Why the Vendor Confirmation Call is Not A Silver Bullet to Avoid Payment Fraud
In the realm of vendor payments, the confirmation call has long been hailed as a safeguard against fraud. However, this seemingly simple step is very manual and is fraught with challenges that undermine its effectiveness. From missing or inaccurate contact information to time zone differences and unresponsive vendors, the process is riddled with pitfalls. Moreover, fraudsters have become adept at subverting the system by evolving tactics to mislead those attempting verification. It is definitely not a simple step, however, by implementing recommendations to overcome these challenges, the confirmation call can be an effective step in a fraud prevention process.
Challenges in Making Effective Confirmation Calls
No or Bad Vendor Contact Information
- When vendor information is collected for vendor setup or for submitting changes, often the contact information for the vendor team members that need to confirm the remittance changes is not collected.
- When a search for this information is done the applicable contact information is removed from the vendor’s website (ironically, to avoid fraud).
- When using search results to find vendor contact information, impersonated websites and fraudulent contact information may rank higher in the search results since fraudsters use SEO and paid ads to provide fraudulent contact information.
- Fraudsters know the confirmation call is required for a remittance change, a new workaround is to first send a request to change contact information, then send a request to change remittance information. When the confirmation call is made, it is made to the fraudster.
Vendors Don’t Pick Up the Phone When Calls Are Made
- When the confirmation call is made, it is made to a contact that is not responsible for confirmation remittance information.
- Vendors may be too busy to take calls, leading to missed confirmations.
- Time Zone Differences: Time zone differences can make it challenging to reach, especially those in other countries.
Even When You Have the Right Contact Information, and the Vendor Does Pick Up, the Confirmation is Not Valid
- To avoid fraud, vendors have instructed the contacts that confirm remittance changes to not confirm via phone. From the vendor’s point of view, they may not know who is on the other end of the phone requiring confirmation of sensitive information.
- Authenticating questions such as providing existing banking information or the vendor’s tax identification number, are not being asked to verify that the confirmation is from a vendor contact and not from a fraudster.
Improving the Confirmation Call Process
Collect and Maintain Valid Contact Information
- At the time of vendor setup or when updating vendor information, request vendor contact information from an applicable internal team member. This can be the buyer from Purchasing or the internal team member for non-purchase order vendors.
- Create a separate form or include fields on an existing vendor form to collect valid vendor contact information.
Use Confirmation Call Scripts
- Have an introduction to explain the reason for the call and include your name, the name of your company and also the name of the team member at the vendor’s place of business that requested the service or product or that submitted the remittance request. This may help the vendor contact to recognize the request as legitimate.
- Include fraud prevention questions such as the last 5 digits of the existing bank routing number and the last 5 digits of the existing bank account number.
- Confirm the new banking information submitted by asking the last 5 digits of the new bank routing number and the last 5 digits of the new bank account number as fraud prevention, but also to make sure there were no errors when the new banking was submitted.
- Include language for a graceful exit if the confirmation attempt was not valid.
Document Confirmation Call Attempts
- Create a log to track all confirmation call attempts and the status of each.
- For pending confirmation calls, do additional research to avoid returned payments because a payment was released before the remittance information was updated while balancing the need to avoid payment fraud.
Document Confirmation Call Process
- Create a desktop procedure so that all team members are following the same process.
- A documented procedure can be audited, which will help to ensure that team members will continue to follow the process.
- Make decisions such has how many attempts will be made before additional steps are required and document those next steps.
Final Thoughts
Effective confirmation calls can be a vital part of preventing B2B payment fraud as part of a larger fraud prevention process when adding vendors and when changing existing vendor information.
