12.1 Treasury Fraud Vectors: Check Fraud, Business Email Compromise & ACH Tampering

12.1 Treasury Fraud Vectors: Check Fraud, Business Email Compromise & ACH Tampering

Executive Summary: Treasury operations handle the financial lifeblood of the enterprise, making them the primary target for sophisticated external cybercriminals and dishonest internal actors. Understanding the specific mechanics of payment fraud vectors—spanning physical check alterations, Business Email Compromise (BEC), and automated clearinghouse (ACH) batch tampering—is essential for implementing effective preventative controls and managing statutory liabilities under the Uniform Commercial Code (UCC).

---

The Corporate Payments Fraud Landscape

Corporate treasury departments manage billions of dollars in daily cash flows across diverse payment rails. This immense concentration of liquidity makes treasury systems high-value targets for financial crime.

Key Findings from the AFP Payments Fraud and Control Survey

The Association for Financial Professionals (AFP) Payments Fraud and Control Survey provides annual benchmarking on the prevalence, vectors, and financial impacts of treasury fraud across corporations:

• High Attack Prevalence: Typically 65% to 75% of surveyed organizations report experiencing actual or attempted payments fraud in any given year.
• Check Vulnerability: Despite declining check transaction volumes nationwide, paper checks remain the payment method most frequently targeted by fraudsters (over 60% of impacted organizations report check fraud attempts). The open disclosure of bank routing transit numbers (RTN) and demand deposit account (DDA) numbers on physical check MICR lines creates persistent systemic vulnerability.
• High Dollar Severity in Electronic Rails: While checks experience the highest frequency of attacks, wire transfers and commercial ACH credits represent the largest individual dollar losses per occurrence, largely driven by social engineering and corporate credential theft.
• Dominance of Social Engineering: Business Email Compromise (BEC) and vendor impersonation scams consistently represent the primary catalyst for illicit electronic disbursements.

Payment Rail Fraud Profile:
┌──────────────────────┬────────────────────────┬─────────────────────────┐
│ Payment Method       │ Attack Frequency       │ Financial Loss Severity │
├──────────────────────┼────────────────────────┼─────────────────────────┤
│ Paper Checks         │ Highest (~65% of orgs) │ Moderate ($10k - $100k) │
│ Wire Transfers       │ Moderate (~30% of orgs)│ Extreme ($500k - $10M+) │
│ Corporate ACH Credits│ Moderate (~30% of orgs)│ High ($100k - $2M+)     │
│ Corporate ACH Debits │ Low-Moderate (~20%)    │ Low-Moderate (<$50k)    │
│ Commercial Cards     │ Moderate (~35% of orgs)│ Low (Strict zero-liab.) │
└──────────────────────┴────────────────────────┴─────────────────────────┘

---

Primary Payment Fraud Vectors

Corporate treasury practitioners must analyze fraud vulnerabilities across physical, electronic, and human attack surfaces.

                                  Corporate Treasury Fraud Vectors
                                                 │
         ┌──────────────────────────────┬────────┴────────────────────────┬─────────────────────────┐
         ▼                              ▼                                 ▼                         ▼
    Check Fraud            Business Email Compromise (BEC)       ACH & Wire Tampering        Internal / Employee Fraud
  • Check Washing            • Executive Impersonation (CEO)       • Unauthorized ACH Debits   • Ghost Vendors in MVF
  • Signature Forgery        • Vendor Bank Change Requests         • Payroll Direct Deposit    • Structuring Under Limits
  • Counterfeit MICR         • Mailbox Takeover / Forwarding         Hijacking                 • Collusion & Lapping
  • Rogue Internal Stock     • Lookalike Spoofed Domains           • NACHA Batch File Edits    • Unapproved Account Openings

1. Physical Check Fraud

Physical checks contain static, unencrypted banking credentials printed directly on the face of the instrument in Magnetic Ink Character Recognition (MICR) format, exposing organizations to several distinct attack types:

• Check Washing: Criminals intercept physical checks from corporate mailboxes or postal collection points and apply chemical solvents (such as acetone, brake fluid, or bleach) to dissolve handwritten or printed ink in the payee and dollar amount fields while leaving the legitimate drawer signature intact. The check is then re-written to a fraudulent payee for an inflated amount.
• Check Forgery: An unauthorized individual signs the drawer's name on a legitimate corporate check blank, attempting to replicate an authorized signature on file with the financial institution.
• Counterfeit Checks: Fraudsters capture the drawer's routing number, account number, corporate logo, and check numbering sequence from a single negotiated check. Using off-the-shelf desktop publishing software, MICR toner, and blank safety check paper, they fabricate thousands of fraudulent checks drawn against the victim company's account.
• Payee Alteration: Modifying only the payee line of an authentic check (e.g., adding "and Associates" or "John Doe c/o" above the corporate vendor name) to allow the fraudster to deposit the item into an illicit account without modifying the numerical dollar amount.
• Rogue Internal Check Stock Theft: Compromise of physical check stock, MICR printer signature keys, or check-writing software by internal personnel or unauthorized office visitors.

2. Business Email Compromise (BEC) & Social Engineering

Business Email Compromise (BEC) is a sophisticated form of spear-phishing that targets individuals who have the authority to initiate or approve financial payments. Unlike automated malware, BEC relies entirely on social engineering and psychological manipulation:

• Lookalike Domain Spoofing (Typosquatting): Fraudsters register internet domains that visually mimic legitimate corporate or vendor domains (e.g., substituting @acnne-corp.com for @acme-corp.com, or @supplier-inc.co for @supplier-inc.com) to send deceptive payment instructions to Accounts Payable (AP) staff.
• Account Takeover (ATO) / Mailbox Compromise: Attackers steal legitimate employee or vendor email credentials via phishing or credential stuffing. Once inside the mailbox, the attacker monitors ongoing transactions, studies communication patterns, and sets up silent inbox forwarding rules to hide their fraudulent correspondence.
• Executive Impersonation (CEO Fraud): The attacker poses as the Chief Executive Officer, Chief Financial Officer, or General Counsel, contacting a mid-level treasury analyst with an urgent, "strictly confidential" request to wire funds for an emergency foreign acquisition, regulatory settlement, or tax payment, explicitly ordering the analyst to bypass standard approval channels.
• Vendor Impersonation / Bank Detail Change Scams: The fraudster poses as an established supplier with outstanding legitimate invoices. The attacker sends official-looking correspondence (often on authentic supplier letterhead) stating that due to an internal bank transition or audit, all upcoming ACH/wire remittances must be redirected to a new beneficiary bank and account number.

3. Electronic ACH and Wire Fraud

Automated Clearing House (ACH) and real-time gross settlement (RTGS / Fedwire) systems process massive volumes of corporate disbursements:

• Unauthorized ACH Debits: Outside entities use a company's publicly exposed routing and account numbers to originate unauthorized ACH direct debits against corporate checking accounts, masquerading as commercial utility payments, merchant settlements, or loan repayments.
• Payroll Direct Deposit Hijacking: Fraudsters execute targeted phishing campaigns against corporate employees to compromise Human Resources Information System (HRIS) or self-service payroll login credentials. Once authenticated, the attacker changes the employee's direct deposit routing details to a prepaid debit card or digital money mule account immediately prior to payroll cutoff.
• Malicious Payment File Tampering: Unencrypted payment batch files (such as NACHA formatted files, CSV files, or flat files) sitting on local network shared drives are intercepted and edited prior to upload to the corporate banking portal, substituting the fraudster's account numbers for legitimate vendor accounts.

4. Internal and Employee Fraud

Internal fraud occurs when employees leverage their privileged operational access, operational familiarity, or administrative control to misappropriate corporate funds:

• Ghost Vendors in the Master Vendor File (MVF): An employee with administrative access to the Enterprise Resource Planning (ERP) vendor database creates a fictitious vendor entity. The employee then enters fake invoices, approves the payments, and directs the disbursements to a personal bank account or shell company.
• Payment Structuring / Smurfing Under Approval Thresholds: An internal maker intentionally splits a single large disbursement (e.g., $150,000) into two smaller payments of $75,000 to circumvent a mandatory $100,000 dual-authorization threshold.
• Skimming and Lapping: The theft of incoming customer payments (checks or cash) before they are recorded in the accounting system. In a lapping scheme, the perpetrator conceals the missing funds from Customer A by applying subsequent receipts from Customer B to Customer A's account, creating a continuous, compounding cycle of fraudulent accounting entries.

