Download - Stop Payment Fraud flyer
Phishing attacks on state and local governments continue to rise, with some sources indicating a doubling or more for each of the last several quarters. Business email compromise (BEC) scams, a form of phishing that tricks staff into diverting funds, play a major role and have caused hundreds of millions of dollars in losses. These scams often “spoof” trusted contacts to request "urgent" ACH changes and payments, vanishing taxpayer dollars into bad actors’ accounts. They succeed by preying on trust and haste, not just tech flaws.
Safeguard your municipality with these essential procedures:
- Tag external emails with a clear "EXTERNAL" warning and train staff to pause on red flags like "immediate" or "updated payment details."
- Scrutinize domain names from senders requesting funds; jimselectricalservice.com looks like jimselectricaIservice.com (note the capital I instead of the lowercase l) or jimselectricalservice.co.
- Don’t act on email-only requests for ACH or banking updates. Verify by calling the sender using a pre-saved contact number; do not use the number(s) provided in the message.
- Match payment requests to legitimate, verified invoices. For any new or changed accounts, send a small test transaction and wait for confirmation, or call to verify.
- Require dual approval for any change in ACH information.
Following these procedures will greatly reduce the chance of any error, however, if you discover that a payment has been made in error, contact law enforcement and your bank immediately. Time is of the essence when it comes to reversing fund transfers.
