Avoiding Losses Due to Payments Fraud

Ladies and gentlemen, welcome and thank you for joining our Avoiding Losses due to Payments Fraud webinar.

Before we get started, we would like.

To mention for all of our guests joining that your phone lines are currently in a listen only mode.

To minimize our background noise, we do.

A planned question and answer session at the end of our presentation today and you can submit note questions to us at any point using the note chat function on the right hand side of your screen or located under the participants menu at the top of your screen. And and please address all of these note questions to all presenters.

And with that, I'd like to begin.

Today'S conference and hand the call over.

To Natali Goriel from the sba.

Great.

Thank you so much.

Tony.

Hi everyone.

My name is Natali Goriel and I'm the online Media coordinator for the U.S. small Business Administration. I'd like to welcome you to today's webinar. This webinar is made possible through a partnership with the Federal Reserve bank of Minneapolis. We're excited to work with the Federal Reserve because partnerships like this one allow government organizations to come together in the support of the small business community. It also allows us to hold free webinars like this one on a variety of business topics. In just a moment, I'm going to turn it over to Mary Hughes and Amanda Dorothy. But before I do that, I want to say a little bit about the sba. So we know that as small business owners and entrepreneurs, you need more of two things, time and money. Our mission at the SBA is to provide the nation's 28 million small businesses with the support they need in a world where time and money are both short. We do this through what we call the three Cs. First, SBA provides capital to small businesses in the form of guaranteed loans to start, expand, export, or recover after a disaster. Second, we help small businesses with government contracts, which is a $100 billion market. And finally, SBA provides counseling services, often at no cost. Many of you might be familiar with the SBA resource partner network, including small business development centers, SCORE mentors, women's business centers, veterans business centers, and our SBA field offices. I encourage you to visit SBA.gov to learn more about the services and events in your Resource Partner Network.

So with that, let's go ahead and.

Get started with today's webinar. I'd like to turn it over to Mary.

Thanks, Natalie. Hello to everyone and thank you for joining us today. Amanda and I want to thank the Small Business Administration for this opportunity. We recognize that making and receiving payments is a very important function in your small business. Unfortunately, though, all payments carry the risk of fraud. Today we're going to tell you about a free resource that will help you make better choices about the payments your small business uses. The Small Business Payments Toolkit. Most of the webinar is going to focus on tools and techniques that you can use to protect your small business from becoming a victim of payments fraud. Amanda and I both work for the Federal Reserve bank of Minneapolis, which is one of 12 regional banks that make up the Federal Reserve Banks, the central bank of the United States. The Federal Reserve has been empowered by Congress to serve four main roles. First, we provide financial services to banks and we also serve as the government bank. We establish and execute U.S. monetary policy through the Federal Open Market Committee. We supervise and regulate certain financial institutions, and we are tasked with maintaining a stable financial system and containing systemic risk. To that end, our mission in payments is to foster the integrity, efficiency and accessibility of the US Payments and settlement systems in support of financial stability and growth. To accomplish this, the Fed works with many diverse stakeholders to improve the efficiency and effectiveness and safety of the US Payment system. And in particular, our department, the Payment Standards and Outreach Group, works to improve the efficiency and security of business to business payments. Next, I'll let Amanda introduce herself.

Thank you, Mary. I'm Amanda Dorpy and as Mary mentioned, we work together in our Payment Standards and Outreach group and one of my main areas of focus is on payments fraud prevention and education. And you can find resources on our website which is listed on the slide, as well as there's a link in the back of the toolkit that provides access to the resources that we produce on fraud mitigation. Next, I'll have Mary tell you what we're going to talk about today.

Thanks, Amanda. Our webinar is divided into three parts. First, we're going to tell you about the Small Business Payments Toolkit and highlight materials that you can find there. Second, we're going to share information on why small businesses should care about payments fraud and tell you about a few current schemes that you should watch out for. Third, we're going to describe some payment security best practices by payment type, covering payments made by tech, the Automated Clearinghouse, or what we'll refer to as ACH and various types of cards. And I do need to say that the opinions that you hear from Amanda and I today are our own and do not reflect the opinions of the federal system. Finally, the SBA is recording this webinar and they're going to be posting the link to it on their YouTube channel. And after the webinar is over, they will share our slide deck with all of the registrants. The first part of the webinar will talk about the Small Business Payments Toolkit. What exactly is this? First of all, it's free. It's a 45 page PDF document that you can download at the website that is listed on this slide. And in addition to the toolkit itself, you will find links there to YouTube videos of previous webinars that we've given on the Toolkit and.

