Category: Business

Knowledge-based authentication (KBA) has been the industry standard for over 20 years as a method of identity verification. KBA has been an outdated mode of verification for a long time. This is a flawed approach to verifying identities as it uses stagnant data. The same data has been breached and accessed by thousands of users worldwide. Personal data and knowledge-based questions’ answers are readily available on the dark web.

Fraudsters have become more proficient in answering all the credit-based questions than the people who have to rely on the quizzes.

This flaw was first recognized in 2015, which led the National Institute of Standards and Technology (NIST) to limit the use of KBA in their latest version of Special Publication. The latest publication is the most widely used ID verification standard in the United States.

However, KBA is commonly used by state and local agencies to verify identities. The most common uses include motor vehicle registration, online portal access, and notarization.

KBAs are considered to be the backup for manual identity verification. But it’s still not a good enough solution, as KBA data has been breached multiple times. Personally identifiable information goes as low as $1 on the dark web.

Current Problem with KBAs

The biggest problem with KBAs is that the data is available with ease almost everywhere on the dark web. Once fraudsters have answers to questions, they’re easily able to bypass security measures and gain illegal access to user accounts. 

Fraudsters often find methods of least resistance to gain access to illegal access to systems. If businesses choose to use knowledge-based authentication to verify identities, they are only using a flawed method.

To properly identify identities and verify users with ease, businesses need to move forward from Knowledge-Based Authentication (KBA). Solutions like the DIRO document verification tool and other verification solutions can help businesses verify the identities of users, ideally.

DIRO’s document verification solution can quickly and accurately verify identities and prevent the risk of fraud while ensuring the integrity of user accounts.

Why Businesses Shouldn’t Rely on KBA

Hackers and fraudsters have exploited the breaches and data thefts to quickly bypass the login systems. Using solutions like DIRO document verification can help businesses with far more accurate verification and huge cost savings.

1. Flaws in KBA

The biggest flaw in KBA lies in its reliance on static and outdated information. Information like Social Security numbers, addresses, and personal details is easily stolen.

Hackers and fraudsters have exploited these breaches regularly to collect necessary information. Moreover, the easy availability of personal data on the dark web and social media has significantly reduced the effectiveness of KBAs.

2. NIST Non-Approval of KBA

The NIST has made KBAs a non-approved technology in their latest version of Special Publication 800-63-3. This highlights a growing acknowledgment of KBA, which highlights how ineffective the knowledge-based authentication process is.

KBA’s deprecation signifies a need for more secure and sophisticated alternatives to make sure accounts are verified properly.

3. Risks of Relying on KBA

Businesses that solely rely on KBAs are at a serious risk of hurting their business. It makes sense that state agencies use KBA for verifying the identity of users, as it’s easy to use and familiar.

With modern cybersecurity threats becoming increasingly sophisticated, businesses and governments need to use a more secure solution.

4. Adoption of Biometrics

Using biometric verification in the identity proofing process can enhance the security of the process. Biometric data is unique to each individual and cannot be easily replicated or stolen.

Technologies such as fingerprint recognition, facial recognition, or retinal recognition can provide a more robust and secure way of verifying identities.

5. Behavioral Analytics

Instead of using biometric data, businesses can use behavioral analytics data to verify if a user account has been hacked. By using a user’s behavior patterns, such as typing speed, mouse movements, or smartphone usage habits are unique to each user.

Any sudden change in the patterns of a user can be an indicator of fraud.

Final Take

Relying on Knowledge-based authentication (KBAs) for identity proofing has been flawed for a long time. Relying on data that has been breached and stolen countless times to identify a user isn’t a great idea.

By using more secure options like the DIRO document verification solution, businesses can quickly and easily identify user identities.

Businesses often overlook fraud red flags. In the long run, this leads to monetary and reputational losses. Vendor fraud has become highly prevalent across several industries. When vendor fraud happens, the culprit could be someone from your own team or someone you trusted. It could also be a fake vendor that wasn’t verified properly. 

