Payment Fraud Types and Business Email Compromise

Why This Topic Matters

Payment fraud is one of the most significant operational risks a treasury department faces, and it sits squarely within the Financial, Regulatory and Operational Risk domain of the AFP Certified Treasury Professional (CTP) exam. According to the annual AFP Payments Fraud and Control Survey, roughly 80% of organizations report being targeted by attempted or actual payment fraud in a given year, and business email compromise (BEC) consistently ranks as the most common and most financially damaging scheme. The FBI Internet Crime Complaint Center (IC3) has reported tens of billions of dollars in cumulative BEC losses worldwide.

For treasury professionals, this topic matters for three reasons:
1. Treasury owns payments. Disbursements, bank account structures, and payment authorizations are treasury responsibilities, so treasury is the natural first line of defense.
2. Liability is governed by law and bank agreements. Whether the company or the bank absorbs a fraud loss depends on the Uniform Commercial Code (UCC), Regulation E, NACHA Operating Rules, and the security procedures agreed to in the account documentation.
3. Controls are testable. The CTP exam expects you to match specific fraud types with the specific controls that mitigate them, and to understand the legal framework that allocates losses.

What Is Payment Fraud?

Payment fraud is any scheme in which a party uses deception, theft, or unauthorized access to obtain funds through a payment instrument or payment system. It can be external (criminals, organized crime rings, nation-state actors), internal (employees with access to payment systems or check stock), or collusive (an insider working with an outsider). The CTP body of knowledge organizes payment fraud primarily by payment instrument, with BEC treated as a distinct, cross-channel social engineering threat.

Major Types of Payment Fraud

1. Check Fraud
Checks remain the payment type most frequently targeted by fraud, despite declining volumes. Common forms include:
- Counterfeit checks: entirely fabricated items printed using stolen account and routing numbers.
- Altered checks: legitimate checks on which the payee name or amount is changed, often through chemical 'check washing.'
- Forged maker signature: an unauthorized person signs the drawer's name.
- Forged endorsement: the check is intercepted and the payee's endorsement is forged.
- Stolen check stock: blank checks taken from the company's internal supply.
- Mail theft: criminals steal outgoing checks from mailboxes (including USPS collection boxes) to wash or copy them.
Primary controls: positive pay, payee positive pay, reverse positive pay, secure check stock, segregation of duties, daily reconciliation, migrating payments to electronic methods.

2. ACH Fraud
- Unauthorized ACH debits: a fraudster who obtains the company's account and routing number originates a debit against the account.
- Account takeover (ATO): criminals gain online banking credentials and originate fraudulent ACH credits or change payment templates.
- Diverted ACH credits: often the result of BEC, where a vendor's or employee's bank account information is changed to a criminal-controlled account.
Primary controls: ACH debit blocks, ACH debit filters (also called ACH positive pay), Universal Payment Identification Codes (UPICs), multi-factor authentication, dual control on template changes, daily monitoring. Under NACHA rules, a corporate (non-consumer) account must return an unauthorized debit within two banking days of settlement, while a consumer has 60 days from the statement date under Regulation E.

3. Wire Transfer Fraud
Wires are high-value, irrevocable, and settle in near real time, making them the preferred payout channel for BEC criminals. Wire fraud typically occurs through social engineering (an employee is tricked into sending a legitimate-looking wire) or through account takeover (credentials are stolen and a wire is initiated by the criminal). Because wires are final once credited, recovery depends on speed; the FBI's Financial Fraud Kill Chain can help recover international wires over $50,000 if reported within 72 hours. Primary controls: dual authorization, callback verification, payment limits, token-based or biometric authentication, dedicated payment workstations.

4. Card Fraud
- Card-not-present (CNP) fraud: stolen card data used online or by phone; the fastest-growing card fraud type following EMV chip adoption.
- Counterfeit/skimmed cards: magnetic stripe data captured by skimming devices.
- Lost or stolen cards and account takeover of cardholder accounts.
- Commercial card misuse: employee abuse of purchasing or travel cards.
Primary controls: EMV chip, tokenization, virtual (single-use) card numbers, merchant category code (MCC) restrictions, spending limits, PCI DSS compliance for merchants, transaction monitoring.

5. Account Takeover and Credential Theft
Criminals use phishing, malware, keyloggers, or credential stuffing to gain access to online banking or ERP systems, then initiate payments, add payees, or alter standing instructions. Controls: multi-factor authentication, out-of-band confirmation, IP whitelisting, dedicated computers for banking, prompt removal of departed employees' access, behavioral monitoring.

