Fraud Protection
Dealing with fraud can be both time consuming and frustrating, and no one is immune to the threat. Watermark Bank is committed to helping you recognize potential scams and providing resources for protecting your financial information and reducing the risk of fraud.
|
Positive Pay and Account Reconciliation:
By providing a list of distributed checks and pre-authorized ACH transactions, we are able to monitor and detect fraudulent items attempting to clear your account. If an item is not on the list, or the issue date or dollar amount are different, we flag it for your review.
|
ACH Filters and Blocks:
Manage transactions within time constraints and minimize the risk of unauthorized ACH transactions by automatically preventing them from posting to your account.
|
ACH and Wire Transfer Email Notifications:
The sophistication of Watermark Treasury Connect allows you to customize a multitude of alerts that will notify you when transfers are initiated by online users.
|
What to Do If You Suspect Fraud
If you notice unauthorized activity or believe your account or financial information may have been compromised, contact Watermark Bank right away at (405) 810-6210.
When you contact us, please have the following information available, if applicable:
- Your account number
- Your debit card number
- The amount of the unauthorized transaction
- The date the activity occurred
Lost or Stolen Debit Cards:
During business hours, contact us at (405) 810-6210. You can also turn your debit card off through Card Management in Watermark Online or Mobile Banking. To report a lost or stolen debit card outside of normal business hours, call (888) 297-3416.
Fraud Prevention
Businesses are frequent targets of fraud, and criminals continue to change how they attempt to gain access to financial information and funds. Understanding common fraud schemes and knowing what to watch for can help you identify suspicious activity before your business is impacted.
Business Email Compromise
Business email compromise (BEC) is one of the most financially damaging forms of fraud, and it is growing quickly. It now accounts for the large majority of reported fraud involving business wire and ACH transfers, and the FBI has tracked over fifty-five billion dollars in losses to this scheme over the past decade. BEC works because businesses depend on email to move money. A fraudster sends a message that appears to come from a known source, such as a vendor sharing an invoice with updated payment details, an executive requesting an urgent transfer, or a title company providing wire instructions. The message is fake, and the funds go to the criminal.
Fraudsters may spoof an email address with a one-character difference, send targeted phishing messages to gain access to company accounts, or use malware to monitor real invoice conversations and time their requests.
How to protect your business
-
Verify any new payment instructions or account changes by calling a number you already know for the requester, never one provided in the email.
-
Examine sender addresses, links, and spelling closely for small variations.
-
Turn on multifactor authentication for every account that offers it.
-
Treat pressure to act quickly as a warning sign.
-
Set internal procedures that require a second approval for payment changes.
-
Dual control and transfer alerts through Watermark Treasury Connect can support this.
Wire and ACH Fraud
Wire and ACH transfers are fast, automated, and hard to reverse once sent, which is exactly why they're a target for fraud. Fraudsters go after both large businesses, where a high volume of transactions can help fraud go unnoticed, and smaller businesses, where limited staff or oversight can leave gaps.
How it happens
If fraudsters gain access to your online banking or accounting system, whether through phishing, malware, or a compromised password, they can submit ACH files or alter payment instructions to redirect funds to accounts they control. See Corporate Account Takeover for how these access attempts typically unfold.
Fraud doesn't always require account access, though. A phishing email, call, or text may impersonate a trusted business, such as your bank or a vendor, and ask you to "update" login credentials or payment details. In a business email compromise scheme, a fraudster poses as someone in your company, often an executive, and instructs whoever handles payments to change an account number or send a wire immediately. Watermark will never contact you out of the blue to request login credentials or account information.
How to protect your business
- Require a second approval for any payment or account change, dual control on ACH and wire initiation is one of the strongest defenses available.
- Confirm any new or changed payment instructions by calling a number you already know, never one provided in the request itself.
- Turn on multifactor authentication for every account that offers it.
- Regularly reconcile accounts and audit ACH activity rather than assuming everything cleared is legitimate.
- Keep systems updated and protected with current antivirus and anti-malware software.