You'Ll find some.

Of that informative, I think The Toolkit.

Was created by a group called the.

Business Payments Coalition and it was compiled by a group of volunteers of about 25 individuals representing banks, standards development organizations, small through large businesses, technology and service providers, and fed payments experts. We strive to write the Toolkit in plain language and it offers common sense tips and advice that you can consider for your own small business based on your needs and in addition to articles on a wide variety of topics. We have a very robust resource section at the end of the toolkit that would give you links to further information. The toolkit covers these main payment types and A payment is simply a transfer of value from the payer, who is the party initiating the payment, to the payee, which is the party receiving the payment. And going clockwise from the top, the toolkit covers ach, which stands for automated clearinghouse, and ACH transactions are processed in batches or groups instead of as single items. The payer originates an ACH transaction and can opt to have it settled that same day or or in a one to two day time frame. You'll see ACH used for direct deposit of payroll, direct debit of recurring bills, and many, many other use cases. As a network, it's important to note that the ACH can be used to push funds in terms of an ACH credit or to pull funds, which is an ACH debit. So an ACH credit is an entry that pushes a payment to another account, for example from a buyer, to pay a supplier for a purchase. And a really good example of an ACH credit is when an employer uses direct deposit of payroll to pay employees by depositing money directly into their checking accounts. An ACH debit is an entry that pulls a payment from another account, for example when a supplier debits funds from the buyer's account for a purchase. ACH direct debit transfers include monthly payments on insurance premiums, mortgage loans, and other kinds of bills that require payment on a recurring basis. Moving around the circles there, I'm going to talk about Internet bill pay next. Internet bill pay gives businesses a way to pay bills by asking their bank or another service provider to make a payment on their behalf. That provider in turn is going to probably write a check or make an ACH payment to pay the bill on behalf of the requester. Some businesses receive electronic invoices over the Internet and they can use a bill pay service to route those bills for payment and processing. The purple bubble there represents credit and debit cards, which are extremely popular in the U.S. a credit card allows cardholders to make purchases or get a cash advance using a line of credit granted by the bank that issued them the card. A debit card allows cardholders to make purchases or withdraw cash from their own checking accounts. Wire transfers electronically transmit funds intraday, meaning that the payment is initiated and settled on the same business day. And a wire is an unconditional order to pay a certain amount to the beneficiary. Upon receipt, the funds are irrevocable and they can't be returned. Funds are settled immediately and delivered really fast, usually just in a few seconds. And a wire transfer is always done as a single payment. And it's very popular for making an international payment or a high value critical payment.

I think most of you will know.

What checks are, but the toolkit explains that a check is a negotiable instrument that instructs and authorizes the bank upon which it's drawn to pay a certain amount from the payer's account to the payee, the party receiving the check. And then finally, the toolkit covers what we call alternative payments, and those are payment initiation methods that exist outside the mainstream payment channels and most online mobile payments. Mobile wallet type products tend to focus on consumers, but we're seeing business services gaining traction as well. And in the toolkit we explain how alternative payment services like PayPal and Square can allow small businesses to accept online payments or cards without having a traditional merchant account. So the toolkit will give you basic information on all these payment types. It describes what each one is, and it covers the pros as well as the cons of each payment method. This bar graph summarizes how businesses that were surveyed rate the various payment types available to them. The blue covers checks, the pink part of the bar is ach, green is wire transfers, and cards are in purple. And we're showing you this slide because we want to call your attention to the circled line. Best Fraud Protection Automated clearinghouse or ach payments are viewed as Having the best fraud protection by 37% of the survey respondents. Next, Amanda will explain why payments fraud is a serious concern for small businesses.