6. Internal Fraud
Embezzlement, fictitious vendors, ghost employees, lapping of receivables, and unauthorized disbursements. Controls: segregation of duties (initiation, approval, release, and reconciliation performed by different people), mandatory vacations, job rotation, independent vendor master file maintenance, surprise audits, whistleblower hotlines.

7. Identity and Synthetic Identity Fraud
Use of stolen or fabricated identities to open accounts or obtain credit. Relevant to treasury mainly through vendor onboarding and know-your-customer processes.

8. Ransomware and Data Breach
While not payment fraud in the narrow sense, ransomware and data breaches are frequently tested alongside payment fraud because they expose bank account data, vendor files, and credentials that enable later fraud.

Business Email Compromise (BEC): What It Is

Business email compromise is a sophisticated social engineering scam in which a criminal impersonates a trusted party, typically an executive, a vendor, an attorney, or an employee, via email in order to induce a legitimate employee to send a payment or sensitive data to a criminal-controlled destination. BEC is also called CEO fraud, imposter fraud, or email account compromise (EAC) when the attacker uses a genuinely hacked mailbox rather than a spoofed one.

Key characteristics:
- It targets people and processes, not technical vulnerabilities in the payment system itself.
- The resulting payment is authorized by the company's own employee, which means the bank has generally followed its security procedures and the loss falls on the company under UCC Article 4A.
- Payouts are usually by wire or ACH to domestic 'money mule' accounts, then moved rapidly offshore or converted to cryptocurrency.

The Five Classic BEC Variants
1. CEO or executive impersonation: an urgent, confidential request from the 'CEO' to wire funds for an acquisition or deal, often sent while the executive is traveling.
2. Vendor or supplier invoice fraud (bogus invoice scheme): a fraudster impersonates a known supplier and requests that remittances be sent to 'new' bank account details. This is the most costly variant.
3. Attorney impersonation: a supposed lawyer demands immediate, secret payment related to litigation or a transaction.
4. Payroll diversion: an 'employee' asks HR or payroll to change direct deposit information.
5. Data theft: requests to HR or finance for W-2 forms, employee personal data, or customer lists, which are then used in further fraud.

How BEC Works: The Attack Lifecycle

Step 1 - Reconnaissance. Attackers research the target using LinkedIn, corporate websites, press releases, and social media to learn who approves payments, who the major vendors are, and when executives travel.
Step 2 - Gaining access or establishing a disguise. The criminal either (a) compromises a real mailbox through phishing or credential theft, (b) registers a look-alike domain (for example, replacing 'rn' with 'm' or adding a letter), or (c) spoofs the display name so the email appears to come from a trusted person.
Step 3 - Monitoring and timing. In compromised-mailbox attacks, criminals may lurk for weeks, setting up auto-forwarding rules, learning invoice cycles, and waiting for a large payment to come due.
Step 4 - The lure. The fraudulent request arrives, typically featuring urgency ('must go out today'), secrecy ('do not discuss with anyone'), authority (from a senior person), and a plausible business reason. Vendor variants include a realistic invoice and new banking details on company letterhead.
Step 5 - Execution. An employee updates the vendor master file or initiates a wire. Because the employee is authorized and the bank's security procedure (passwords, tokens, dual approval) is satisfied, the payment is processed normally.
Step 6 - Laundering. Funds land in a mule account and are dispersed within hours, frequently across borders, making recovery difficult.

BEC Red Flags
- Requests to change payment instructions or bank account details, especially by email alone.
- Pressure for speed and confidentiality.
- Email addresses that differ subtly from the real domain, or reply-to addresses that do not match the sender.
- Requests that bypass normal procedures or arrive outside normal business hours.
- Changes in tone, grammar, or formatting from the supposed sender.
- Vendor requests to send payment to a bank in a different country or to an account name that does not match the vendor name.