- Use ACH Filters and Blocks and Positive Pay, described above, to catch unauthorized items before they post.
Corporate Account Takeover
Protecting your account starts with understanding how account takeover fraud occurs and knowing what to watch for. Fraudsters continue to use increasingly sophisticated tactics to gain access to personal and business accounts. These attempts often involve impersonating trusted sources and creating urgency to prompt action.
What account takeover looks like
Fraudsters don't always present themselves the same way. In some cases, they may claim to be from a bank fraud department. In others, the message may appear as a payment alert, a verification request, or a general security or account check. The common thread is urgency, encouraging you to share information quickly without time to verify.
How it happens
Fraudsters may contact you by phone, text, or email and reference suspicious or unauthorized activity. They often sound professional and may use spoofed phone numbers or publicly available information to appear legitimate. The goal is to obtain login credentials or one-time passcodes. If a one-time passcode is shared, fraudsters can gain immediate access to online banking accounts, which may result in account takeover and unauthorized transactions.
How to stay safe
Watermark Bank will never call or text to request account credentials, passwords, PINs, one-time passcodes, or multifactor authentication codes. Caller ID, email addresses, and message formatting can be spoofed. Be cautious of messages that pressure you to act quickly or ask you to "confirm" activity.If you receive an unexpected call, text, or message claiming to be from Watermark, do not share any information, end the interaction, and contact us directly using verified contact information.
Additional resources
For more on recognizing and avoiding scams, visit the FTC at consumer.ftc.gov/articles/how-avoid-scam.
Debit Fraud
Debit card fraud can take several forms: a lost or stolen card, unauthorized transactions, skimming devices placed on card readers, or a card intercepted before it ever reaches you in the mail.
Automatic debit card alerts
If we detect suspicious activity on your debit card, we'll notify you in real time asking whether the transaction is valid or fraudulent. The text will only ever ask that, we will never ask you to click a link. When in doubt, don't respond, and call us directly.
Security reminders
- Never write your PIN on your card
- Treat your debit card like cash, and store it securely
- Do not reveal any information about your card over the phone or internet unless you initiated the contact
- Watermark will never request card, account, or PIN information in a text, email, phone call, or any type of alert or notification
- Inspect ATMs and card readers before use, and cover the keypad when entering your PIN
- Avoid entering your card number over public Wi-Fi, and only shop online with businesses whose website address begins with "https"
Manage your card in the app
With the Watermark Bank app, you can turn your card on or off instantly if it's lost or stolen, block certain transaction types, get instant alerts when your card is used, and set travel notices so your card isn't blocked while you're away.
If you suspect fraud
Turn your card off immediately through Card Management in Online or Mobile Banking, or call us directly at (405) 810-6210 during business hours. Outside business hours, call (888) 297-3416.
Phishing and Text Message Scams
Phishing and smishing (text-based phishing) are messages designed to look like they come from a bank, delivery company, government agency, or another organization you recognize, often claiming a problem with your account, an unpaid toll, or a package delivery issue that needs immediate action. A familiar name, logo, or phone number in the message is not proof it's legitimate.
Spear phishing is a more targeted version, aimed at a specific person rather than a generic list, using details gathered from social media or a company website to seem convincing. A fraudster posing as a CEO, for example, might reference a real recent conversation to get an employee to click a link that steals their login credentials.
How to protect yourself
- Don't click a link in an unexpected message, go directly to the organization's official website or app instead
- Don't call a phone number provided in a suspicious text or email, use a number you already know to be legitimate
- Treat urgency as a warning sign, "act immediately" is a pressure tactic, not proof of a real problem
- Double-check sender email addresses and phone numbers closely, small variations are easy to miss
Identity Theft
Identity theft happens when a fraudster unlawfully uses your personal information, your name, Social Security number, or financial details, to access your accounts, open new credit in your name, or make unauthorized purchases. The consequences can take months or years to fully resolve.