Well, it's not if, but when a small business will experience payments fraud attempts. As Mary mentioned earlier, all payments carry the risk of fraud. Fraud schemes can vary from somewhat simple to more sophisticated scams. Fraud events can be carried out by employees, customers or other outsiders, such as organized fraud rings. Fraud Tactics Change two Attacking the Weakest Link as businesses and other industry participants adopt measures to reduce risk, fraudsters will modify their tactics. When fraud happens, businesses can be held responsible for lost funds. Liability for payments fraud is governed by laws, regulations and by private contracts. And the liability varies by payment type. So you know, Mary just went through the variety of payment types. The rules around who is subject to a loss in the event of fraud is different for each of those. And if a payment involves consumer accounts, for example, we as consumers enjoy many protections, but your small businesses do not have those same protections for your company. And in the resource section that we mentioned. So back on page 42 of the toolkit, there's a link to a payments fraud liability matrix that was produced by the Minneapolis Federal Reserve and it describes for fraudulent payments involving a consumer account. It lists the laws, regulations and rules that apply and who might be on the hook if there's fraud losses. And lastly, I wanted to mention that there's a practical matter of recovering loss funds. It will take time and effort and the business might not be successful. So today we'll cover steps that you can take to help reduce your risk of fraud losses. This slide shows that the share of check fraud losses by the type of account and small businesses as well as consumers are hit with the largest share. So they account for about 83% of all check fraud losses. So this is to point out that small businesses are vulnerable and they are often attacked. At the end of last year the Federal Reserve published results of a payment study and this study estimated the percent of card fraud value by type of fraud occurring in the US in 2015. As the chart shows, 55% of card fraud value occurred with the use of counterfeit and lost and stolen card fraud. These generally reflect in person fraud or what's also known as card present fraudulent Use of account number reflects purchases made online by mail or or by telephone and is also known as card not present fraud. And you may be aware that E Commerce purchases it's a smaller share of purchases across the U.S. it's about 20% of the transaction, but they receive a disproportionate share of fraud losses. On the chart it shows 39% U.S. expects that the share of counterfeit fraud to go down as more card transactions are done with chip cards and chip readers. Fraud is then likely to shift to other card methods or to other payments altogether.

So there are some themes that I.

Want you to all be aware of. These are prevalent. The first one I want to discuss is business email compromise schemes, also known as BEC schemes. And this is a growing area of fraud attacks. So when Beck schemes succeed, an authorized person at the company has been deceived and persuaded to send a payment, often wire, but it doesn't have to be, could involve check or ach. And this scheme has several variations. So I'm describing two somewhat generically. But fraudsters are pretty creative, so they may not all fit this particular mold. I'll start with the invoice schemes. In this scheme, the business receives an email instructing a change in the payment instructions, such as where to send a check or a change in account information for an electronic payment. The fraudster will spoof the email address so it appears very similar to the legitimate supplier or vendor. So they're really hard to detect that it's not a real email from your trading partner. And this scheme targets payments made by wire, ACH and even check the executive scams. Again, they're using emails. In this case, the fraudster creates a fictitious email from a spoofed account. And that means that it looks like it could be the person's email address, but maybe for Mary, instead of an M, it's two N's. And unless you scrutinize it really close, you might not catch that. And these emails look like they're coming from the owner of a company, the CEO, the CFO, or some other C level executive. The email is sent to a person that handles payments in the company, and it's oftentimes sent at the end of the business day, the end of the work week, or when executives are on business travel or out of town. The payment request itself says that it's urgent and confidential. So in some way it expresses some urgency and it instructs the person to send money, usually a wire transfer. Because it appears legitimate, employees are deceived into making a payment to the fraudster's account if the wire was used. Mary described earlier that these move quickly, they're final, they're irrevocable, and so if that happens, it's extremely difficult to get the money back. Fraudsters do their homework, request a pure legitimate having processes in place to steer clear of these scams are really important. The other scheme that I wanted to make you aware of is called account takeovers. And small and mid sized businesses do remain primary targets for this particular scheme. In account takeover, the fraudster uses compromised business credentials to hijack a company's bank account or send funds. So your logon, id, password, other credentials that you use to access the system on a regular basis, the fraudsters are obtaining and they might do this through malware. So an employee might go online on the Internet, click on a pop up message or download pictures from social media. There could be emails with attachments that when clothing clicked or opened, can download malicious software that installs on the computers. There's software that does key logging, so it's capturing the keystrokes of the employee as they're working in the online banking tool, for example. There's also methods such as social engineering where someone might be called on the telephone and ask specific information and may be tricked into divulging account and login credentials. And there's also spear phishing and phishing attacks. Again, this is involving email where someone is persuaded to enter information in response to an email that looks legitimate. I got a spear phishing email just the other week and it was directed to me. So it said dear Amanda, so that's why I'm calling it a spear phishing since it was personalized. And it said we are going to charge several hundred dollars to your account unless I act immediately. And there was an attachment for me to click and they also gave me a password in the text of the email. I didn't click on the attachment. I reported the phishing attacks and I also deleted the email. But it did make me wonder. It got me anxious thinking, oh, what if someone's really going to charge my account? I went on my online banking and looked instead, rather than pursuing what the email said. And also another intrusion method is hacking computer computer systems. That's another way they can get at the credentials. Once a fraudster has the login credentials, they can impersonate the business in online banking sessions. And they might not make a payment right away. They might collect information to determine what your normal payment patterns are so that when they do move forward with the attack, they can try to fly under the radar and not meet. When they do initiate funds, funds are typically sent to what we call mule accounts. These are accounts where someone maybe has responded to a work at home. Ad. And these are people that are recruited perhaps as payment processes processors or financial agents. And these mules are also often innocent victims. Once the mule has the funds, they send it out again and those accounts are emptied and it's very, very difficult to get funds back. Next, I'll turn it over again to Mary.

