits.<\/p>\n

While a consumer has 60 days to return an unauthor\u00adized ACH debit, commercial organizations have only two days. For this reason, commercial organizations must change their internal procedures to make it easier to rec\u00adoncile ACH debits on a very timely basis.<\/p>\n

Keystroke Logger Virus and ACH Fraud.<\/b> Recently, a Midwestern company\u2019s computer system became infected with a virus that tracked keystrokes. The hacker was able to decipher the log-on keystrokes to the company\u2019s bank, logged on and sent $160,000 in ACH credits to various bank accounts the thief controlled. The money was sent overseas the following day. The company was shocked when its bank denied liability for the loss because the log-on was authentic. A bank is not responsible for the integrity of a customer\u2019s computer.<\/p>\n

How to Avoid ACH Fraud<\/b><\/p>\n

Shielding commercial and retail accounts from unauthorized ACH charges is a simple three-step process:<\/p>\n

    \n
  1. Ask your bank to place ACH debit blocks on accounts that should not have ACH withdrawals.\u00a0<\/b>For example, a trust account or refund account should not have with\u00addrawals via ACH. Such accounts should have ACH blocks. An ACH block rejects all ACH debits.<\/span><\/li>\n
  2. Bank accounts should be structured so that authorized ACH debits occur in only a few designated accounts.<\/b> Ask your bank to place an ACH filter on those accounts. An ACH filter allows debits only from companies that have been preauthorized, or in preauthorized dollar amounts. If your bank does not offer an ACH filter, open up a new account exclu\u00adsively for authorized ACH debits, and restrict who has knowledge of that account number.<\/span><\/li>\n
  3. Monitor all unblocked accounts daily to catch unau\u00adthorized activity.<\/b> Companies have two business days to reject an unauthorized debit and recover their money. If an unauthorized debit is not questioned for more than two days, it will be much more difficult to recover lost funds. Because all fraudulent ACH transactions originate in real bank accounts, unwinding them is quite straightforward if caught in a timely fashion.<\/span><\/li>\n<\/ol>\n

    External Threats.<\/b> Guard against hackers by using a fire\u00adwall device, anti-spyware and anti-virus software. When evaluating products, read the technical reviews in PC Magazine<\/i><\/a> and CNETNetworks<\/i><\/a>. It is important to reference both periodicals because they often critique differently.<\/p>\n

    Small companies might consider the Cisco Pix 501, with a retail price of approximately $250, or Barra\u00adcuda firewalls, and Webroot.com<\/a> anti-spyware for home or office. For virus protection, Norton and McAfee are highly rated programs, but tend to be resource hogs and can slow down an older computer. A viable alternative is Kaspersky, which is highly rated but is not a resource hog. Anti-spyware and anti-virus software definitions should be updated for new threats on a weekly basis.<\/p>\n

    Internal Threats.<\/b> According to the Association of Certified Fraud Examiners, more than 85 percent of intellectual property theft is committed by insiders. For this reason, it is important that you know your employees. Moreover, it is important to complete background checks on information technology, finance, mailroom and temporary employees, as well as the cleaning crew. Facebook.com<\/a>, MySpace.com<\/a>, Zabasearch.com<\/span><\/a>, and <\/span>Zoominfo.com<\/a> are great online resources for background information about potential employees. Other internal fraud prevention ideas include the following:<\/p>\n