This month’s guest post is courtesy of Theresa Payton, the Chief Advisor and CEO of Fortalice, LLC.

Have you ever had your credit card company reverse a charge on your card because it was not you?  Sounds reassuring, right?  Well, if you are a business owner, those same protections do not extend to you.  Cybercriminals know this!  Business owners are a prime target of cybercriminals.  The cybercriminals target your business using hundreds of thousands of computers in their control, often called bots, short for robots.

It is a business owner’s worst nightmare – Imagine logging into your business banking account to make your payroll and the balance is zero.  Unlike your personal card or bank account which are protected under a law known as Regulation E, many people do not realize that banks are not always held liable.

WHAT YOU SHOULD KNOW:

ASSUME YOU ARE EXPOSED:  You may not be protected-These attacks are exposing something little known in the business world.  Those protections you have when your personal card is used by a fraudster or when someone steals money out of your personal account fall under the protections of Regulation E (electronic funds transfer) and they do not transfer to business accounts.

FINANCIAL RUIN:  Devastating consequences – one firm in NY is facing bankruptcy because thieves stole more than $160K from the company by hiding behind a computer virus and their bank says they are not liable

STAGGERING STATISTICS:  The Ponemon Institute and Guardian Analytics conducted a survey with over 500 executives and owners of Small-Medium Size Businesses across the United States.  As of March, 2010, here are the stats:

• 55% of businesses reported experiencing fraud in the last 12 months, with 58% enabled by online banking activities.
• 80% of banks failed to catch fraud BEFORE dollars were transferred out of their institution.
• In 87% of fraud attacks, the bank could not fully recover 100% of the dollars taken.
• 57% of the respondents that experienced a fraud attack were NOT made whole by their banks, in essence, the business ate the expense.
• 26% were not compensated for any part of their losses.
• 24% of businesses claim that their banks do not provide a policy explaining the bank’s responsibilities to secure and protect their companies’ accounts from fraud.

4 TIPS TO P.A.D.LOCK YOUR ACCOUNTS:

• PROTECT:
  •  EMPLOYEE AWARENESS YOUR GREATEST WEAPON:  Train your employees not to click on links in emails or open attachments.
  •  RESERVE A COMPUTER FOR BANKING:  Consider reserving one computer that is only used for your online business banking access and do not allow anyone to surf the net on that computer.
  •  ANTIVIRUS:  Keep you Antivirus software up to date.
  •  Windows Users:  If you use Windows, use Internet Explorer version 8.  Turn on the Protected Mode and set your Internet Zone Security to High
  •  Mac Users:  If you use Mac, pay attention when your Mac prompts you to allow software to be installed.  Make sure your security settings are set to high.
• ACCOUNTS:
  •  SEEK PROTECTIONS: Talk to your banker to see what your protections are.
  •  DUAL CONTROLS:  Ask your bank to set up dual controls on your account so every transaction requires the approval of two people.
  •  SWEEPING:  Consider sweeping, or moving, your company balances into a consumer account to earn additional interest and protect your money.
• DETECT:
  •  LIMITS:  Establish a daily limit on transfers to/from your accounts.
  •  CONFIRMATION:  Require that all transfers be confirmed via phone call or text messages.
  •  ELECTRONIC ALERTS:  Set up alerts on your online banking system to alert you via text or email every time money is withdrawn from your account.
  •  BALANCE CHECK:  Check you bank balances every day.
• LOCK:
  •  RESTRICTIONS:  Ask for restrictions on adding new payees.
  •  CONSUMER OPTIONS:  Talk to your CPA to see if you could qualify using a consumer account for your business  and whether or not that is the right option for your company’s bank account.

What to do if you think you are a victim:

First Step-Call Your Bank:  Contact your bank immediately to see if they can reverse the transactions.

Notify Local Law Enforcement:  Contact local law enforcement to file a report

Contact the FBI:  Contract the FBI to report the internet fraud.  You can reach them via http://www.ic3.gov/default.aspx which is their Internet Complaint Center.

Creditors:  Contact all of your creditors and notify them of the issue.

Keep a log:  Keep detailed notes and records of everyone that you notify

If you want to learn more about Consumer Protections, look up Regulation E, also known as the Electronic Funds Act:  http://www.fdic.gov/regulations/laws/rules/6500-1350.html

Theresa Payton is the Chief Advisor and CEO of Fortalice LLC.  Fortalice provides security, risk and fraud consulting services to small to large companies and the government.   She also hosts a weekly segment on Charlotte’s WBTV CBS station called “Protecting Your Cyberturf” with audio and webnotes posted at WBTV.com.  For more information or to contact her, visit her company’s website at www.FortaliceLLC.com.