Thanks, Amanda. In this third section, we're going to discuss steps that small businesses can take to help reduce the risk of being victimized by payment fraud. Unfortunately, there really is no one solution and fraudsters keep changing their methods of attack. We emphasize that prudent risk management requires that you put multiple layers of protection in place to help prevent payments fraud in your business. The Small Business Payments Toolkit provides much more information than what we will have time to cover in the webinar today. In the toolkit, fraud prevention education is organized by payment type as shown here. And in addition, the toolkit lists many practical tips and offers ideas that you can consider implementing to help protect against fraud threats. Amanda, can you give us an overview of the fraud prevention process?

Sure. Well, the idea is to protect detectives, respond and improve. So fraud mitigation is a continuous process. We need to take measures to protect sensitive data which can help prevent fraud from happening in the first place. We also need to implement processes and tools to detect and defend against fraud attacks and when fraud does happen, respond and make improvements to update defenses. In the next series of slides, we'll cover fraud mitigation by payment type and Mary will kick us off with checks.

When you think about it, every time your business writes a check, you are sharing your bank's routing number and your business's checking account number in the check shown on the exhibit here. That bottom nicker line has important information that a fraudster can use. That first set of digits contains the routing number that identifies your financial institution. That second set of digits tells them.

What your account number is.

So criminals will steal this information from checks and they'll use it in check counterfeiting schemes or to attempt ach debit fraud, which we will be discussing later in today's webinar. Next, Amanda is going to tell you more about why check writing is risky and what you can do to avoid check fraud.

Check fraud is still a problem. Many businesses, especially small businesses, continue to make and accept check payments. Checks is vulnerable to fraud attacks. As Mary pointed out, checks issued by the business makes their account information accessible. A couple of examples of common fraud with use that are by check are counterfeit checks for the fraudster. These are low cost frauds. They can easily purchase check stock and printing equipment at your office supply stores. And if a criminal has your business account number and routing number, they can print a counterfeit check. Another method criminals use is to alter a check that has been issued. A technique called check washing makes it possible to modify the payee name on the check or the dollar amount. A business associate of mine told me about an alter check that she received at their company. And to help obscure the change, the criminal made, like a coffee cup ring over where they altered the check to try to distort the fact that they had changed the payee on the check. And how might they get those checks that your company has issued? Mailfest is one of those methods to obtain a check. I remember at my dentist office they always used to have their going mail right in a wire basket on their counter. And I thought, well, I know it's convenient for the postmaster, but it was also convenient for anybody else who wanted to grab the mail and go. If these frauds happen to your business, do you have processes or tools in place that would help you detect them? Let's find out. So there are many ways that businesses can protect themselves from becoming victims of check fraud. Some of these risk mitigation methods really apply across payments generally and others are specific to check. First on my list is to implement strong internal controls and procedures around key payment functions. Reconcile your bank accounts, date address exceptions and make timely returns. And this might mean you need to talk to your banker about what are the check return deadlines. There are rules around timing of returns and for handling exceptions that if missed, will make recovery of lost funds more difficult. At the same time, additional fraud can go undetected. Apply separation of duties within the organization over check, stock check issuance, mailing and account reconciliation where no one person can complete the process start to finish. It takes teamwork. If it's not practical to do that to separate the duties. Other risk management practices become more important and educate and train staff. Mary, what else can businesses do?

