Fraudsters target salaries

With public contact details that are easy to find on social media, the fraudster sends an email on behalf of an employee containing a 'changed' account number to the payroll administrator. Without the right checks and balances, it can just happen that the next salary payment falls into the wrong hands. Farfetched? Yet it is becoming more and more common.

Marcel de Dood, Services Manager of HR & Payroll Solutions at Centric Netherlands was told this by several customers this month. “After I shared a message about this on LinkedIn, several payroll administrators responded with similar incidents, also from longer ago. So, it is a tried and tested method. Given the amount of recent reports, this type of fraud now seems to be gaining in popularity.”

Prevention: awareness & authentication

What can you as an employer do about this? “Awareness programs enable employees to recognize salary fraud,” explains De Dood. “But even then, you still have to pay attention: Bol.com recently showed that even trained salary professionals can get fooled in an unguarded moment. It is better to use an HRM system in which employees make personnel changes themselves and then exclusively via multi-factor authentication, as an extra layer of security.”

Organizations that do not yet have the latest technology can also take preventive action. De Dood: “For example, with clear procedures, such as the rule that employees must always be personally called in the event of a changed account number to verify the account number.”

‘Thanks to vigilance, we have prevented wrong payments’

Salary administrator Ron Heij of Strukton Civiel also saw fraud attempts within his organization: “In recent months we have received several fraudulent emails requesting to change an account number. Thanks to the attentiveness of our employees, we have been able to prevent incorrect payments.”

Even if an incorrect account number is entered with an employee, this does not automatically lead to an incorrect payment. Many banks first carry out an IBAN Name Check, a check whether name and account number match.

The IBAN Name Check: do name and account number match?

Dorine van Basten Commercial Director of SurePay, the inventor and executor of the IBAN-Name Check that carries out this check for various banks, sees criminals adjusting their tactics accordingly: “What you now see is that fraudsters provide an account number of a smaller bank that is not connected to the IBAN Name Check. A payment to such an account cannot then be verified. Most banks notify payers if verification is not possible. It is up to the payer whether he proceeds with the payment or conducts further investigation first.”

Organizations that like to be sure of verified payments can also have the check carried out themselves, via the SurePay IBAN Name Check for Businesses. Dorine: “As a company you supply files with IBANs and names, which SurePay then checks. By linking address systems to the SurePay API, newly entered contacts or changed bank account numbers can be checked in real time.” Various banks, municipalities and other organizations already use this in-house IBAN Name Check.

Tips to prevent fraud

• Check the sender's email address
• Verify by phone whether the employee indeed wants to pass on a new account number
• Offer employees HR self-service, so that changing an account number can only be done with the correct authentication
• Implement the IBAN Name Check for Organizations
• Finally: always report fraud attempts!