| CRBJ Charter Member: |
|
|
| CRBJ Home > April 2006 | ||||||
Protect your businessBy Debra Morrill
He checked with others at the restaurant and discovered his new manager had okayed the order. A sales representative had called, identified himself as the restaurant's regular supplier of tape for the credit card machine, and said it was time to reorder. But the out-of-state company wasn't their regular supplier, and in fact they had never ordered from them before. Roussos and his manager had fallen victim to a "paper pirates" office supply scam. Here's how it works: the scammers will call and obtain the brand and model number of a photocopier, fax machine, or other piece of office equipment. Then in a later call, they'll pretend to be a regular supplier and suggest that it's time to reorder consumables. When the goods arrive, they'll be overpriced and of inferior quality. Or in a variation on this scam, the scammers will call and obtain the name of a purchasing agent or manager, again under false pretenses. The scammer will then send a shipment with an invoice indicating the purchase was authorized by that person, despite the fact that the purchasing agent never even talked to the "supplier." Office supply scams are just one of the schemes unscrupulous companies use to defraud business owners. Another common fraud includes an offer to advertise in a non-existent yellow pages or business directory. "Telephone solicitors often ask if businesses wish to renew ads from last year, leaving the impression the transaction is merely routine," says Glen Loyd, public information officer for the Wisconsin Department of Agriculture, Trade and Consumer Protection. Or a victim receives a rebate check and neglects to read the fine print hidden on the back, and in cashing it, approves the purchase of an unwanted item. Some enterprising scammers don't even bother to send a product, instead sending phony invoices directly to the accounts payable department, hoping they look enough like a real bill that payment will be put through. The majority of these scams rely on the fact that a surprising number of businesses have informal or lax purchasing and accounts payable procedures. "Some of the larger companies have a system for paying bills and they normally catch the rip-offs, but smaller companies might not," Loyd says. Scammers also know they will be successful in a certain number of cases due to basic inattention and the overwork that's so common at large and small businesses today. Some businesses, afraid of being reported to a credit agency, will pay rather than make the effort to untangle the mess, which can be no small time commitment. Roussos spent between five and six hours straightening out the fraud. "It takes time and energy away from running your business," he said. Eyes open Generally speaking, anyone you don't know who approaches you and offers a good or service should be scrutinized closely, Loyd says. "If a company comes to you saying they will help you save money, always check with us before you do business with them." The Wisconsin Department of Agriculture, Trade and Consumer Protection can tell business owners whether a prospective company has ever had a complaint filed against them and advise on things to watch for. The Better Business Bureau of Wisconsin operates a Web site and 24-hour hotline connected to the national Better Business Bureau database. And do pay attention to where a company is located. Many of these scammers are located out of state, according to Randall Hoth, president and CEO of the Better Business Bureau of Wisconsin, and a large number of them are located in either New York, California or Florida. "Not enough people check out a business before they do business with them," Hoth says. "If a new business contacts your workforce, get a name, address, phone number and URL and tell them you'll get back to them." One bold scammer even tried to con the Better Business Bureau itself. Roth says they received a call from someone who said, "I just need to get a serial number and model number off your copier because I'm your new supplier." The first step to protecting your business from scams is education. "Train everyone who might be talking to a supplier or telemarketer on the phone to control the amount of information you share about the business," he says. Under Wisconsin law, any unsolicited merchandise you receive is a gift. "You may keep it without any obligation whatsoever," Loyd says. Secondly, have clearly defined purchasing and accounts payable procedures. Require that all invoices refer to a purchase order number. Set up an approved vendor list and mandate that any invoices from a supplier not on the list be approved by upper management. And of course, if your business does fall victim to a scam, report it to the authorities. "A lot of businesses don't like to share the fact they've been compromised," Hoth says. "Even if they're not willing to go public, their complaint would be helpful to us in putting out a general warning to other businesses. We don't always know what schemes are out there until someone gets victimized." The stickiest fingers Scammers and unscrupulous companies aren't the only sources of fraud against business. Employee theft outstrips retail theft, according to Mary Anne Thurber in the crime prevention office of the Madison Police Department. It's estimated that as many as three-fourths of employees steal from their employers on at least one occasion, according to information provided by the National White Collar Crime Center. Estimated yearly losses from employee theft in the United States reach $75 billion and can go beyond $200 billion when intellectual property theft is factored in. "Most people think about stopping external inventory theft and have quite a few systems in place to prevent that but tend not to think about what's going out the door from their own folks," says Chuck Droege, a manager with the Madison branch of accounting firm Virchow, Krause & Co. "If you're a business owner and you're not thinking about it, it's happening at your company." Droege stresses segregation of duties in limiting employee theft. "Purchasing and receiving are key areas in preventing theft, so you'd never want to have the same person both ordering the goods and receiving the goods," he says. He also advises doing a monthly inventory as a back-end check. "If somebody's stolen something, it's already gone, but it's a way to stop it from becoming a