Question

Prompt:

A popular method for defrauding a company is to issue a phony invoice. The scam begins by initially contacting the target firm to discover details of key business contacts, business operations, and products. The swindler then uses this information to create a fictitious invoice. The invoice will include names, figures, and other details to give it the appearance of legitimacy. Scott County Schools was a victim of the above scam in 2017.

Scott County Schools in Kentucky announced that it was the victim of a major attack that resulted in a loss of $3.7 million. This was a typical invoice scam where the school was notified that an invoice was outstanding, the school duly paid the fake invoice. Once the fact this was a wire fraud incident, the FBI was contacted, and attempts were made to recover the funds. Initially, it was it is unclear whether it will be possible to recover the money. Just today it was confirmed that the school district in Kentucky recovered the $3.7 million stolen by the hacker in this cyber wire fraud scam.

1. How can scams like this be avoided and what policies should be implemented by companies to detect phony invoices sooner?

Answer 1

Phony or Fake invoices can cause a business a great deal of harm as even indicated in the given case study. In order to check how it can be avoided, the intention of creating fake invoices should be checked so that appropriate action can be taken accordingly:

• Claim of excess expenditure for the purpose of tax saving
• Excess claim of expense reimbursement when the claimant is aware about the budgets
• Fake invoice to increase the turnover so that better financial data can be reflected to stakeholders
• Laundering of money

To avoid such practises, companies should make stringent policies such as:

• Invoice checking hierarchy: Invoices should always be checked at multi-level by different people. Specially the person submitting the invoice shouldn’t in any influence the invoice processing mechanism either directly or indirectly. If the invoice checked at multiple level, there are high chances, fake invoice may generate query which might lead too finding out the legitimacy of invoice
• Employ 3-Way Matching: If you can match each invoice to a purchase order and receipt of goods, then you’re much less likely to pay a fraudulent invoice. Most fraudsters won’t bother fabricating three separate documents.
• Watch Invoice Amounts and threshold limits: Amounts on invoices can provide clues that the invoice isn’t on the up-and-up. If your company requires additional review for invoices over $1,000 (for example), checks squeaking by right under that threshold (such as $990 or say $980) should raise suspicion.
• Keep Up Moral: Invoice fraud can come from inside the company or from an outside source. Happy employees are unlikely to commit fraud and more likely to catch fraud from outside sources. If they don’t have reason to complain, then they’re more likely to care about doing right by the company.
• Check On Vendors: Fraudulent invoices are typically issued under fake business names or use a legitimate name but a fake address or bank account number. You’ll want to look up any new vendors to make sure they’re legitimate and find the address on Google maps. If the address is residential or a post-office box, that’s a big red-flag. Also, check-in with your existing vendors directly if their account information changes.
• Track Invoice Activity: If you’re tracking invoice activity, you’ll be able to notice when something changes. For example, one vendor typically submits 5 to 10 invoices a month and suddenly you see 50 from them in a single month. It might be legitimate, but you’ll still want to get in touch with them and double-check.
• Implement “Fuzzy Matching”: Duplicate payments are one way to commit invoice fraud – fraudsters submit a near-perfect copy of a legitimate invoice and hope no one notices one payment is going to a different account number. Sometimes they’ll also change date, invoice number, or amount. You’ll need a program that allows for “fuzzy matching” to catch near-duplicates as well as identical invoices.

Please note there could be many more ways to tackle the issue varying due to business to business. Thus, the above points are generic and thus could be applied with modification or by combination of above points to come to a solution.