Managing fraud risks in times of crisis

With modern crises causing economic hardship and significant organisational change, it’s no surprise that businesses are at a heightened risk of becoming victim to opportunistic fraudsters. 

After the 2008 Global Financial Crisis, the Association of Certified Fraud Examiners (ACFE) found that the majority of respondents experienced an observable increase in the number of frauds, and 80% said they believe fraud increases during times of economic distress.  Results from the 2020 ACFE Report to the Nation show CFEs estimate organisations lose 5% of revenue to fraud each year, which equates to more than $4.5 trillion of losses globally.

As stock markets experience turbulent times and business confidence plunges, many of the factors that existed in previous downturns are present today. Furthermore, a recent survey found that organisations are estimated to lose 5% of revenue to employee fraud each year, a costly consequence that most businesses can’t afford to lose in our current climate.  

So, while businesses are rightly focussing on the safety and wellbeing of staff, the heightened fraud risk during these unprecedented times should also be given attention.  

The uncertainty caused by the public health crisis has created a perfect storm for fraud to occur. The well-known Fraud Triangle explains that for fraud to exist there are three principal drivers – pressure, opportunity and rationalisation.

What motivates someone to commit fraud varies in times of economic crisis. Financial pressure and reduced job security tend to rise and departing employees may be tempted to copy sensitive data like customer lists and intellectual property. Personal addictions, such as gambling and alcoholism, are also aggravated in times of stress which adds to the pressure.

Businesses are currently focused on adopting cost-cutting measures to manage the impacts of the crisis. This means less investment in compliance and fighting fraud, and leaves little or no time to monitor key risks. This can lead to weakened defences in business processes, creating greater opportunities for individuals to exploit.

The uncertainty also creates an easier environment for individuals to rationalise their actions. For example, they may tell themselves “I will pay the money back once I’m more financially secure” or “I better pay myself first in case the company folds.”

Scam watchdogs across the world have warned against an increase in the number of fraudulent scams and phishing attempts. Victims are typically targeted via phone, email and social media – a greater risk now that more of us are working from home and accessing company data remotely.

One business recently fell victim to a scammer who crafted a convincing email and fake website that appeared to be from their payroll provider. The email requested the recipient log in with their credentials using the link provided, in order for the provider to process their payroll correctly from home. This not only compromised staff log in credentials to gain access to the real payroll system, but also put employees’ sensitive information at risk exposure.

Governments have introduced various support schemes to assist businesses that are impacted by crises as they happen. While this is a welcome relief to many businesses, it leaves open the opportunity for these schemes to be exploited. In New Zealand, reports of employers breaching their obligations to pass on wage subsidies in full to employees has resulted in the government warning that employers pocketing the subsidy may face criminal prosecution.  

Scammers could also target an organisation’s payroll if they know that they are going to receive government funds. This is made even more possible where in some countries, there is a public register of organisations receiving a wage subsidy. 

• Consider whether the changes in company resources increases the risk of theft of company assets.

• Reinforcing channels for staff to report suspicious behaviour or concerns has never been more important. Consider also reminding staff of integrity standards.

• Follow up on suspicions of reported fraud. Although businesses are increasingly focused on dealing with the crisis at hand, this leaves open the opportunity for individuals to exploit this lack of oversight. 

• Carry out a risk assessment of any IT risks (e.g. updating anti-malware and anti-virus software) and the potential for sensitive data to be compromised.

• Continue communicating with employees. Poor employee engagement is one of the key drivers for employee fraud, so it’s important to make sure they have a forum to be heard. 

• Be vigilant with email communication. Don’t click on links or open attachments from unknown or unverified senders. Check email addresses carefully for irregularities as often the email address has just a letter missing, making hard to tell it’s a spoof.

• Systems that contain sensitive information such as payroll should have multi-factor authentication features, which requires an extra step to log in. Enforcing long and complex passwords can also help prevent an attacker from guessing them.

There is no doubt that businesses are continually navigating periods of uncertainty. Assessing your vulnerability to fraud risk, with limited resources to manage them, might not be top of the mind right now.

However, even implementing a few simple process improvements and remaining vigilant to threats will help to ensure your business doesn’t also have to deal with the financial and reputational damage of falling victim to fraud.

Disclaimer: The content of this article is general in nature and not intended as a substitute for specific professional advice on any matter and should not be relied upon for that purpose.