Well, it's good practice to keep all checks, deposit slips and canceled checks in a lost cabinet. You should always shred old documents that you no longer need. You can use tools and services offered by your bank and reputable service providers. An example of that is a positive pay service which systematically compares checks presented for payment to a file of issued checks that the business provides to their bank. The bank then cross references the checks that have cleared to detect check numbers and dollar amounts that don't match the.

File given to them by the business.

And as Amanda just talked about, altered checks using a positive pay service is going to catch a check with an altered amount or it will identify it as a counterfeit Another example of a tool is to apply Post no Check restrictions. If your business uses one account for issuing checks, talk to your banker about applying a Post no Check restriction to all your other accounts. Merchants that accept checks at the point of sale can use check fraud detection services. For example, they can get a score back on a check and if it comes back account closed, they know not to take the check. Another great piece of advice is to simply limit the number of checks you issue by your business. One way to do this is to replace checks with electronic payments, for instance by paying employees with direct deposit via ACH or via payroll cards. Along these lines, to reduce risk, some merchants no longer accept checks at all. Amanda is going to now talk to us about how you can avoid being a victim of ACH fraud.

Thanks Mary. I'll start out with talking about some of the frauds that affect businesses that use ach. So unauthorized debits to accounts are so this is where the ACH payment has been taken from a company's account, but the company did not authorize the payment. For example, if the fraudster is able to obtain the company's routing number and account number off a legitimate check. So that picture of the check we showed just a few slides ago? That information can be used to originate a debit ACH against the company's account. There's also the possibility of insider fraud, so tactics could include paying a fake vendor or employee for altering a file.

And then email scams can be used.

To facilitate account takeovers or business email compromise schemes that I discussed earlier. To avoid unauthorized debits to a business owned banking account, limit ACH debit activity to one or two accounts that the business uses to make the ACH debit payment. So similar to check, you may not want to do everything out of every account that you have. Also reconcile the account data, address exceptions, and make timely returns. Again, my advice would be to talk to your banker so that you understand what deadlines you need to meet and processes to follow to complete a return or report an exception and notify your bank of any suspicious activity. You might be the first to detect something that's going and they may be able to put some stops in place to get it so it's not continuing. Use the fraud prevention services. Your bank has tools to help you. They can place ACH debit blocks on accounts that you do not plan to use for ACH debit transactions. Most banks offer ACH filters and positive pay programs that let the business establish criteria that its bank will use to filter ACH transactions and then the business is notified of any rejected items via email or text message. And then you can decide whether to reject the item that doesn't meet your specified criteria or to instruct the bank to allow it to go through. Businesses may also receive alerts when an ACH debit is received. Alerts can speed up the process of identifying suspicious activity. Schemes associated with ACH credit fraud are those where payments are being sent from from your account. Prevention methods include implementing best practices for online and IT data security. Some examples would be adopting stronger forms of authentication or added layers of security such as using multi factor authentication to access your online banking. And factors include something you have, something you know or something you are and having multi factor means it's using at least two of those factors. So if it's just something I know and it's three something I know, that's not multi factor. So maybe you have a securities token option for accessing online banking in addition to having a password that would be multifactor. Use out of band authentication. So if a request is by email, then call or send a text for verification. This is a good way, you know, to help prevent business email compromise schemes. You've got an email coming from the company owner saying send funds to Mary.

Sorry Mary.

