Reference

The vocabulary of business payment fraud

Coffr maintains 19 definitions covering how business payments are made, how that exchange is exploited, and what the law does after the money is gone. Open a term for its explanation, practical context, common questions and sources.

Fraud methods

Business email compromise: Business email compromise is a fraud in which an attacker uses a real or spoofed business email account to convince someone with payment authority to send funds or change bank details for a legitimate obligation.
Vendor impersonation fraud: Vendor impersonation fraud is an attack in which a criminal poses as an existing supplier and submits new banking details so that legitimate invoice payments are redirected to an account they control.
Account takeover: Account takeover is unauthorized control of a legitimate account, such as an online banking profile or a business mailbox, which the attacker then uses to move money or manipulate payment instructions from inside a trusted identity.
Check fraud: Check fraud is the theft, alteration, forgery, or counterfeiting of a paper check in order to obtain funds from the account it draws on.
Authorized push payment fraud: Authorized push payment fraud is any scam in which the victim is deceived into personally instructing a payment to an account controlled by a criminal, meaning the transfer is technically authorized and therefore rarely reversible.

Payment rails

Wire transfer: A wire transfer is a real time, credit push transfer of funds between banks that settles with finality, meaning it cannot be unilaterally reversed once the receiving bank accepts it.
ACH: ACH is the batch based Automated Clearing House network used in the United States for direct deposits, vendor payments, and recurring debits, governed by the Nacha operating rules.
RTP and FedNow: RTP and FedNow are the two United States instant payment rails that settle credit transfers in seconds, around the clock, with immediate finality for the receiving party.

Controls

Callback verification: Callback verification is the control of confirming a payment instruction or a bank detail change by telephoning the counterparty on a number already held on file, never a number supplied in the request itself.
Out of band verification: Out of band verification confirms a request over a channel entirely separate from the one that carried it, so that compromise of a single channel cannot both make and confirm the request.
Positive pay: Positive pay is a bank service in which the company sends the bank a file of issued payments so the bank can reject any item that does not match, most commonly used for checks and increasingly for ACH debits.
Bank account validation: Bank account validation is the process of confirming that a bank account exists, is open, and belongs to the party expected to own it, before that account is used to receive funds.
Vendor master data: Vendor master data is the stored record of each supplier, including legal name, tax identifier, contacts, and remittance bank details, that a payment system reads when it pays an invoice.
Segregation of duties: Segregation of duties is the control principle that no single person can both create and approve a payment or a change to payment data, so that one compromised or coerced individual cannot complete a fraudulent transaction alone.
Immutable ledger: An immutable ledger is a digital record that, once an entry is written, cannot be edited or deleted, so the history of what was recorded and when stays provably intact.

Regulation and recovery

UCC Article 4A: UCC Article 4A is the body of United States commercial law that governs funds transfers between businesses and allocates loss from unauthorized payment orders based on whether a commercially reasonable security procedure was agreed and followed.
Regulation E: Regulation E implements the Electronic Fund Transfer Act and gives consumers, not businesses, defined error resolution rights and liability limits for unauthorized electronic fund transfers from their accounts.
Suspicious activity report: A suspicious activity report is a confidential filing that financial institutions submit to FinCEN when a transaction is suspected to involve fraud or other illicit activity, under the Bank Secrecy Act.
Recovery Asset Team: The Recovery Asset Team is the FBI IC3 unit that coordinates with receiving financial institutions to freeze funds from fraudulent domestic wire transfers reported quickly enough to intervene.

These definitions sit underneath our longer work. Read the research in Blog or the cited dataset behind our loss estimates in the BEC and wire fraud loss index.

Fraud methods

Payment rails

Controls

Regulation and recovery

Disclosures