My assumption is that much of the money he owes has been spent or is “hidden” and will not be turned over or seized by the government. This is where many tax payers would negotiate with the Internal Revenue Service and get an agreed upon settlement on the debt. I hope they do not allow Snipes to get away with this. This was not an error, an oversight, or the result of poor tax advice. Snipes made $38 million and claimed that he owed no taxes. I don’t care who your accountant and tax advisor is – anyone would know that this was not correct. Snipes knew exactly what he was doing AND knew he was defrauding the United States. Snipes should be made to repay every penny plus interest plus any and all related penalties before he gets to keep a dime of it for himself.

Now to the travel. If he is to make money to repay the government, he must make movies. Based on Snipes’ extremely shaky ethics, I doubt many people would hire him to perform a real job. Also, I doubt he has the mental capability to make a good deal of money at anything other than acting – well, anything legal anyway. I have several questions related to the travel.

Firstly, we not have first got some sort of assurance from the governments that he is traveling to that he would not be able to take refuge there? How do we guarantee he comes back. This was the main reason that the ability to travel was up in the air to begin with.

Secondly, who is getting paid for this acting. Are the “paychecks” cut to Snipes or are they cut to some entity that he has set up that technically is not in violation of paying taxes. If the entity is paying Snipes a “salary,” of say $50K a year – the government may only garnish a small percentage of his salary (I think 10%). The rest of the millions will set in the Corporation and only current taxes will have to be paid. I hope that all this was thought out and planned by the judges who granted him the right to travel. My guess is the Snipes is O.J.’d up and will not have to pay the money he owes the United States for a long long time – if ever.

Third, why is he not in jail? How many other people are in jail for tax fraud in much smaller amounts? The man was convicted – of three counts. He received a maximum of 3 years in jail and was told he would be notified of when and where to report to begin serving his sentence. What? Don’t you start serving your sentence when you are convicted? Why is he allowed to keep traveling and making movies? Shouldn’t this crook be in a jail cell?

For my final point, I want to ask who wants to go see these movies? I am not talking about the genre of movies, but rather who actually wants to go support this criminal by continuing to provide him the lavish lifestyle he has come to live when so much of the movie going public pays so much in taxes that they can hardly afford the tickets and popcorn?

We have a huge national debt in this country, and the liberals want to soak the rich and middle class to try to get it balanced and paid. Well, Snipes is the richest of the rich, yet so many of these same liberals are supporting him for various reasons. The IRS went after Snipes with much more passive means than they do many tax payers who do not file and pay their taxes – with much less income.

The bottom line is: Snipes knew he owed taxes on the money. If he didn’t, he is the dumbest man in the country. Snipes knowingly did not file or pay his taxes. He should receive his just punishment. Period.

Note to Wesley Snipes: I hope your cell mates think you are pretty.

Most of these scams consist of e-mails or faxes requesting detailed personal information that appear to be from the IRS.

To keep it short and simple….

The IRS does not send unsolicited emails or faxes from taxpayers. If you get an email or a fax that appears to be from the IRS, it is not.

To determine what to do if you have received this type of information, follow the IRS’s guidelines here.

The FBI has had a warning against this scam on their website for a long time now. The problem is that I do not know anyone (other than a few other fraud professionals/investigators) who regularly surf out to the FBI’s website to see what scams they are notifying consumers of. We are left to other outlets to alert us to these scams. Obviously, the media isn’t doing a very good job. If these scams did not work for the perpetrators, they would not still be in existence after all these years.

I was pleased to see this morning that an Olympia, Washington woman was sentenced to two years in prison and five years of supervised release after pleading guilty to attempting to defraud U.S. citizens a Nigerian check scam. Edna Fiedler was not the Nigerian brain child of the scam. She was a U.S. citizen who replied to the email, and ultimately got sucked into it. The Nigerians would send her fake checks and money orders to cash. She would cash them and get to keep a more than fair percentage for herself, and then send the rest to the individual she was “helping” in Nigeria. When she was arrested, she had cashed $609,000 worth of phony checks and money orders. The FBI found an additional $1.1 million worth of checks and money orders that she was preparing to send out.

It looks like the FBI has at least made some headway into stopping this scam. Obvioiusly, the only thing that will stop it for good is if everyone is aware of it. Personally, I do not see why anyone would think these emails are real. Of course, we are in a money hungry society in which everyone wants a quick buck, but only a small percentage of the people are willing to put in the work to get it. Perhaps the success of this scam is more of a reflection of what many (not all) Americans have become than anything else.

Let me know your thoughts.