Every business needs to make robust and reliable partnerships with vendors to thrive. Fraudsters often take advantage of this reliance on vendors to trick businesses into making wrong payments. 

Here are some of the most common types of vendor fraud, and how you can prevent them:

Common Vendor Fraud Types

1. Phony Vendors

One of the most common methods of vendor fraud is fake vendors pretending to be legit. Fake vendors try to get businesses to make payments for fake services. It can take a long time before companies uncover the fraud.

In some cases, even employees pose as fake vendors to exploit known weaknesses in payment systems. Employees can set up fake vendors, and make fake invoices to get payments in their accounts.

Common red flags to uncovering fake vendor fraud include:

• Photoshopped invoices
• Photocopied invoices
• Companies with no real-address
• Sequentially numbered invoices
• Companies with addresses of post offices

Companies should train their employees to check for red flags in invoices raised by vendors. If there’s a specific vendor that raises invoices just below the sum that needs approval from higher-ups.

2. Fake Invoices with Real Vendors

Sometimes an employee from your business and an employee from the vendor’s team can collaborate to come up with a scam. Both members of the team can collude to trick the business into making wrongful payments. 

A vendor may submit fake invoices, and an employee at the purchasing department will make payment for the amount. The payment is made to a personal account and split between the two. 

This type of fraud becomes common when the supplier and business teams are in close contact. To prevent this kind of fraud businesses must do due diligence before they hire their employees.

3. Kickbacks

If your business performs contract work, then kickbacks are another type of vendor fraud you need to be wary of. The person who approves the contracts could be receiving kickbacks from their vendors. Common red flags for this kind of fraud include:

• Fewer bids than expected/needed.
• Widely ranging bids on the same project.
• Sudden and unexplained deadline changes. 

Kickbacks also happen when you’re paying higher prices for low-quality products. Making cash payments to your employees is the hardest to detect as there’s no record of these payments in company books. But they are reflected in higher pricing from vendors. Even fraudulent vendors need to cover their costs. 

To minimize losses, companies should always look for consistent shortages, communications that happen informally between vendors and staff, and poor record keeping.

How to Effectively Identify Vendor Fraud?

The key to fighting vendor fraud is knowing where to look. If you don’t know where to look for it, you won’t be able to detect it. Here are some basic measures any company can take to prevent vendor fraud:

• Check for the vendor’s pricing structure. If the prices look too good to be true, they’re probably scams. 
• Don’t be lenient on any single invoice. Scrutinize every invoice submitted by the vendor or submitted on behalf of the vendor. If there are two same invoices with the same invoice numbers, it’s probably a fraud. 
• Most companies follow their own invoice format. If the invoice was made using Microsoft Excel, it’s a red flag.
• A vendor that doesn’t have a verifiable taxpayer identification number is most likely to be a fake vendor.
• Do vendor onboarding checks? Run Vendor KYB checks, and background checks to see if they’re legit or if they have a history of fraud.
• Any vendor with a P.O. box address is likely a fraud.

Tips for Vendor Fraud Prevention

Knowing how to look for vendor fraud is one thing, but it’s not enough to identify vendor fraud. What’s important is to prevent vendor fraud from happening. 

1. Manage Vendors Effectively

Fraudsters keep evolving their methods of conducting fraud. When you’re fighting vendors, you need to come up with an effective vendor fraud management system. 

With an ideal vendor fraud management system in place, it will become easier to manage vendor risk. Ideal strategies can significantly reduce the risk of fraud.

2. Audit Vendors Regularly

Keeping a track of vendors is essential. Even a trusted vendor can suddenly start doing fraud. Frequent vendor auditing can help you protect your business against huge financial losses caused by fraudulent schemes. 

3. Multi-Level Payment Approval Process

Vendor fraud happens the most at businesses where there are just one or two employees handling vendor invoices. 

To prevent making fraudulent payments, vendor invoices should go through multiple processes from different departments. 