Call the owner and say do you really want these funds sent? Or send a text message. Dedicate a PC to online banking and ACH origination and don't use that computer for other purposes such as emails or web serving. My friend is a director at a small company with 15 employees. They have a laptop that is only used for payment processing and when it's not in use for that purpose, they log off and secure it in a locked cabinet. Keep antivirus and malware detection software up to date. Install security apps on mobile devices if you're using mobile devices, use logical so those are technology based controls as well as physical control so room access, locking it for access to payment processing and then something that's very simple. Shut down your PCs at night. Use dual control for payment origination and account setup so that no one person alone can complete a transaction and this measure can help account takeovers and BEC schemes. If a request appears to be coming from a company president, don't skip your normal control measures. Establish verification procedures for supplier and vendor account changes. Make sure that you have a list of who's authorized at those companies and if you receive a request then based on your own maintained information, go off your list and call and verify the change. That will help to again reduce the chances of being fooled by a business email compromise scheme require due diligence of your vendors involved in payment processes, so check them out before establishing a relationship and keep periodically refresh your review and monitor activity. If you see something that looks suspicious, say something, escalate to management, call the bank and then lastly educate and train staff. Lastly, implement protective proactive Excuse me, Implement proactive detection and monitoring. Check with your bank on the services they offer and how they work, such as notice of a new PAE added or transaction batch and file limits. Take advantage of the tools your banks provide. Many of them are free. Next, let's discuss card payments on cards that are issued to your employees for business purposes purchases. Common frauds are employee misuse and when that happens, it's typically the business that's on the hook for liability. Use of Loss and Stolen Cards When a card is lost or stolen or the data stolen, a tactic that the fraudsters use is they'll ping the account with a small purchase to see if the card is still active and they do that before escalating a more full blown attack. Counterfeit cards too can be used online or at point of sale. If you're accepting card payments. Schemes include counterfeit, lost or stolen cards used online or at point of sale. And we've heard about some of the big data breaches over the last several years. When card data has been stolen, it can be used to make fraudulent card purchases. If your company has business or purchasing cards, these are some of the tips covered in the toolkit. Establish policies and processes. Only give cards to those that need them. We have one person in our area that has a business card. She does all of our supplies. If I travel, I don't have a business card for that. I use my own card and get repaid. Establish HR policies and checklists so when a person leaves, make sure that card that they're holding is canceled and require receipts for transactions over a certain threshold. Monitor transaction activities. Require the managers to review the purchasing activity of other staff and when a new cardholder makes their first purchase, have the manager contact them to verify the purchase. It shows the employee that the purchase activity is being watched and regularly monitor for unusual and high value transactions. Consider conducting random audits of receipts and use online services to view activities. Mary, what other tools are in the toolkit for reducing card progress?

Well, it's recommended that personal banking accounts be separated from business banking accounts and that personal cards should be separated from business cards. It's recommended too that businesses consider switching to online statements and online payment methods or set up a secure mailbox for receiving and sending bills so that you keep sensitive data out of the hands of criminals. Other controls regarding the use of business cards are to separate duties for administration, approval, auditing and reconciliation among different employees whenever possible. And that's to create a system of checks and balances within your business. You can also place limits on dollar amounts of and frequency with which transactions can be made on a card. And if you use a lot of business cards, you can ask your card issuer to apply merchant category code restrictions. For example, you can say that a card can't be used for a cash advance or that it cannot be used to make a purchase in a liquor store. Amanda, what other tools will help protect against card fraud?

Education and training of employees and actually these are, I think, really good tips for any of us who use cards, debit or credit. Educate staff. They should know that if a card is lost or stolen that they need to report that as soon as possible because the business is responsible for charges until the card is reported lost. Look out for unauthorized transactions. You may be able to set up alerts too. Monitor card statements timely and use online services to view activity. If you're using debit cards, monitor your checking account daily, which we've said two for checks, so we're really encouraging that. And again, watch for unusual activity. Keep a low balance and limit it to just the funds needed to cut cover your payments. As a consumer I do follow these practices. I regularly monitor my accounts in addition to reviewing my monthly statements. I go online and view activity almost daily and I have spotted one unauthorized charge and notified my financial institution immediately. They blocked my account for future transit transactions and issued me a new card with a new number. If a business accepts card payments, there's a wealth of information in the toolkit about practices you can use to reduce the potential for fraud on cards accepted. So I'll highlight just a few of those. I do encourage you to look at the toolkit first. Establish best practices on on card acceptance policies and make sure that the employees know it and follow it. Use automated tools such as validation services. And this would be where when accepting a card, the merchant might ask to see your card and they'll enter that three digit code. That's a CVV code on the back of the card or, or maybe the clerk asks you for your zip code and they'll enter it in. That data is being matched to help to validate that that's a legitimate cardholder that's making the purchase. For Internet and telephone sales require that the customer provide the name on the card, billing address, card number, expiration and the security code and then use validation services that check this data against the cardholder information. The fraudster might not have all those pieces of information, so the data might not match. If you haven't already considered it, think about upgrading to card readers that accept EMV or chip coins. In 2015, the fraud liability for card present disputed transactions changed to the party that is not EMV enabled. So if you are accepting cards and don't have a chip card reader yet, you are subject to that liability and emv. That helps to reduce in person counterfeit card fraud and it also makes it harder to skim data and can protect against tampering. When shipping a product, be sure the billing and shipping zip codes match. If not, find out why you don't have to accept a sale if you think it's suspicious. A few more get authorization for the full amount of the sale. Don't split the sale among multiple cards unless it makes business sense to do so. Like at a restaurant, I go in with gift cards sometime and use up a gift card and then put the rest on a credit card. So there are other reasons you might do that. Inspect the card and verify the data matches. Look at the account number on the card to what's showing up on the terminal because if it's reading just mag stripe that can be counterfeited and they may not match. That would be a red flag. Look at the cardholder name that prints on a receipt to see if it matches the name on the card. These are just a few of the tips to consider. Again, there's many more in the toolkit. We're in the final stretch. Mary will recap what we've discussed today.

