How to stop small business banking fraud

There's no way to sugarcoat it. Banks and fintech companies alike are getting crushed right now by small business account fraud.

Fraudsters' big payday from pandemic relief programs across the globe put a spotlight on the fact that many firms have antiquated, inadequate fraud controls. It was a perfect storm. Given the circumstances, banks were faced with an intense sense of urgency for dispersing the pandemic relief, but many banks did not have the processes in place to digitally onboard new businesses at all — let alone at the rate in which applications were rolling in. This situation, unfortunately, resulted in a lot of fraud slipping through the cracks. d

As Alloy's CEO, Tommy Nicholas, pointed out in a recent blog post about the recent Silicon Valley Bank (SVB) shutdown, banks can once again expect to see a spike in new business account applications. History will repeat itself: with the spike in applications, there will be a spike in attempted fraud. The good news is that there's a lot you can do to make it harder for fraudsters to take advantage of you this time.

What types of small business fraud are banks facing right now?

Fraudsters will often take advantage of the hectic moments surrounding events like the COVID-19 pandemic and the fallout from the SVB bank shutdown. Fraudsters used many of the same tactics they might have used before the pandemic — identity theft, synthetic identities, registering fake businesses, etc. They are, however, always coming up with new ways to execute these types of fraud. Let's take a closer look at some common small business fraud schemes.

Business identity theft

Business identity theft typically means that someone uses someone else's business information for personal gain. There are several ways a fraudster can execute business identity theft. A bad actor might use stolen information to open a bank account in a legitimate business's name and then use it to commit fraud. They may use stolen information to apply for a line of credit in a legitimate business's name, or they may use a business's tax number to apply for a tax refund.

Synthetic business fraud

Synthetic identity fraud is a big industry buzzword right now. In fact, in our annual State of Fraud report, banks and fintech companies named synthetic identity fraud as the type of fraud they are most concerned about for the next twelve months — a concern echoed in countries outside of the US as well.

Banks and fintech companies should consider synthetic business fraud a threat as well. Synthetic business fraud occurs when a fake (or legitimate) person creates a fictitious business to commit fraud while using fabricated (or some valid) business elements. Then, the fraudster applies for a loan or opens up a business bank credit card or bank account.

While synthetic identities are often years in the making, in some cases, setting up a synthetic business is as simple as registering a fake business with the state and then using it to open an account or apply for credit.

Check fraud + synthetic business fraud

Some fraudsters combine check fraud and synthetic business fraud to deposit real checks into fake accounts. They will steal a check out of the mail for a legitimate business and then set up a new business using a slightly different spelling of the valid business name on the check.

For example, suppose there is a legitimate company called ABC Company. First, a fraudster steals a check made out to ABC Company out of the mail. Then, the fraudster registers a new business called AB&C Company and opens up a new small business bank account. When they try to deposit the check meant for ABC Company, the bank doesn't catch the subtle difference in name change or thinks that it could be meant for the same company and allows the deposit to go through.

Challenges banks face onboarding small businesses

Before we get into solutions, let's look at some of the blockers that make it tricky for banks to mitigate small business fraud.

Reliance on old policies and old technologies

The organizational structure and legacy technology that many banks use can make it harder for them to adapt. Perhaps it used to be suitable just to check state registrations and negative information associated with the new business. But now, there are new data points that you could consider when verifying a new business entity, such as behavioral and device data.

It could take a bank months to get a new data vendor approved and implemented. As a result, rather than add new technologies, banks often just tighten the controls of their existing systems. This might effectively decrease fraud, but it also likely increases false negatives — blocking potential "good customers" from entering your onboarding funnel.

Siloed KYC, KYB, and fraud checks

A lot of firms tick the box for Know Your Customer (KYC) and Know Your Business (KYB) compliance, and then maybe they do some additional fraud checks after that. Fraud checks should be just as much of the onboarding process as your KYC and KYB checks are — and they are most powerful when combined into a single workstream so that you can get a 360-view of an applicant’s complete risk profile.

Lack of review on business signers

Banks have a legal obligation to verify the identity of a business's beneficial owners. But are they performing KYC checks on individuals added as business signers on a business account? Is your Firm completing an identity fraud review on beneficial owners or signers? Some banks might skip this step, but it can be highly effective in keeping fraudulent actors out.

Internal initiatives support small businesses

Many banks are seeing the small business segment as an area of growth right now. At the same time, many banks are hyper-focused on consumer fraud because they aren't seeing small business fraud as an equal threat to consumer fraud. The problem is, just because they may not be seeing a lot of small business fraud yet, doesn't mean it's not coming their way soon. The best way to fight fraud is to stay one step ahead of your future fraudsters.

Digital onboarding not offered to small businesses

Digital onboarding for individuals is still relatively new to some banks, and many don't offer digital onboarding to businesses at all. Banks that take this stance may be preventing a lot of fraud, but they are also losing out on a lot of customers — who are increasingly expecting banks to deliver fully digital experiences on par with other non-banking apps they use, such as Uber, Google, and Instagram. Put simply, firms that don’t digitally onboard businesses are inhibiting their growth.

What can banks do to prevent small business fraud?

Solving this problem can be challenging, but it can be done! In a recent blog, Alloy CEO Tommy Nicholas provided six tactical steps you can take to prevent small business bank fraud.

More generally speaking, I believe the vast majority of small business fraud can be stopped at origination. Banks need to start looking beyond what they must do to comply with regulatory requirements and start thinking about what they choose to do to prevent fraud. Instead of just ticking the box of compliance during onboarding, think about what other checks you can add to your onboarding process to identify risky or fraudulent applicants.

Could you add a data source that pulls in behavioral analytics? Can you implement additional verification steps for riskier applicants while keeping it frictionless for less risky applicants?

Small business fraud attempts probably won’t go away any time soon. Luckily, the right tools exist to fight against it, you just have to be open to using them.