larger amount," he says. The people doing the counting should be different from the people doing the receiving. Analyzing monthly financial data and comparing it against previous months and against known industry standards also helps catch internal theft. One common measure looks at the cost of raw materials or inventory versus sales for the month. "If it shows a blip, that's the key to start doing some investigation," he says. Employees may be stealing from inventory. When it comes to internal theft, though, prevention is always better than trying to catch it after it's happened. "If you establish a positive control environment where everyone knows there are safeguards and they're being monitored, then less fraud tends to happen in the first place," Droege says. Trust but verify Business owners who suspect employee theft or fraud may choose to hire a security or private investigation firm. Making wise hiring decisions helps prevent it from getting that far. Shawn Smith, chief executive officer of Madison-based Midwest Patrol & Investigations stresses the importance of doing background checks when hiring employees. "A lot of employers get themselves in trouble at the get-go by taking at face value everything on the resume," he says. "People embellish on their resume, and people lie on their resume. Let the employer beware. You're responsible for that employee." His mantra? Trust but verify, a Russian proverb most famously uttered by Ronald Reagan. "You're not accusing anyone, you're just verifying," he says. He suggests verifying key facts on the resume, maybe not for entry-level unskilled positions, but certainly for positions of responsibility. "You need to find out if they have a criminal history," he says. "You want to find out if they were fired from previous jobs. And at a minimum, you want to do a pre-employment drug screen." Business owners can hire private detective agencies to do this work, or they can take some basic steps on their own, Smith says. Begin by asking prospective employees to sign a waiver agreeing to pre-employment investigation. Then check their references and call previous employers. Ask for certified transcripts to verify any post-secondary education listed. It gets a little trickier when investigating criminal history, Smith says. In Wisconsin, the Circuit Court Access system (at www.wcca.wicourts.gov) provides information about all court cases in the state, including criminal and civil cases. But beware that names that are similar will return hits that might not be the person you're investigating. Searching on Bill Smith, for instance, returns 384 hits. And right on the home page for the system, it warns that "it may be a violation of state law to discriminate against a job applicant because of an arrest or conviction record. Generally speaking, an employer may refuse to hire an applicant on the basis of a conviction only if the circumstances of the conviction substantially relate to the particular job." Smith believes it's particularly important to run background checks on employees who have access to customer credit card numbers. "It's incredibly easy to steal information. You need someone honest running the numbers," he says. Identity crises A growing concern for companies is becoming an unwitting accomplice to identity theft. While many businesses are most fearful for the security of their client records and customer lists, payroll records are more often taken, says Peter Marshall, CEO of The Identity Guardian, a California company that provides identity theft protection programs to companies as employee benefits. Companies don't realize how much they pass people's information around. "Many companies have 50 to 100 service providers," he said, who handle 401(k)s, pensions, health insurance. Companies should designate a point person to go through an external service provider list and identify points of exposure. He suggests having vendors sign service agreements requiring they follow federal requirements for "reasonable safeguards," and encouraging vendors to carry enterprise ID theft liability insurance. Your company also should have a policy that matches the level of risk your organization faces, he says. Expanding universe The Internet's ever-expanding universe of high-tech fraud can make paranoids of us all. It's hard enough to keep up with the vocabulary of cybercrime -- botnets, pharming, phishing, click fraud, etc. -- let alone feel fully protected. The media buzz with the latest threat; at the moment it's keylogging programs that actually pick up passwords as users type them in. Beyond getting protection software from companies such as Cisco, ISS, or Symantec, a company can hire a tech security firm such as Madison-based Inacom Information Systems or Berbee to do a white knight vulnerability assessment, which entails learning everything about your systems, your company and your people to see how hackers could get in. "We call that footprinting," says Inacom's Nicholas Morris. Security firms can help with questions such as whether you should store credit card information, which may be vulnerable to hackers, how to store and protect log-in histories to see who has accessed the system, and password protection. One thing that helps in choosing a security expert is certification from Illinois-based ISACA certification or credentials from Florida-based ISC2. Cisco and Microsoft also offer vendor-specific certification. An assessment will also look at the access and control policies in place for employees, Morris says. "No matter what security we put around data, if people are given access to it without thought, it won't do you any good," he points out. Defining an access and control policy will help ensure that only users who really need the information will have access. Documenting who has access will help down the road as people leave the company -- if you don't have a record you gave it to them, you may not have any clue where a hit is coming from. Because scammers are amazingly inventive, having trained, competent managers is key, Smith says. "Someone in a position of trust has to be watching the store," he says. Vigilance is also important. "The smartest thing you can do as a business person is to know who you're doing business with," the Madison Police's Thurber says. "And that's a function of protecting your property and your professional reputation." debramorrill@yahoo.com madison.com ©2009 Capital Newspapers. All rights reserved. |
|
|||||
