3 ms·
Nearly every one of my clients have been invoice scammed. The amounts are typically five figures. When we onboard a new customer, I send a packet with payment
by trollbridge 2y ago
Nearly every one of my clients have been invoice scammed. The amounts are typically five figures.
When we onboard a new customer, I send a packet with payment information including how to direct deposit. It has this information:
- Our routing/account number. We sweep the funds out of this account nearly instantly once the deposits are made. The bank account’s purpose is to accept direct deposits and nothing else. The account number we transmit over the phone so at least it’s less likely to end up sitting in a (compromised) e-mail box.
- Our mailing address, which is a PO Box.
- Some information on invoice scams, including an offer to review any suspicious requests free of charge. A customer takes us up on this every few months… so far we have yet to see one legitimate one.
- A warning to never, ever accept changes for our payment information or mailing address unless told to do so in person by an officer of the company, with a list of the current officers.
- If in doubt, mail a check to the PO Box instead of direct deposit.
- A warning not to trust information sent via email, fax, phone calls (voice changers are a real thing), or from an employee/officer other than the one they usually interact with, and such a change must be confirmed with a phone call to a different officer.
- A recommendation to also contact our local credit union (where we deposit payments from our customers) if they feel something is suspicious.
- We have an internal rule that any change to bank accounts requires a meeting of 3 officers, in person or over the Google Meet we normally use for video calls (no phone calls) with meeting minutes conducted for the change. The change must be unanimous and the change can’t be put in for 30 days unless an emergency. Emergencies must be coordinated with a responsible person at the bank, in person. (Sorry, but this means no fintech etc. type of banks.) We recommend our customers to do the same.
The biggest liability is that it would be hard for us to change bank accounts.
We get an attempt on an invoice scam or otherwise every few weeks. So far we haven’t lost a penny of company funds due to fraud.
- throw10920 2y agoThis level of rigor should be the standard for every financial institution, and those that handle things that consumers consider valuable (such as their personal data). Or, at the very least, consumers/clients should have the ability to opt in to this kind of paranoia, without meaningless sacrifices of convenience. Those of us in the US can't.
- Henchman21 2y agoInstead we get banks that refuse to even police their own systems. We get bank fraud relabeled as “identity theft”. On the one hand I didn’t vote for Trump, don’t want any of what he’s doing to happen. At all. But on the other hand I’d be happy to light the match that sets alight the house of cards thats been built. Everything about life in the US seems like its built on a foundation of lies. In my frustration, I may have digressed a bit :)
- 01HNNWZ0MV43FF 2y ago[flagged]
- macintux 2y agoAny jackass can kick a barn down but it takes a carpenter to build one. -LBJ (I’ve seen a few variations on the wording.)
- bsder 2y agoDifferent Texan--Sam Rayburn.
- macintux 2y agoInteresting, thanks. I see it attributed to both, but the numbers favor Rayburn. Possibly LBJ quoted him on it at some point.
- bsder 2y agoFrom where are you getting LBJ quoting? Even a cursory Google only coughs up Sam Rayburn. I actually have to look for LBJ using it in "Remarks at an Airport Rally in Wilmington, Delaware". Wikiquote seems to have the validated references. While Rayburn may be the first to use this quote in a recorded way, I can certainly believe that it is much older than Rayburn.
- h4ck_th3_pl4n3t 2y agoUnironically best opsec I've read about in a while. In times of Deepfakes, people really underestimate the level of fakes they can receive. I've seen companies getting scammed with spoofed phone calls where they didn't have a policy to call back to prevent numbers being spoofed etc. Most of the private data is available online, so you always have to assume that e.g. a workflow via email or phone can be malicious by default. In an alternate reality M$ Outlook would be a product for the receivers of email, and not a business product for spammers.