Don’t get caught: Fraud is everyone’s business

One out of every five small businesses has been victimized by fraud. Was it yours? We are very concerned about the rising costs of fraud on small businesses. In fact, members impacted by fraud tell us they lost on average $6,200 to scammers last year.

Through our research and conversations with members, we have determined there are five major types of fraud committed against small business.

Credit card fraud: Millions ofdollars lost annually

Credit card fraud is one of the most common types of fraud that you can face. According to the Canadian Bankers Association, there are over 68.5 million credit cards in circulation in Canada. Although less than 1% of cards are compromised, that still represents hundreds of millions of dollars lost.

Card present: stolen or counterfeit

Card present fraud is when the credit card is physically present during the transaction. According to Stats Canada, most retail fraud is done in person. Unlike shoplifters, who often will avoid eye contact and make a quick exit, fraudsters can be:

• Brazen
• Confident
• Friendly
• New to your store
• Making larger than normal orders
• Buying items in multiples
• Avoid using the Chip-and-PIN system

The importance of the Chip-and-PIN:

When a cardholder makes an in-store purchase at a chip-activated terminal, the chip card generates a unique one-time code that’s needed for the transaction to be approved — a feature that is virtually impossible to replicate in a counterfeit card. Canadian chip cards used at your place of business that are not processed using a chip device will shift the fraud liability to you.

If you suspect someone trying to commit fraud during a transaction, you can call your payment authorization centre and ask for a “Code 10” and they can coach you from there.

Card not present: Fraud on the rise

Card not present fraud simply means the credit card is not physically present during the transaction this includes transaction is done over the phone or online. According to the RCMP, this is one of the fastest growing types of fraud in Canada.

How does it work?

There are many variations, but two look like this:

A fraudster will call wanting to make a purchase with a credit card. This could be the actual card holder who is intending to defraud your business, or it could be a stolen credit card. The script may sound like this:

“My son is going to school in your town and I want to purchase him a computer on my credit card. Can I pay for that and have him come and pick it up?” The authorization will be approved on the credit card when the merchant calls it in. Naturally, the merchant will believe all is well and allow the merchandise to be picked up. Later the transaction will be reported as fraud.

OR

A fraudster will call and ask for products to being shipped or delivered elsewhere – this often happens with building supplies dropped off at “job sites.”

The transaction will be approved when called in, the supplies will be delivered to the job site – which is likely to be unmanned. The fraudsters swoop in, steal the materials and disappear.

Typically the next day or so, the merchant will be advised from their processor that the transaction is fraudulent

Unfortunately, because Chip-and-PIN is not used during card not present transactions, there is next to no recourse to help you to recoup the loss of income or product.

According to Statistics Canada, only 15% of businesses with fewer than 20 employees report credit card fraud but fraudsters will often hit multiple businesses in a small local area in a short period of time. That is why you need to report all fraud.

To report a fraud: gather as much information as you can and contact the Canadian Anti-Fraud Centre, the RCMP or your local police department.

Tips to protect your business from credit card fraud

• Know your rights and responsibilities when accepting credit cards
• Create awareness. Train your staff to recognize fraud with the help of our free poster (see related documents on the right).
• Adopt a policy that credit cards transactions will NOT be taken over the phone.
• Look into e-commerce solutions that provide proper security for online transactions.
• Require customers picking up product to provide ID or the credit card that was used to authorize the transaction.
• Refuse to take credit card payments where the chip and PIN can’t be used.

Always ensure your POS systems are chip-enabled. You can do so by contacting your Acquirer/Payment Process.

Sometimes a merchant can do everything correct on their end, and still end up holding an empty bag. Such is the case of Friendly Fraud.

Directory fraud, false invoicing and office supply scams

According to the Competition Bureau’s Little Black Book of Scams, directory fraud, also known as unsolicited advertising, is one of the most common types of fraud committed against small businesses.

Our Counsellors hear from many members who have received an invoice for advertisements in a locally distributed directory. Sometimes these invoices are actually solicitations for listings in business directories, but sometimes they provide you with nothing but a demand for payment.

A directory scam can appear to be as innocent as an invitation to update your information for records. It might feature names you are familiar with, such as Yellow Pages or Google, or they might even have recognizable logos, such as the walking fingers.

Members caught in this scheme have received bills for thousands of dollars and harassing phone calls threatening court and collections.

Another scam that plagues small businesses occurs when companies send boxes of office supplies that were never ordered with a big price tag attached. These boxes might contain toner, receipt paper – you name it. Often, small print on the invoice will claim that the opening of the box constitutes consent to buy and you may be stuck with supplies you never ordered.

How to spot the fraud:

• Carefully inspect the name of companies on invoices: they might seem familiar but often will have a slight variation.
• Check for addresses that don’t make sense, like international listings.
• Check for invoice references or numbers. If it doesn’t have one, it could be a scam.
• Do not call the number on the invoice you have received; instead, do a separate search for the actual company’s phone number before contacting them.
• Ensure there are no demands for payment in the fine print.
• Be vigilant in training staff to be aware of these types of scams.
• Don’t give out information about your business unless you know how it will be used.
• Never agree to anything over the phone – always get it in writing.
• Do not open parcels you aren’t expecting or from companies you don’t recognize.

If someone is trying to collect on an invoice you suspect is fraudulent, request a copy of the contract or agreement the company is referencing. If they cannot produce a contract with your written signature on it, their claims are invalid. Sometimes companies will forge the signature of employees or former employees, many of which do not even have signing authority for the business. No signature; no contract; nothing owed.