Thanks Amanda. Well, I hope you have been persuaded by now that the Toolkit has a lot of good ideas and information that will teach you more about payments in general. Plus, we'll give you some excellent advice that you can consider to avoid being a victim of payments fraud. This slide shows some of the key themes that we cover in the Toolkit. First, that you have to ensure that fraud prevention and detection is an organizational wide objective. Very important that you set policies and procedures, that you monitor compliance with them, and that you take action as needed when there's exceptions. A second theme is that you should take advantage of cost effective tools and processes that might address your vulnerabilities. Talk to your banker about fraud monitoring services and tools that they offer. Some of the services are free. The third idea is that you should check your accounts daily. Fourth, you should lock up banking account information and you should limit access to online data. We encourage the use of strong passwords, and it's very important that you change them regularly. Educating and training employees on fraud prevention is an excellent idea as well. And make sure that fraud prevention education is part of your new employee onboarding.

As well if they'll be dealing with.

Payments on behalf of your business. Finally, you have to be vigilant and know going in that you'll have to continually update your defenses because fraudsters evolve their tactics and we need to do the same in order to counter fraud threats. So we hope that you found this webinar informative. If you have suggestions on how we can improve the Small Business Payments Toolkit, or if you want to get a copy of the slide deck used in today's webinar, please reach out to us and send an email to the address shown on this slide. And we're going to spend the last part of the webinar answering questions that came in. And we strongly encourage all of you to go get your free copy of the Small Business Payments toolkit and read it and use it and share it with your colleagues. So I'm seeing, Amanda, that we just got one question that came in and while you were talking, I looked up the slide in question that it refers to. He's asking us if we could please clarify the E Commerce fraudulent percentage and also to repeat the solutions that we're recommending to combat E commerce or card not present fraud. Amanda, do you want to take a crack at answering those questions?

Sure. So this was the chart that showed fraud by payment type and the particular schemes. So counterfeit card, lost and stolen card, those are typically in person transactions. So at the cash register, at the merchant card issue, but not received. So that could be mail theft, fraudulent applications. So ID theft or something where someone is impersonating someone and applying for a card and then fraudulent use of the account number. And that was 39% of the fraud value in 2015 and that associated with with E Commerce or other card not present type transactions. So it would be online transactions, mail order and telephone order that can fall in that figure. And I had mentioned that if you think about commerce in the US Your purchases at your brick and mortar merchants still far exceeds the percent of sales than E Commerce. I believe E Commerce is about 20% of US sales. So if we were looking at the chart, 39% of the fraud was fraudulent use of account numbers. Again, that's typically online. And if E Commerce is only 20% of sales. That's a very high percent compared to your non E Commerce sales. And then they asked me, how would you prevent it? Yeah.

And I think you addressed some of that on the slide where you talked about how to avoid fraud on cars.

Accepted. Right. So this would be some of the online tools like checking the CVV code, checking the billing address to make sure it matches the shipping address. And then there are many, many tools that are listed in the toolkit. So we did not cover those in depth. And so I would encourage the person that asks that question to also refer to the materials in the toolkit.

Well, thanks. I don't see any other questions. So again, thank you very much for your attention today. And I'm going to turn things back to Tony to close out the webinar.

Wonderful. Thank you so much. And a reminder for all of our guests, we do want to thank you again. We will have this posted onto the YouTube site for any recordings. So if you were not able to watch the entire conference or if you do have folks that were not able to make the conference, it will be posted usually about a week from now. We do want to thank everyone for joining us today on our conference. That does conclude our call. And you may now disconnect.