---

Legal Liabilities and the Uniform Commercial Code (UCC)

Corporate treasury practitioners must understand the statutory allocation of loss for fraudulent transactions established by the Uniform Commercial Code (UCC), as adopted across U.S. state jurisdictions.

                      Uniform Commercial Code (UCC) Payment Framework
                                            │
            ┌───────────────────────────────┴───────────────────────────────┐
            ▼                                                               ▼
    UCC Articles 3 & 4                                               UCC Article 4A
  • Physical Checks & Negotiable Instruments                       • Wholesale Funds Transfers (Wires & Commercial ACH)
  • Forged Signatures vs. Altered Payees                           • Authorized vs. Verified Payment Orders
  • Strict Bank Liability vs. Comparative Negligence              • Commercially Reasonable Security Procedures
  • Ordinary Care & Notice Deadlines (UCC § 4-406)                 • Safe Harbor & Customer Negligence Burden

UCC Article 3 & Article 4: Check Fraud Allocation

UCC Article 3 (Negotiable Instruments) and Article 4 (Bank Deposits and Collections) govern the legal rights and responsibilities of drawers, payees, collecting banks, and paying banks regarding physical checks.

1. Forged Drawer Signature vs. Altered Check

• Forged Drawer Signature: The drawee (paying) bank is generally strictly liable for paying a check bearing a forged drawer signature because the check was not "properly payable" from the customer's account (UCC § 4-401). The paying bank is presumed to know its own customer's signature and cannot pass this loss upstream to collecting banks.
• Altered Check (Altered Amount or Payee): The drawee bank that pays an altered check can generally pass the loss back upstream to the depository (collecting) bank based on a breach of the Presentment Warranty (UCC § 4-208), which warrants that the instrument has not been altered.

2. Ordinary Care and Comparative Negligence (UCC § 3-406)

If the customer's failure to exercise ordinary care substantially contributed to the making of an alteration or forged signature (e.g., storing blank check stock in an unlocked public hallway or mailing checks in clear envelopes), the customer may be precluded from asserting the forgery against the bank.

• Comparative Fault Standard: If both the customer and the bank failed to exercise ordinary care (e.g., the customer was negligent with check stock, but the bank paid a poorly altered check without following standard automated clearinghouse or visual clearing rules), the loss is allocated between the customer and the bank based on their respective degrees of fault.

3. Timely Examination and Notice Rules (UCC § 4-406)

Corporate account holders are legally obligated to examine their account statements with "reasonable promptness":

• Repeat Wrongdoer Rule: If the same wrongdoer commits multiple forgeries, the customer must discover and report the first unauthorized item within a reasonable period (not exceeding 30 calendar days under statutory default) after the statement was made available. Failure to report within this window relieves the bank of liability for subsequent forged checks paid before notification.
• Absolute Statutory Bar: Under statutory UCC § 4-406(f), an absolute one-year limit exists to report alterations or forged endorsements. However, commercial treasury deposit agreements almost universally shorten this notice window contractually to 14, 30, or 60 days.

---

UCC Article 4A: Wholesale Funds Transfers (Wires & Commercial ACH)

UCC Article 4A governs commercial wire transfers (such as Fedwire and CHIPS) and wholesale ACH credit transfers. It does not apply to consumer transactions covered by Regulation E (Electronic Fund Transfers Act).

Authorized vs. Verified Orders

Under UCC Article 4A, a corporate customer is financially liable for a payment order if the order is either authorized or verified:

1. Authorized Payment Order (UCC § 4A-202(a)): The order was explicitly authorized by the customer under standard legal agency principles (e.g., executed by an authorized signer).
2. Verified Payment Order (UCC § 4A-202(b)): Even if the payment order was initiated by an unauthorized third-party fraudster (such as in a BEC attack), the order is legally effective as the customer's order if:
   • The bank and the customer agreed upon a commercially reasonable security procedure to verify the authenticity of payment orders; and
   • The bank proves that it accepted the payment order in good faith and in strict compliance with the agreed security procedure and any written customer instructions.

