FRAUD PREVENTION
Fraud Prevention
Commercial Fraud in Focus: How We Protect You
5 minute read time
Video Timestamps:
00:00 – 01:46: Common Fraud Pressure Tactics
01:47 – 04:56: How to Recognize Scams
04:57 – 07:03: How We Protect Our Clients
07:04 – 07:50: What to Do If You Suspect Fraud
07:51 – 15:53: Emerging Threats and How to Prepare
15:54 – 16:49: Fraud and Internal Control Takeaways
Fraud is shifting fast but awareness is your first line of defense. In the second video of our three-part Commercial Fraud in Focus series, Chief Information Security Officer, Mark Ward and Bushra Latif, VP and Bank Fraud Program Manager, shift from what the threats are to how to use internal controls to stop them. They discuss the practical defenses, from ACH and check blocking to real-time fraud monitoring, and concrete steps to protect your business.
Watch the full video and share the key takeaways to put your team ahead of fraud. Then stay tuned for Part 3, where we cover the emerging threats on the horizon that many businesses haven’t even heard of yet.
5 Key Takeaways
1. Fraudsters target people first, not technology
Technology controls are designed to stop attacks on technology but fraudsters start by targeting people. They manufacture urgency and borrow the credibility of familiar names (your bank, a government agency) to get you to hand over multi-factor authentication (MFA) codes or approve unauthorized actions before you can think clearly.
2. Layered controls catch fraud at every stage
ACH and check blocking, positive pay with payee-name matching, dual control for transaction approval, IP whitelisting and real-time fraud monitoring work together to stop unauthorized transactions before money moves.
3. Emerging threats are already here
AI prompt injection, bring-your-own-AI data leakage, deepfakes, device code scams, consent grant attacks and ClickFix are trending up now and expected to accelerate in 2027. The good news: For each one, there are concrete steps your organization can take today to protect itself from approving a shortlist of sanctioned AI tools to prevent data leakage to building verification into payment workflows so a deepfake voice or video alone can't authorize a transaction.
4. What you see and hear is no longer proof
Real-time deepfakes can swap faces and voices at 30 frames per second and device code scams use genuine Microsoft and Google login pages so real credentials and real MFA codes won't catch them. The threat landscape has moved past verify with your eyes and ears; your verification process needs to catch up.
5. Turn off the convenience defaults attackers exploit
Device code and consent grant settings in Microsoft and Google environments are typically on by default for convenience and attackers count on it. Review those settings, restrict which applications users can authorize and ensure your team only uses approved AI tools to avoid leaking corporate data.
Technology alone won't stop fraud because fraudsters target people, not systems. The most powerful defense is awareness — the habit of pausing, verifying through a trusted channel and reporting suspicious activity immediately. Educate your team and enable the controls available to you to ensure you’re one step ahead.
In the final video of the Commercial Fraud in Focus series, we'll look ahead to what's coming in 2027 and what your business should be doing now to prepare.
Frequently Asked Questions
The most effective internal controls to prevent fraud combine banking-level payment protections with strict internal approval workflows so no single person or compromised credential can move money alone. Rather than relying on a single barrier, your company should use layered defenses that catch unauthorized activity at different stages:
- Dual control for transaction approval: Requiring two separate people to initiate and approve wire or ACH transfers stops a single compromised account or tricked employee from sending funds.
- Positive pay with payee-name matching: Automatically comparing presented checks against your issued-check file catches altered dollar amounts and forged payee names before the money clears.
- ACH and check blocking: Placing blocks or filters on accounts prevents unauthorized debit activity before money ever leaves your account.
- IP whitelisting and real-time monitoring: Restricting banking portal access to approved company networks and flagging unusual login or payment behavior helps your team spot anomalies right away.
Updating your internal controls for AI-driven fraud requires moving past verify with your eyes and ears and locking down default software settings that attackers exploit. Real-time deepfake software can now swap faces and voices at 30 frames per second during live video or phone calls, making visual or voice recognition unreliable for authorizing payments. To protect your company against these evolving threats, you can put four concrete controls in place today:
- Require out-of-band, dual-person verification: Never rely on a single phone call, video chat or email to change payment instructions or approve a transfer. Require a second approver and verify requests through an established portal or known phone number.
- Turn off convenience defaults in Microsoft and Google: Device code authentication and third-party application consent grants are typically turned on by default. Have your IT team disable device code flows and restrict which applications employees can authorize.
- Establish an approved AI policy: Prevent "bring-your-own-AI" data leakage and AI prompt injection by restricting staff to company-approved AI tools and blocking sensitive financial data from public models.
- Train staff on modern lures like ClickFix: Educate your team to recognize fake error prompts that ask users to copy and paste commands into their computers and reinforce the habit of reporting suspicious activity immediately.
Johnson Financial Group partners with your company to layer bank-side treasury protections directly onto your internal accounting and IT workflows. Our advisors work with you to configure automated defenses, including Positive Pay with payee-name matching, ACH debit blocks and filters, dual-control requirements and IP whitelisting, while backed by real-time bank fraud monitoring. If your team ever suspects fraudulent activity or an imposter scam, contacting your Johnson Financial Group advisor immediately allows our fraud team to lock down access, intercept pending transactions and help your company respond before money moves.
View More Videos
1 of
3