Controls Against BEC
- Out-of-band callback verification: confirm any payment instruction change by telephone using a number from the existing vendor master file or prior contract, never a number supplied in the suspicious email.
- Dual control and segregation of duties for vendor master changes and payment release.
- Email authentication protocols: SPF, DKIM, and DMARC to reduce spoofing; external-sender banners; blocking of look-alike domains.
- Multi-factor authentication on email and banking platforms; disabling or monitoring auto-forwarding rules.
- Employee awareness training and simulated phishing exercises.
- Payment policies that prohibit changes to bank details based solely on email, impose waiting periods, and require executive requests to go through formal workflow rather than email.
- Bank-side tools: account validation services, payee name matching, and beneficiary verification.
- Insurance: crime or fidelity policies and cyber policies, though many standard crime policies exclude 'voluntary parting' with funds, so a specific social engineering endorsement is often required.
- Incident response plan: immediately contact the originating bank to request a recall, notify the beneficiary bank, file with the FBI IC3, and preserve evidence.

The Legal and Regulatory Framework for Loss Allocation

The CTP exam frequently tests who bears a fraud loss. Key rules:

UCC Articles 3 and 4 (checks): A bank may charge a customer's account only for items that are 'properly payable.' A check with a forged drawer signature is not properly payable, so the bank generally bears the loss, unless the customer's negligence contributed (UCC 3-406) or the customer failed to review statements and report the forgery promptly (UCC 4-406, with a one-year outside limit and a shorter window, often 30 days, for repeat forgeries by the same wrongdoer). Forged endorsement losses generally fall on the depositary bank. Account agreements commonly shift risk to customers who decline positive pay.

UCC Article 4A (wires and commercial ACH credits): If the bank and customer agreed on a commercially reasonable security procedure and the bank accepted the payment order in good faith and in compliance with that procedure, the order is effective against the customer even if it was unauthorized. This is why BEC and account takeover losses usually fall on the company. If the bank did not follow the procedure, the bank bears the loss.

Regulation E (consumer electronic fund transfers): Protects consumers, not businesses. Consumer liability is limited to $50 if reported within 2 business days, $500 if reported within 60 days, and potentially unlimited after 60 days from the statement. Businesses rely instead on NACHA rules and account agreements.

NACHA Operating Rules: Corporate receivers must return unauthorized debits within two banking days; originators warrant that entries are authorized; NACHA requires originators of WEB debits to use commercially reasonable fraudulent transaction detection, including account validation.

Check 21 and Regulation CC: Govern substitute checks and funds availability, relevant to remote deposit capture fraud and duplicate presentment.

Comparison of Key Bank Fraud Control Services

- Positive pay: Company transmits an issue file (check number, amount, date); the bank compares presented checks and reports exceptions for pay/return decisions. Catches counterfeit checks and altered amounts.
- Payee positive pay: Adds the payee name to the match, catching altered payee names, the classic check washing attack.
- Reverse positive pay: The bank sends the company a list of presented checks and the company performs the matching. Lower cost but places more burden and risk on the company, with a short decision window.
- ACH debit block: Prevents all ACH debits from posting to the account. Ideal for accounts that should receive only credits or that are used solely for check disbursement.
- ACH debit filter (ACH positive pay): Allows only pre-authorized originators, often with dollar limits, to debit the account; others are returned or presented for decision.
- UPIC: A masking identifier that lets a company receive ACH credits without disclosing its actual account number; it cannot be used for debits.
- Virtual cards: Single-use or limited-use card numbers tied to a specific supplier and amount, eliminating exposure of the master account number.

How to Answer Exam Questions on This Topic

CTP questions on payment fraud generally fall into four patterns:

Pattern 1 - Identify the fraud type from a scenario. Read for the payment instrument and the method. A changed payee name on an intercepted check is check alteration; an email from a supplier asking to update remittance details is vendor impersonation BEC; an unknown company pulling funds from the account is an unauthorized ACH debit; stolen login credentials used to create new wire templates is account takeover.

Pattern 2 - Select the best control. Match the control to the instrument and the specific weakness. Positive pay does nothing for ACH; ACH debit blocks do nothing for checks or wires; dual approval inside the bank portal does not stop BEC if both approvers believe the request is legitimate, whereas callback verification to a known number does. When two answers seem correct, choose the one that addresses the root cause described in the scenario.

Pattern 3 - Allocate the loss. Ask three questions: Which law governs (UCC 3/4 for checks, 4A for wires and corporate ACH credits, Reg E for consumers)? Did the bank follow a commercially reasonable security procedure? Was the customer negligent or late in reporting? For BEC, the standard exam answer is that the company bears the loss because the payment was authorized by its employee and the bank followed procedures.

Pattern 4 - Recall a fact or timeframe. Memorize: corporate ACH return window is 2 banking days; consumer Reg E window is 60 days; Reg E consumer liability tiers are $50/$500/unlimited; UCC 4-406 one-year outside limit; FBI Financial Fraud Kill Chain targets international wires over $50,000 reported within 72 hours.