Denise, a $35K a year bookkeeper, for a small trucking company in Alabama is facing several years in prison for embezzling over $550,000 from the company. What did Denise do with all this money? She spent it on cosmetic surgery, new cars, luxury vacations, and jewelry. She was living the high life.

I am sure most of us remember the name Gus Gorman. He was the character played by Richard Pryor in Superman III. How did he get caught? Well, he was stupid. He showed up to work in a new Ferrari. Unfortunately, most fraudsters do not give themselves up like this and many employers may not even notice.

Denise got caught not because of the huge sums of money that she was wiring out of the company account into her own, but because she changed her annual salary from $35K to $38K. When the owner of the company noticed this small discrepancy, it was the beginning of an investigation that kept growing and growing.

Like this trucking Company, most small business lack fundamental controls to prevent and detect fraud. Denise was responsible for all of the accounting and bookkeeping functions except the physical signing of checks. Denise would periodically wire funds from the companies account to her own account. When the bank statements came, she would reconcile them, burying the wire transfers into an expense account and then destroying the evidence – the bank statements. Since the owner did not review the bank statement – he was none the wiser.

What are some steps that you can take to prevent fraud in your business?

1) Education: Educate yourself and your employees. You can do this in house or have a fraud specialist come in and provide the training for you.
2) Internal Control Review: It is critical that all businesses have the proper internal controls relative to their size. Depending upon the size of your company, you may not be able to segregate all of the duties, but you should segregate as much as possible.
3) Cash Reviews/Reconciliations: It is important that cash is reviewed and bank statements are reconciled by a party that is not involved in the other aspects of the accounting process.
4) Pre-screen Employees: Because of the perceived cost and time involved, many small businesses do not properly screen employees prior to hiring them. This could include checking work references, criminal records, credit reports, drug screening or other screening procedures.
5) Balance Trust properly. Ronald Reagan called it, “Trust, But Verify.” Mark Twain said, “Trust everybody, but make sure you cut the cards.”
6) Seek Professional Assistance. As your company grows make sure that you setup the proper controls to safeguard yourself. If you are unsure about how to do this, consult with a professional.

There are two things that must exist for an employee to be driven to commit fraud – motive and opportunity. As business owners, we must set up a proper system of internal controls to limit the opportunity as much as possible.

Motive is difficult to set controls around. According to legend, there was a loyal bookkeeper that has been with a Company a number of years. He requested a $100 per month raise and it was denied. The bookkeeper methodically stole from the Company for the next 20 years, until he retired. His replacement discovered an amazing fact. The retired bookkeeper has pilfered exactly $100 a month.

For a mere $19.95, the Excused Absence Network will issue you up to 5 sick notes from Doctors, Dentists, Emergency Rooms, Jury Duty, Funerals, or Medical Evaluations. While their website states that the notes are for “entertainment purposes only,” how many people are actually using these notes to entertain their supervisors or friends?

MSNBC reported that a New Jersey woman was arrested after supplying one of these notes in order to provide explanation for why she missed traffic court. Unfortunately, court officials called the chiropractor who was listed on the note, and surprisingly, he had never heard of the woman.

A CCH nationwide survey found an absenteeism rate of about 2.3 percent in 2007. That’s down from 2.5 percent in 2006, the highest rate since 2.7 percent in 1999.

In my opinion, this practice is pretty unethical and could be considered fraud if your Company is paying you for your day off. Company founder, John Liddell was quoted as saying, “Millions of Americans work dead-end jobs, and sometimes they just need a day off. People are going to lie anyway. ”

My response to John Liddell and those “millions” of people in dead end jobs, do something to improve your situation and get a better job. The answer is not to lie, cheat and steal. You will never get out of your current situation doing that. The answer is to work on improving yourself and your abilities and move on to a better job with greater opportunities.

The first scam involves phishing, which many of us are familiar with. The basic priciple of phishing is that the fraudster sends you an email that looks like it is from someone that you do business with, typically a bank. It ask you to login and takes you to a website that looks identical to the one you are expecting and once you login on their website, they have your username, password, and access to everything underneath. In this particular scam, identity thieves are posing as the Internal Revenue Service and are basically trying to obtain your personal information for their less than honest purposes.

Some important notes on emails from the IRS:
1) The IRS nevers offers refund through email
2) The IRS NEVER sends out unsolicited emails to taxpayers – they always use U.S. Mail to distribute unsolicited notices

Another fraud issue facing taxpayers is someone obtaining their Social Security Number and using it to file for a refund before the actual owner of that Social Security Number files for themselves. In many cases, they visit quickie tax shops where they can get a refund on the spot. Then when the true owner of the social securiy numbers files their tax return, the IRS kicks it back as a duplicate return!

You can read the entire article on the ACFE website.