As a small-business owner, do you regularly pull out your business debit card to pick up office supplies, purchase new equipment or buy plane tickets for business trips? If so, you might be at risk for high-dollar fraud.
Christie Summervill, CEO of Wichita, Kan.-based consulting firm BalancedComp, learned that the hard way in January when a thief racked up $15,752 in fraudulent charges on her business debit card. All of the purchases were made online and at stores in Texas during five days.
“I was not anywhere near Texas, and hadn't been for a couple of years,” says Summervill, who adds that she has no idea when the thief could have gotten access to her card information: “The card was never out of my hand.”
Summervill believes the fraudster created a copy of her card and used it to make purchases that ranged from $189 at a small Mexican meat market to thousands of dollars at an Apple store, Home Depot and CVS.
“That's called cloning,” says identity theft expert Robert Siciliano, noting that making a copy of a card allows thieves to swipe the card and make purchases that look legitimate.
A BalancedComp employee eventually spotted the suspicious charges and called the credit union where the company banks, but by that time a large chunk of cash already had been siphoned from the business checking account. Summervill immediately filed a police report and filled out credit union paperwork detailing the fraudulent charges.
In one way, she was fortunate: The credit union replaced the stolen money within 48 hours. “The credit union was fantastic about getting the money back to me,” she says.
However, some business owners aren't so lucky. That's because businesses are not covered under the federal law that requires banks to reimburse consumers who get money stolen from their accounts, according to Susan Stawick, a Federal Reserve spokeswoman.
But some institutions do replace funds stolen from business accounts. For example, Meriwest Credit Union deals with unauthorized debit card transactions on business accounts in much the same way they handle those on consumer accounts, says Greg Meyer, community relations manager for Meriwest. “But not all credit unions will do this for their members,” Meyer says.
Even if the institution does reimburse money lost to unauthorized debit card purchases, the onus is on the business owner to prove that fraud happened. “Banks tend to not believe the victims, especially if it's a business,” Siciliano says, adding that banks sometimes will suspect an employee of the business stole the money.
He says: “Businesses could spend months or years fighting to get that money back and even end up hiring lawyers.”
However, there are steps you can take to avoid business debit card fraud or, if it does happen, increase your chances of getting reimbursed. Here are six tips:
- Use your business credit card for purchases. “Your best bet is to use a credit card,” Siciliano says. Federal law limits cardholder liability to $50 for unauthorized use of both consumer and business credit cards, Stawick says. Also, card networks, such as Visa and MasterCard, typically offer $0 liability on business cards. If fraud happens, the card issuer will remove unauthorized charges right away, then investigate, Siciliano says.
- Use your business debit card only for deposits and withdrawals. Get a business debit card without a Visa or MasterCard symbol so it can't be run as a credit card, Siciliano recommends. Then use the card only for making ATM deposits and occasional cash withdrawals when necessary, he says. That's because your debit card number and PIN can easily be stolen when you swipe it at a store, gas pump or even ATM onto which a thief has installed a skimmer, he says. “Then, it's cash right out of your bank account,” he says. And, businesses tend to keep more money in their checking accounts than consumers do, making the stakes higher, Meyer says.
- Don't rely on the bank to flag suspicious purchases. Credit unions and banks have what is called “anomaly detection,” meaning they look for charges that appear unusual for you, Siciliano says. But don't assume that means they'll catch fraud right away, he says. It's important to monitor your account weekly or even daily, he says: “The quicker you discover fraud, the better chance you have of getting the money put back in the account.”
- Put multiple levels of protection in place. You have a better chance of catching fraud fast if more than one person checks your accounts regularly for suspicious charges, Siciliano says. Employees charged with this task should communicate regularly, comparing notes to make sure charges are legitimate. Also, set alerts to be notified immediately by email or text about certain charges — for example, a card-not-present transaction or purchases over a certain dollar amount, Siciliano says. “It can be inconvenient, but those multiple layers of protection are ultimately what's going to keep your money in the bank.”
- Limit employee access to your cards. “The tighter reins you have on financials and who has access to credit within the company, the better,” Siciliano says.
- Have a relationship with your financial institution. In cases where you have to convince a bank that your business was actually a victim of fraud, relationships matter. In fact, Summervill is convinced that's partly why she got her money back with no hassle: “They know me,” she says of her credit union. “It isn't like they have a million customers and they're all just numbers.” At a credit union, “there's more of a relationship between credit unions and small businesses.”
The bottom line: Stay vigilant. “Going after small business bank accounts is pretty lucrative for the bad guys,” Siciliano says. “And it goes beyond debit and credit cards.”