Cybercriminals are increasingly targeting businesses by impersonating banks and financial institutions. These fraudsters use a tactic called phone spoofing, which allows them to make a phone call appear to come from a legitimate bank phone number.

Their goal is to create a sense of urgency, gain your trust, and convince you to reveal sensitive information that can be used to access your online banking accounts and initiate fraudulent ACH transactions.

Understanding how this scam works can help protect your business from financial loss.

How the Scam Works

1. A phone call appears to come from your bank.

The scammer uses phone spoofing technology to make the caller ID display what appears to be your bank’s legitimate phone number. Because the number looks familiar, the call may seem trustworthy.

2. The caller claims there is a problem with your account.

The fraudster may say they have detected suspicious ACH activity, unusual login attempts, or potential fraud involving your business account. Their goal is to create concern and pressure you into acting quickly.

3. They request sensitive information.

The caller may ask for your online banking username, password, one-time passcode, token code, or other authentication information. In some cases, they may direct you to a website that looks like your bank’s online banking login page.

4. Your credentials are compromised.

If the requested information is provided, the scammer can use it to access your online banking account and initiate unauthorized ACH transfers or other fraudulent transactions.

5. Funds are transferred from your account.

Once access is obtained, fraudsters often move quickly to originate ACH transactions or transfer funds to accounts they control.

How to Protect Your Business

Never share online banking credentials.

Your username, password, secure access code, token code, or multifactor authentication information should never be shared with anyone. No legitimate bank employee will ask for this information.

Be cautious of unexpected calls.

Even if the caller ID displays your bank’s phone number, do not assume the call is legitimate. Scammers can manipulate the caller ID.

Hang up and verify independently.

If you receive a call about suspicious account activity, end the conversation and contact your bank directly using the phone number listed on its official website, your account statement, or a trusted contact you already know.

Do not click links provided by callers.

Fraudsters may send links through text messages or email that lead to fake login pages designed to steal your credentials. Always access online banking by typing your bank’s web address directly into your browser or using the bank’s official mobile app.

Train employees who have ACH access.

Employees responsible for online banking, ACH origination, payroll, or accounts payable should understand the risks of phone spoofing and recognize social engineering tactics.

Review account activity regularly.

Monitor your accounts and ACH activity frequently. Prompt detection can help limit losses if fraudulent activity occurs.

What to Do If You Suspect Fraud

If you believe you may have shared sensitive information with a scammer or notice suspicious activity on your account:

• Contact your bank immediately.
• Change your online banking password.
• Notify any employees who have account access.
• Review recent ACH activity and account transactions.
• Follow your bank’s recommendations to secure your accounts.

Stay Vigilant

Phone spoofing scams are becoming more sophisticated, and businesses remain a prime target because of the larger transaction amounts often associated with ACH activity.

Remember: Caller ID alone is not proof that a call is legitimate. When in doubt, hang up and contact your bank directly using a trusted phone number.

Awareness and employee education remain some of the most effective tools for protecting your business from fraud.

If you receive a suspicious call, contact us immediately at 218-751-2430.

Positive Pay is a fraud-prevention service designed to help protect your business against unauthorized ACH or check transactions and altered checks. Please talk with us today about protecting your business with Positive Pay. Learn more about Positive Pay.