Digital transformation continues to change the way we do business. However, along with its many benefits come a range of challenges, notably a rapid rise in the frequency and sophistication of digital fraud.

Organisations are confronted by threats from financially motivated offshore criminal syndicates intent on defrauding them via any means possible, including hacking into computer systems and inducing human error through deception.

The threat is most acute when processing electronic transfers. FAST and bulk GIRO payments in Singapore move on the payee's account number alone, without the bank matching that number against the account holder's name. PayNow adds a name check, but only for payments through a registered UEN or mobile proxy.

This verification gap opens the way for criminals to defraud organisations through a range of attack vectors, including Business Email Compromise (BEC), Vendor Email Compromise (VEC), hacking into ERP systems, or manipulating data in your vendor master file and the GIRO payment files used to upload payment data to online banking portals. Typically, Accounts Payable teams neither have the capacity nor the training to detect this type of fraud, and ERP and accounting software can only match new data to your existing data, meaning they're unable to verify against an independent source.

odern cybercriminals and fraudsters use identity theft and social engineering to impersonate trading partners and vendors. Vulnerabilities in vendor or partner organisations become your problem, too, allowing fraudsters to get into their systems and deceive you using legitimate email accounts and documentation.

Many of today's cybercrime syndicates run with the same style of organisation charts that Fortune 500 companies have. That is exactly how organised their mission to defraud you is.

These impersonations make use of legitimate email accounts and are extremely hard to detect. Fraudsters constantly adapt their tactics to circumvent most payment controls and AP measures.

A single factor of verification, be it your own records or a call-back control, is insufficient in such an environment. That's why we've developed an approach fit for a digitally connected world: multi-layered verification, drawing on 11 million+ verified records across our global network.

Modern fraudsters use identity theft and social engineering to impersonate trading partners and vendors. A vulnerability inside a vendor's own systems becomes your problem too, once a fraudster is inside using a legitimate email account and real documentation.

Many of today's fraud syndicates are run with the same structure as a large company, which shows how organised the effort against you actually is.

Because these impersonations use real email accounts, they are extremely difficult to catch, and fraudsters keep changing tactics to get around standard payment controls. A single layer of verification, whether that is your own records or one callback, is not enough on its own. That is why Eftsure uses multi-layered verification, an approach built for a digitally connected world.

Multi-layered verification checks a vendor's bank account details against more than one independent source, rather than checking once and moving on.

Eftsure applies a "safety in numbers" approach, based on established practice such as multi-factor authentication. We match payee name to account number and Unique Entity Number (UEN). Drawing on 11 million+ verified records, if multiple businesses independently verify and pay the same details, we treat them as correct, and if we catch a fraudulent vendor account for one customer, we alert every other customer paying that same vendor.

Across your entire payment lifecycle, Eftsure draws on its large, proprietary and growing network of 3,500+ customers and 11 million+ verified records to provide you with real-time alerts, in the form of simple traffic-light style "red thumb" and "green thumb" symbols that indicate the validity of a vendor's bank account information (or lack thereof). By "validity," we mean that the account number matches the bank account name and Unique Entity Number (UEN), protecting you from making incorrect payments whether due to fraud or error.

This network powers Eftsure's ability to verify your data at all key phases of your payment lifecycle:

• We verify new vendors at onboarding, including document and certification collection and business legitimacy checks.
• We allow you to maintain the validity and accuracy of that data using our secure vendor management portal.
• We provide real-time payment and compliance alerts before you pay, across payment files including GIRO, and in your online banking payment screen.

Eftsure's database is a live, growing network of 11 million+ verified vendor records, built from the combined data of 3,500+ customers across 200 countries. Every time a customer verifies and pays a vendor, that verification strengthens the network for everyone else in it.

This is what makes the "safety in numbers" approach work. To deceive the system, a fraudster would have to deceive multiple organisations at the same time, using the same fraudulent account details. Our algorithms also look at the frequency and recency of businesses joining the network, among other fraud anomalies, to flag anything that doesn't fit the pattern.

The database isn't static. As new vendors are verified, existing records are refreshed, and bank detail changes are checked against the network before they're accepted. If we catch a fraudulent vendor account in one customer's organisation, we can alert every other customer in the network who might be paying that same vendor, often before they've made a payment.

Having a trusted AP team is important. We all want to believe we can trust those we work with, but a core feature of any risk management framework is:

Trust but verify!

It’s never a good idea to be overly reliant on just one person, or even a handful of people. Effective business continuity planning requires you to have resilient systems in place, rather than being fully dependent on the people in your team.

Fraudsters are actively seeking ways to circumvent your traditional security layers. If those security layers are overly dependent on manual verifications by humans, they will be susceptible to tactics aimed at deceiving them into making errors and potentially facilitating fraudulent payments.