4. Use Invoice Matching Technique

Invoice matching is pretty basic but it can reduce vendor fraud significantly. 

As the name suggests you have to match invoices submitted by vendors against internal records such as purchase orders, payment receipts, inspection slips, etc.

To ensure you achieve the best possible results, you have to match the invoice against multiple documents. 

5. Don’t Make a Single Employee Manager

Sometimes, several employees work with each other to commit fraud. This is why businesses go such a long time without detecting fraud. Usually, its employees in the procurement and payments department conduct these kinds of fraud. 

The best way to manage risks and prevent fraudulent vendor payments is to keep rotating employees and moving them across different departments. This can ensure that no one employee has too much power.

6. Thoroughly Verify Vendors

Vendor verification is a crucial part of the process. During vendor onboarding, you should verify the vendor’s business information. This includes vendor proof of address verification, vendor KYB checks, and vendor bank account verification.

Running through these checks simply means that you’re using vendors you can trust.

In the public landscape, vendor bank account fraud is growing at an alarming rate. A vendor contacts the accounts team to tell them they haven’t received the payment. The accounts team then checks the data and finds out that they’ve paid the invoices. So, when more due diligence is done, it is found out that the money wasn’t sent to the Vendor’s account but to some other account altogether. What happened was that a fraudster got into the systems and changed the Vendor’s bank account information.

This situation has happened a lot in recent times. Most recently it happened with Scott County Schools where they lost $3.7M. Eventually, they were able to recover the funds. And they decided to put some safeguards to prevent something like this from happening again.

Another similar situation happened in the “City of El Paso, TX” where they uncovered $2.9M, and $300K payments were sent to a fraudster. Unfortunately, they were only able to recover $1.6M and $292K from the payments. To prevent this from happening again, they decided to verify vendor information before every single payment.

Regardless of the fact your company has been in a similar situation or not, there are 4 basic steps you can follow to prevent fraudsters from changing banking information.

Prevent Vendor Bank Account Fraud

1. Build Custom Vendor Banking Forms

The first and foremost thing you should do is to build a banking form for all the vendors. The reason for doing so are:

• Don’t accept banking information in an email body. An email with banking details doesn’t provide authentication so that’s why you build the form.
• Change the form every year. This way your team can distinguish between fake and real forms. If they receive an old form, they can ask the vendor if there’s a mistake.
• Add vendor authentication on the form. Existing vendors will have to add some kind of information that’s unique to them. No one except the vendor should have that information as it helps in reducing the risk of fraud
• Your form should require a digital signature. Be careful while building a PDF form with a digital signature built into the form. To avoid emails and calls from vendors saying they’re facing errors, let the vendors use their own digital signature tool.

2. Verify Bank Information

This is a vital step in preventing vendor bank account fraud. As you confirm a vendor’s Legal Name and Tax ID to match IRS records, you should also confirm the bank account information to match them against your records. Moreover, you can use DIRO’s bank account verification service to make sure the documents provided by your vendor are true.

3. Contact Vendor to Confirm Information Change

Once you’ve received the updated form, and confirmed all the data against your records, it’s time to contact the vendor. Call the vendor to verify the changes if there are any. This may seem cumbersome to both parties at first, but the benefits outweigh the pain. There won’t be any payment delays, and you won’t have to try to recover lost money.

While verifying the information, keep in mind that the vendors may not respond right away, so you need to find a way to keep track. If the Vendors don’t respond in time, don’t process the payment.

4. Send Notification to Vendor After Information Change

If there are any changes in the vendor banking information, you should build a system that sends an automatic notification system. Whenever the information is changed, the vendor will receive a notification.

How to Make This Process Efficient?

Building and setting up this process takes up a lot of time. But the process is crucial as it helps vendors and yourself be safe from fraudsters. Implement a vendor self-registration portal for vendors to authenticate themselves and prevent fraud. On the portal, vendors can authenticate themselves and also update their banking information as per their preference.