Inside job: occupational fraud

Internal fraud is also known as occupational fraud, workplace fraud, and employee fraud can encompass a range of activities from outright theft, falsifying accounts, to even abusing flexible working hours. Internal fraud can lead to financial losses, damage to a business’ reputation, and create legal implications, not to mention the impact it can have on morale in the workplace.

HR Fraud

• An employee is on sick leave but working elsewhere
• Abusing a flexible working hours arrangement
• Misuse of official time (computer usage)
• Providing false reference or qualifications

Payment/Receipt Fraud

• Creating fake customer records/accounts to generate false payments
• Changing payee details on cheques and trying to cash them
• Processing false claims on behalf of accomplices
• Self-authorizing payments to oneself

Allowance Fraud

• Expense claims for trips not taken
• Expense claims for amounts higher than actually spent
• Forging signatures
• Making unauthorized changes to timesheets

Three ways to protect your business

• Use pre-employment checks: Set yourself off on the right foot from the beginning. Upon hire, criminal background checks are not always necessary, but make sure to always verify references. You may also wish to see certificates/diplomas of courses completed to verify that the potential employee has the qualifications they claim to have.
• Monitor your employees’ performance: Use communication to be aware of workload, stress levels and goal reaching. Set internal management policies that help employees understand their expectations and that you have an awareness of daily ins and outs of the business.
• Identify the most valuable assets of your company and think how to protect them: This could be sales information, internal processes and procedures, intellectual property, proprietary software, customer information, etc. A privacy policy can help prevent information leaks and a non-competition clause in an employment contract can protect your business if an employee moves on.

Fraud is not always intentional – a lack of awareness amongst employees of things like information security and privacy regulations can allow others to commit fraud against your business and your customers.

Health and safety fraud

One of the most important aspects of a thriving small business is to ensure that Occupational Health and Safety (OHS) requirements are being followed. OHS regulations have several layers, vary from province to province, and occasionally change with little notice. It is no wonder that Occupational Health and Safety is the subject of common scams aimed at small businesses.

We hear from members about two main types of scams involving health and safety.

First-Aid kits

We know you care about your business and the well-being of your employees and customers. Not surprisingly, when a call comes in insisting you must purchase an expensive “government-approved” first-aid kit with automatic refills that can be billed directly to your credit card, it might seem like a prudent thing to do; however, these costly kits are often over and above what is actually required by provincial regulations.

Did you know?

• Provincial requirements for first-aid kits vary depending on the number of employees you have.
• Kits can be purchased at various retailers as well as first-aid supply companies.
• Sometimes the kits suggested for purchase are based on requirements from other provinces.
• Our Counsellors will help you ensure you have the proper kit for your business needs.

Health and Safety training

Our Counsellors get daily calls from members to advise us that they have been solicited to purchase training in occupational health and safety. These courses might be for Workplace Hazardous Materials Information Systems (WHMIS, workplace violence and harassment training, or to provide the business with updates on “new” or “changed” regulations.

Why it’s a problem:

• The calls can leave you believing it is someone from the government demanding mandatory training but the call is actually coming from a company that sells health and safety training.
• Often these calls reference regulation changes that happened in another province.
• Courses offered are often suggested best practices versus required training.
• The courses offered can be at a premium cost to a small business when they are not a required expense.

What you need to know:

• The government will not call your business to solicit you to buy specific training.
• You always have options. There are several sources of training available online and in person at various price points from reputable providers.
• Our Counsellors will help you navigate your training requirements based on provincial and federal regulations.
• Members have access to free health and safety training through our VuBiz partner.

Don’t get caught spending unnecessary time and money on requirements that don’t apply to your business.

For information on your Occupational Health and Safety requirements, you can find the federal and your provincial contact information on the Canadian Centre for Occupational Health and Safety website.

Double deposit of cheques

Technology can make our lives easier, but it can also open the door to increased fraud.

In the past, the only way to deposit or cash a cheque was to provide the actual physical copy to a bank teller. Today, many banks offer an online banking tool called “Remote Deposit Capture”, which allows a person to deposit a cheque by sending a photo of it taken by a smartphone. After the cheque has been deposited, the individual still has the original cheque, which means they could deposit it a second time.  The banking industry calls this a “double presentment”. 

What used to be nearly impossible (i.e. cashing a cheque twice), is now possible due to technological progress and a lack of communication between institutions and technologies.

Two scenarios have come to our attention:

1. An employee receives their pay by cheque. They take a photograph of the cheque, depositing it digitally, and then physically deposit the cheque at a financial institution. Whilst the banks have security processes in place to prevent an employee from being paid twice, the best way to safeguard against this type of fraud is to use direct deposit to pay employees. 
2. A customer uses a government cheque to pay for their merchandise, which is a common practice in many rural communities across Canada. The merchant accepts the cheque as payment but later discovers that the cheque was digitally deposited before the purchase was made. 

Unfortunately, the news for merchants who accept an already-deposited cheque is not so good. From the banks’ perspective, the customer has stolen the merchandise and the onus is on the business owner to prove this to police. 

To help guard against this type of theft, it is advisable to take down information about a customer who is using a government cheque to make their purchase – name, address, telephone number etc. Note that in some provinces it is illegal to even ask to see a drivers' license to verify identity, while in others, you can look at a drivers’ licence to verify identity, but it is against the law to write down any of the information on it or to photocopy it. If you are unsure, please consult with a CFIB Counsellor. 

As part of Fraud Prevention Month, the Competition Bureau of Canada published The Little Black Book of Scams to help you avoid becoming a victim of scams. Scammers will try to collect personal or financial information from you and your business using phone calls, in-person visits, e-mails, or software. The booklet provides hints on how to identify scams and contact information for reporting them to the correct authorities.