Along with the financial cost to your organisation, this brings a variety of other costs, including heightened anxiety in staff, potential reputational damage, delays, time spent on clean-up or attempting to recoup the loss, and much more. Even hiring additional personnel will not protect you from determined fraudsters.

‘Call-backs’ are an important security measure. But many organisations struggle to implement call-backs effectively. For AP teams that are under pressure to complete other important tasks, undertaking call-backs is a highly manual and time-consuming activity. Many  teams struggle to conduct call-backs effectively, which can mean they:

• Don’t independently source vendor contact details
• Rely on return messages and incoming information that may be from
  malicious actors
• Do not ask the correct verification questions

The people conducting call-backs are not trained to detect fraud. Recent reports indicate fraudsters are manipulating telephone numbers in vendor master files, or even using “Deep Fake” technologies to impersonate other peoples’ voices. Call-backs alone are insufficient in the fight against increasingly sophisticated digital fraud.

You may have several systems in your accounting environment to manage vendors and workflow. However, Eftsure is a unique platform that both verifies your vendors' banking details and protects your payments in real time before you process a payment, domestic or international.

By comparison:

• Accounting software matches new information to existing information, but doesn't validate this against external information, such as Eftsure's database of 11 million+ verified records.
• Vendor management systems may deliver efficiencies, but don't contribute to security. They too can be infiltrated using trojans and malware. Eftsure delivers efficiencies and security, in real time.

No. Integrating Eftsure is straightforward.

There are two ways to deploy Eftsure for your Singapore business: as a standalone vendor verification portal, where you manage vendor onboarding and payment verification directly in Eftsure, or embedded into your existing ERP or treasury system through prebuilt connectors, including Kyriba, Coupa, Esker and SAP. Speak with our team to confirm which approach fits your existing systems and IT resourcing.

There's no reason why technology or systems upgrades should delay securing your organisation from the risk of digital fraud. If your organisation is in the process of upgrading ERP systems or embracing AP automation, it's an ideal time to ensure the data being used is accurate and up to date. Irrespective of what systems you use within your AP environment, if the data is incorrect, you are much more likely to experience adverse outcomes.

Integrating Eftsure requires very little investment of time on the part of your IT team, but will deliver significant efficiency dividends, helping you automate many manual processes. Fraudsters aren't waiting. Why should you?

The security of your personal and confidential business information is critical to us.
We take appropriate industry recognised steps to prevent personal and confidential business information we hold from misuse, interference, or loss, and from unauthorised access, modification, or disclosure.

This protection includes the use of technologies and processes such as access control procedures, network firewalls, encryption, and physical security. 

Your vendor data is not visible to any other organisation using Eftsure, nor do you have visibility over other organisations’ supplier data.

Our approach is to aggregate data from 11 million+ organisations. With this data we can determine whether a supplier is being paid using matching banking information by multiple organisations. If this is the case, then there’s a very strong likelihood that the banking information is accurate.

No additional information, including the names of payer organisations, nor the amounts of any payments, is disclosed.

When using the Eftsure portal, you can create unlimited numbers of user accounts for people within your organisation. Each user account you create can have different privileges, based upon the level of access to data you want that person to have.

All data is only ever stored in our secure hosting environment on AWS in Sydney. Nothing is stored offshore.

The Eftsure platform has been extensively vetted by Westpac, PwC, and Amazon Web Services.

To ensure we maintain the highest information security standards, our architecture, processes and systems are regularly audited by independent experts and penetration tested.

We provide comprehensive support throughout your onboarding and beyond. Our goal is to help you maximise the benefits your organisation derives from Eftsure.

Eftsure is used by hundreds of leading businesses in almost every sector of the Australian economy from education to construction and property, mining and resources, infrastructure, state government departments, local government, hospitality and tourism, financial and legal services, to name a few.

Eftsure is also endorsed by PwC, Crime Stoppers NSW, HLB Mann Judd and PKF.

Every day, Eftsure alerts organisations to suspicious payments before the funds are irretrievably released. Several hundred "red thumb" alerts are issued each month. Eftsure has stopped numerous attempted frauds. Due to the confidential nature of these attempts, we are not at liberty to disclose the identities of the impacted organisations.

Some notable recent Eftsure successes include:

• Helping a large construction and engineering firm avoid a $1 million fraud attempt resulting from a BEC attack.
• Helping a leading diversified food company avoid paying fraudsters $200,000 following a BEC attack.

Eftsure is designed to require very little investment of time from your side.

Prior to going live, we will undertake several important steps:

1. Vendor Master File Health Check: 48 hours – 1 week.
2. Verification attempts of supplier anomalies and those not in our database: 1 week – 3 weeks.
3. Staff training: 2 hours.

Once we complete these steps, you can start using Eftsure within minutes.

When joining Eftsure, you gain full access to all the features in the platform. All the features form a holistic fraud-mitigation system and cannot be separated out.