Exam Tips: Answering Questions on Payment Fraud Types and Business Email Compromise

1. Checks are still the most-targeted instrument in AFP survey data, even though BEC produces the largest dollar losses. Do not assume electronic payments are the most frequently attacked.
2. BEC is a people problem, not a system breach. If a question asks for the most effective BEC control, favor process and verification answers (callback to a known number, dual approval of vendor master changes, training) over purely technical answers like firewalls or encryption.
3. Never verify using contact details in the suspicious email. Any answer choice that confirms by replying to the email or calling the number in the email is a distractor.
4. Know the positive pay family cold. Positive pay = bank matches against the issue file; payee positive pay = adds payee name; reverse positive pay = company does the matching. If the scenario involves a washed check with a new payee name, only payee positive pay is the correct answer.
5. Block versus filter. A block stops all ACH debits; a filter permits approved originators. If the account must pay a utility or tax authority by ACH debit, the answer is a filter, not a block.
6. Reg E is for consumers only. If the scenario involves a business account, eliminate Reg E and look for UCC 4A or NACHA rules.
7. Commercially reasonable security procedure is the magic phrase in UCC 4A questions. If the bank followed it in good faith, the customer bears the loss even for an unauthorized order.
8. Speed is the recovery control for wires. The correct first response to a discovered fraudulent wire is to contact the originating bank immediately to request recall and beneficiary bank freeze, then notify law enforcement.
9. Segregation of duties is the universal internal control answer: initiation, approval, release, and reconciliation should be separate people. If a question describes one person doing two of these, that is the control weakness.
10. Insurance is a last resort, not a control. If asked for a preventive measure, insurance is a distractor; if asked for risk transfer, note that many crime policies require a specific social engineering endorsement to cover BEC.
11. Watch for 'authorized versus unauthorized.' Fraud that the company's own employee authorized under deception (BEC) is treated very differently from fraud involving forged signatures or stolen credentials. Exam writers use this distinction to test your understanding of loss allocation.
12. Read for urgency and secrecy cues. In scenario questions, phrases like 'confidential acquisition,' 'CEO traveling,' 'must be sent before close of business,' or 'new bank account' are deliberate signals that the question is about BEC.

Sample Practice Questions

Question 1: A company's accounts payable clerk receives an email that appears to come from a long-standing supplier stating that the supplier has changed banks and providing new remittance instructions. Which control is MOST effective at preventing a loss?
A. Positive pay
B. ACH debit block
C. Callback to the supplier using a phone number from the existing vendor master file
D. Replying to the email to confirm the change
Answer: C. This is vendor impersonation BEC. Positive pay and ACH blocks address other instruments; replying to the email confirms with the fraudster.

Question 2: A corporate treasurer discovers a check cleared the account with the payee name chemically altered from the original vendor to an individual. The company uses standard positive pay. Which service would have detected the fraud?
A. Reverse positive pay
B. Payee positive pay
C. ACH debit filter
D. UPIC
Answer: B. Standard positive pay matches check number and amount; only payee positive pay compares the payee name.

Question 3: A company's treasury analyst, whose online banking credentials were phished, is impersonated by a criminal who initiates a $400,000 wire. The bank verified the wire using the agreed token-based dual authentication procedure. Under UCC Article 4A, who is most likely to bear the loss?
A. The bank, because the wire was unauthorized
B. The company, because the bank complied in good faith with a commercially reasonable security procedure
C. The beneficiary bank
D. The Federal Reserve
Answer: B.

Question 4: An unauthorized ACH debit of $25,000 posts to a corporate operating account. By when must the company return the item under NACHA rules to be assured of recovery?
A. Within 60 calendar days
B. Within 2 banking days of settlement
C. Within 10 business days
D. Within one year
Answer: B. The 60-day window applies to consumers under Regulation E.

Summary

Payment fraud spans checks, ACH, wires, cards, and account takeover, and BEC cuts across all of them by exploiting human trust rather than system flaws. For the CTP exam, master four things: the characteristics of each fraud type, the bank and internal controls that specifically mitigate each one, the legal framework (UCC 3/4, UCC 4A, Regulation E, NACHA) that determines who absorbs the loss, and the red flags and verification practices that defeat BEC. Treasury professionals who can connect the scenario to the instrument, the control, and the governing rule will consistently select the correct answer.