What to do if your business falls victim to fraud

The first step to fighting fraud is to be proactive by having a plan, learning common tactics, and putting safeguards in place. But what happens if a bad actor manages to get through?

Knowing how you’ll respond before fraud happens can help you act faster and more effectively. A few of these steps require preparation ahead of time, so it’s worth having a plan in place now.

1. Implement your Incident Response Plan (IRP)

Preparation is key, and your business should have a plan in place for how it will respond to an incident. That’s where an Incident Response Plan (IRP) comes in.

An IRP is a written document that helps guide your organization before, during and after a confirmed or suspected cybersecurity incident. It establishes the who by identifying the teams and individuals who need to be involved, as well as the what by outlining their responsibilities throughout the response.

If your business experiences an incident, activate your IRP and contact the individuals assigned to lead the response. Depending on your organization, this may include an incident manager who coordinates communication, stakeholder updates and task delegation; a technical manager who brings in additional internal or external experts as needed; and a communications manager who develops messaging for clients, customers, stakeholders and the public.

Your IRP is also important after the immediate threat has passed. The teams involved should review what worked, identify areas for improvement and update the plan based on what they learned. Regularly testing your IRP can also help ensure everyone understands their role before an actual incident occurs.  

2. Isolate the threat

This step may already be included in your Incident Response Plan, but if your business experiences a cybersecurity incident, it’s important to act quickly to contain the threat.

Immediately disconnect any affected devices, systems or programs from your network, especially if you suspect malware or if the incident involves a system that stores sensitive information. This can help prevent the threat from spreading to other parts of your organization.

Once the affected system has been isolated, scan your broader environment for additional indicators of compromise to determine whether other devices or systems may also be affected.

If the incident involves financial loss or compromised financial information, contact your bank as soon as possible. Depending on the nature of the incident, you should also report it to the appropriate law enforcement agencies, including local law enforcement and the FBI.

3. Take alerts seriously

Many banks, platforms and systems have fraud alerts designed to flag suspicious activity. Depending on the system, you may receive a phone call, email or text asking you to verify a transaction or unusual account or network activity.

It’s important to respond to these alerts and investigate them promptly, even if they come through on a weekend or holiday. Fraudsters may take advantage of times when businesses are less staffed or slower to respond, giving suspicious activity more time to go unnoticed.

Make sure the appropriate members of your team know who is responsible for monitoring and responding to alerts, including outside of normal business hours.

4. Report the incident to your bank and other important partners

Fraudsters benefit when incidents go unreported because it gives them more opportunities to repeat the same tactics against other businesses. Reporting suspected fraud quickly can also improve the chances of recovering lost funds.

Contact your bank as soon as you realize fraud may have occurred, even if you are not yet certain. It is better to involve your bank early so they can help verify the activity, secure your accounts and determine what additional steps may be necessary.

You should also document as much information about the incident as possible, especially if you plan to file a cyber insurance claim. Notify the members of your fraud or incident response team identified in your Incident Response Plan and, when appropriate, file a report at IC3.gov.

Conclusion

Fraud can happen even when your business has strong safeguards in place, which is why knowing how to repond is just as important as knowing how to prevent it.

If you suspect you've been targeted by fraud, call the First Financial Bank Business Support Center (BSC) at 866.604.7964. Explore tips and information on how to prepare and protect yourself on our Commercial Fraud and Online Safety Resource Hub.