The "Commercially Reasonable" Security Procedure Standard

A security procedure is deemed commercially reasonable based on the customer's circumstances, the size and frequency of payment orders, and the operational practices of peer banks. Standard elements include multi-factor authentication, cryptographic tokens, IP whitelisting, dual authorization, and out-of-band callbacks.

The Customer Rejection Exception (UCC § 4A-202(c)): If a bank offers a commercially reasonable security procedure (e.g., mandatory dual approval with hardware tokens and out-of-band callback) and the corporate customer expressly refuses that procedure in writing, opting instead for a simpler, less secure method (e.g., single-user email or verbal instruction), the customer assumes full legal liability for any resulting unauthorized funds transfers.

Customer Defense Under UCC § 4A-203 (Proving Breach Outside Control)

If a fraudulent wire is verified under a commercially reasonable security procedure, the customer can avoid liability only if it can legally prove that the perpetrator did not obtain the confidential security credentials or access directly or indirectly from the customer's facilities, systems, or employees. Because cybercriminals almost invariably obtain credentials through customer-side phishing or malware, this burden of proof is extraordinarily difficult for corporations to meet.

---

Realistic Corporate Case: UCC Comparative Negligence Loss Allocation

To understand how legal liability is apportioned in treasury practice, consider a worked corporate loss scenario involving check alteration and comparative negligence.

Scenario Background

• Entity: Titan Manufacturing Corp. (Commercial Drawer)
• Financial Institution: Horizon Commercial Bank (Drawee Bank)
• Incident: An accounts payable clerk mailed physical check #4088 for $5,000 to a legitimate parts supplier. The check was intercepted from an unsecured corporate mail drop.
• Fraud Mechanism: The fraudster washed the payee name to "Omni Global Holdings" and altered the numerical and written dollar amount from $5,000.00 to $255,000.00.
• Clearing: Horizon Commercial Bank processed and cleared the check against Titan's operating account. Titan Manufacturing did not utilize Payee Positive Pay.
• Discovery: Titan discovered the fraudulent clearing 45 days later during monthly account reconciliation.

Comparative Fault Evaluation Matrix:
┌────────────────────────────┬────────────────────────────────────────────────────────────────────────┐
│ Contributing Party         │ Evidence of Failure to Exercise Ordinary Care                          │
├────────────────────────────┼────────────────────────────────────────────────────────────────────────┤
│ Titan Manufacturing (60%)  │ • Left outgoing checks in an unmonitored external mailbox overnight.  │
│                            │ • Declined bank's recommended Payee Positive Pay fraud prevention.     │
│                            │ • Failed to perform daily account reconciliation within 30 days.      │
├────────────────────────────┼────────────────────────────────────────────────────────────────────────┤
│ Horizon Commercial Bank    │ • Cleared a $255,000 check that exceeded the account's historical      │
│ (40%)                      │   $25,000 high-check watermark without manual signature review.       │
│                            │ • Failed to detect obvious visual chemical discoloration around amount.│
└────────────────────────────┴────────────────────────────────────────────────────────────────────────┘

Step-by-Step Loss Apportionment Calculation

1. Total Gross Fraud Loss: $\text{Total Gross Loss} = \$255,000 - \$5,000 = \$250,000$
2. Apportionment of Fault (Legal Arbitration Determination):
   • Drawer Fault Percentage (Titan Manufacturing): $60%$
   • Bank Fault Percentage (Horizon Commercial Bank): $40%$
3. Dollar Allocation of Loss: $\text{Titan Manufacturing Liability} = \$250,000 \times 0.60 = \$150,000$ $\text{Horizon Commercial Bank Liability} = \$250,000 \times 0.40 = \$100,000$

Key Takeaway: Had Titan Manufacturing implemented automated Payee Positive Pay, the altered check would have been flagged as an exception at 08:00 AM on the day of presentment and returned unpaid automatically, resulting in $0 loss.