UB Insider #55: Defending Against Fraud

About this episode:

Last year, 30 percent of fraud cases were against small businesses, and 60 percent of those businesses didn’t recover any of their losses. In this episode of UB Insider, Crystal Low, director of corporate services for Zions Bank, tells why the problem can be so pervasive and damaging to small businesses, and some basic steps business owners can take to defend against fraud. Subscribe to our podcast or download this episode on Apple Podcasts, Stitcher or Google Play.


Lisa Christensen: Hello and welcome to UB Insider. I’m Lisa Christensen, online editor at Utah Business magazine. Last year, 30% of fraud cases occurred in small businesses and 60% of those victims didn’t recover any of their losses. To talk about why small businesses are especially vulnerable to fraud and how they can protect themselves, we have with us Crystal Low, Director of Corporate Services for Zions Bank. Welcome.

Crystal Low: Thanks. It’s great to be here.

Lisa Christensen: So why do so few people recover their losses after fraud? I mean, 60% don’t recover anything!

Crystal Low: Yeah, I think there’s many reasons. But maybe two of the biggest is many times this is electronic fraud. So when money leaves your bank account, it’s gone. It’s very hard to recover those electronic wires or ACH transactions that are sent out. And so there are opportunities, but they’re very few and it’s all about timing and getting that money back.

And in the paper space, so when you’re thinking about checks or a person who is embezzling money, typically that embezzlement happens over time. So that money is spent, it’s gone. You can get judgments and go to court for that fraudster who committed the crime to pay you back, but the likelihood of them then being able to do that is very low. So when the money is gone, it’s typically gone.

Lisa Christensen: So why are small businesses typically more vulnerable to fraud than large businesses?

Crystal Low: I think in most cases it’s because small businesses think they’re immune. They think that the fraudsters are going after the large corporations which, you’ve stated the stats, 30% of the fraud happens to small business. And it’s not just that they’re immune, and they think that they’re immune, but it also has to do with resources.

So in a larger company you typically have more people that can implement the controls that you need to have in place to protect your business from fraud. In a small business that’s hard to do. You might have one or two people or a handful of people doing all the work. So to say, take some time out of your regular work to implement these controls, which in many cases do take time, is very hard for a small business to do.

Lisa Christensen: You’ve said that fraud is not a technology issue, but that it’s a people issue. What do you mean by that?

Crystal Low: Well in the technology space, there’s many controls, technical controls so–to-speak in place to protect bank accounts. We can monitor activity types in the credit card space. We can monitor the types of transactions and we watch for red flags or changes in trends. So the technology can do that. Typically it’s a human element that interrupts those technical controls that puts us at exposure to fraud.

I think business email comprises a type of fraud that we’re seeing a lot right now. And just to give you an example, what will happen is in a company, let’s say you have a CFO. And the CFO manages the finances. That CFO gets an email from what seems to be the CEO, their boss that says please wire this amount of money to this company, and it needs to be done immediately. And by the way, this isn’t public knowledge but this is based on a transaction that is not public, so don’t say anything. And then we’ll make the announcement after it’s final and contracts are signed. CFO gets that and says, “Wow, I’m kind of in the know on something and my boss is asking me to do it.” We typically don’t challenge our boss, right? So they go, they transact the wire, money sent, money is gone. And what happens is that CEO never sent the email. The fraudster hacked the email from various sources, sent the email and once that wire’s gone it’s really hard to recover.

Lisa Christensen: So fraud has obviously happened as long as there’s been business, but I wonder if you could talk to me a little bit about how it has gotten more sophisticated.

Crystal Low: I think it’s more sophisticated in… It always evolves because the fraudsters are smart. Right? I mean, it’s kind of the joke. If these people were just sort of legitimate businesses, the world would be a much better place because they are very smart. So if you think back to the check days, the fraudsters found all kinds of ways to counterfeit checks and wash checks. And what’s happened is now we’re kind of moving from the check space and now we’re in the technology of automating transfers and electronic money movement. And with electronic money movement, the internet, email, it just puts us all vulnerable to the fraudsters.

Lisa Christensen: But that people issue has been around since the dawn of time.

Crystal Low: Yeah. There’s always a human element in everything that we do, right? And so I think it’s a matter of, you know, in the business email compromise it seems so logical to just get an email from their boss and do what they ask. And to tell our people to challenge and ask questions why is kind of new, I think, in many businesses. Especially in a small business. I mean, a couple of people running the company and the CEO sends you an email? You just do it. You don’t even think about it. So I think really we need to aware, educate and communicate.

Lisa Christensen: So what are, in a small business, when you are lacking for resources perhaps or people to set in place these controls, what are some basic steps that small businesses can do to protect themselves?

Crystal Low: I think first and foremost in the banking space, your banker is your partner and they have lots of tips and tricks and products and services that can help you. A lot of times, we have a product, Positive Pay. It allows a business to control anything that comes out of their account whether that be an electronic payment in the ACH space or a check. And what we typically get, we go out and we educate our customers and they typically say uh, I don’t want to do that because it might cost a little money. And it takes time and it takes a little effort to use it.

So they say no. Fraud, we’re never experienced fraud. We’re never going to experience fraud, so we’re good. We’re good without it but thanks for bringing it up. And then what happens is six months down the road they do experience fraud and then we reactively have to go in and implement something like that. So I would challenge every small business, every business out there, any business out there that has a checking account should have a product like Positive Pay. And all banks offer them, the service, I should say. Don’t be afraid of a little cost up front and don’t be afraid of a little bit of work because it will save you time in the long run. And so that’s just one example of a service that can help a small business or a large business.

Lisa Christensen: You mentioned awareness. What are some kind of people tricks that small businesses can implement as well?

Crystal Low: Education. And there’s a lot of free education out there. I know at our bank we host lunch and learn seminars where you can come in for an hour and a half, have lunch on us and we will give you information on the types of fraud that’s out there and how to protect your business. Some controls you can implement that aren’t necessarily services that we offer, but just having separation of duties. The person that’s issuing or creating the payroll shouldn’t be the person that’s sending it out or signing a check or approving an electronic transfer. They’re little things that we take for granted. Look in your community at the different resources out there. Maybe it’s through your CPA or insurance partner, but there’s a lot of opportunity to educate yourself but really you need to pass that education on to your employees.

Lisa Christensen: Is there anything that businesses can do should the worst happen, should they be defrauded, that they can do after discovering the fraud to either protect themselves from further losses or to increase their chances of recovering some of those losses.

Crystal Low: It’s time. You need to notify your bank immediately when fraud does occur. And there are times where we can recover a wire or an ACH or get money that was cashed on a check. There are times that we can recover those funds. But you cannot rely on that. It doesn’t happen all the time. So the quicker you can notify whoever’s involved, the better. And from there, like I said before with the Positive Pay scenario, there are lots of things that we can reactively implement and look at your processes with you, analyzing everything that you’re doing to ensure that you’re protected as best you can be.

Lisa Christensen: Is there anything that you find people have a common misconception about, in general, when it comes to fraud?

Crystal Low: Everybody thinks that it won’t happen to them. That is the number one common thing that we see. All businesses are made up of a bunch of consumers, right? We’re all just people and it comes back to that human element.

I think it’s just like insurance. It’s hard to pay for insurance sometimes because you’re only going to use it if something bad happens. Well you need to be thinking about implementing those types of insurance controls into your business practice so that in case something does happen, you’re protected. Because if you don’t, you’re going to pay big and it’s going to take a lot to recover. If in a small business scenario, many of those businesses cannot recover. Because if you think about a small business and maybe somebody takes $10,000 – can you make payroll? Can you keep the lights on? And in many cases you can’t. So I think it’s really about being proactive.

Lisa Christensen: Okay, well thank you so much for coming in today.

Crystal Low: Thanks, it’s my pleasure.

Lisa Christensen: Thanks also to Mike Sasich for production help. You can subscribe to our podcast on Stitcher, Apple Podcasts, or wherever you get your podcasts or on our website at You can also reach out to us at or on social media at @utahbusiness. Thanks for listening.