Signs of identity theft
- Unfamiliar withdrawals or charges on your accounts
- Missing bills or mail you're expecting
- Statements from credit cards you didn't open
- Unexpected denial of a credit or loan application
- Notification of a data breach involving your information
- A fraudulent tax return filed in your name
How to protect yourself
- Shred documents containing personal information, including receipts, statements, and credit offers, before discarding them
- Retrieve mail promptly, and consider a lockable mailbox or a USPS hold if you'll be away
- Share personal information only if you initiated the contact, and only once you're certain who you're speaking with
- Be cautious about who asks for your Social Security number, and ask whether an alternative identifier is available
- Place a fraud alert with the three major credit bureaus (Equifax, Experian, TransUnion), or consider a credit freeze, which is free, doesn't affect your credit score, and can be lifted when needed
- Request your free annual credit report at annualcreditreport.com to check for accounts you didn't open
If you suspect identity theft
Visit IdentityTheft.gov, the federal government's resource for reporting identity theft and building a personalized recovery plan. If your Watermark accounts are affected, contact us at (405) 810-6210.
Bank Impersonation Scams
Fraudsters may pose as Watermark Bank or another financial institution in an attempt to gain access to your business accounts or sensitive information. They may manipulate caller ID so a call appears to come from a legitimate bank phone number and may know details about your business or employees to make the call seem credible. A fraudster may claim there is suspicious activity on your account and pressure you to take immediate action. They may ask you to move funds, provide login information or share a one-time passcode or multifactor authentication code.If you receive an unexpected call claiming to be from Watermark, do not rely on caller ID to verify who is calling. Hang up and contact Watermark directly using a number you know and trust.
Remember:
- Never share your online banking password, PIN or authentication codes with an unexpected caller.
- Be suspicious of anyone pressuring you to move funds immediately to “protect” your money.
- Never move funds to a new account at another financial institution at the direction of an unexpected caller claiming to be from your bank.
- When in doubt, end the call and contact Watermark directly.
Common Scams that Target Businesses
Fake Invoices and Unordered Merchandise
Scammers create phony invoices that look like you ordered products or services for your business. They hope the person who pays your bills will assume the invoices are real and make the payment. Except it’s all fake. Or a scammer might call, claiming they want to “confirm” an existing order, “verify” an address, or offer a “free” catalog or sample. If you say yes to any of those, unordered merchandise will arrive at your doorstep — followed by high-pressure demands to pay for it. Don’t pay. And remember, if you receive merchandise you didn’t order, you have a legal right to keep it and use it for free.
Scammers create phony invoices that look like you ordered products or services for your business. They hope the person who pays your bills will assume the invoices are real and make the payment. Except it’s all fake. Or a scammer might call, claiming they want to “confirm” an existing order, “verify” an address, or offer a “free” catalog or sample. If you say yes to any of those, unordered merchandise will arrive at your doorstep — followed by high-pressure demands to pay for it. Don’t pay. And remember, if you receive merchandise you didn’t order, you have a legal right to keep it and use it for free.
Online Listing and Advertising Scams
Scammers try to fool you into paying for nonexistent advertising or a listing in a phony business directory. They may ask you to give your contact information for a “free” listing, or say the call is simply to “confirm” your information. Later, you’ll get a big bill, and the scammer may use details — or even a recording — of the earlier call to pressure you to pay.
Scammers try to fool you into paying for nonexistent advertising or a listing in a phony business directory. They may ask you to give your contact information for a “free” listing, or say the call is simply to “confirm” your information. Later, you’ll get a big bill, and the scammer may use details — or even a recording — of the earlier call to pressure you to pay.
Tech Support Scams
Tech support scams start with a call or an alarming pop-up message on your screen. The scammers pretend to be from a well-known tech company, telling you there is a problem with your computer’s security. Their goal is to get your money, access to your computer, or both. They may ask you to pay to fix a problem you don’t really have, enroll your business in a nonexistent or useless computer maintenance program, or sneak on your computer network to grab confidential data they can use to commit identity theft.
Tech support scams start with a call or an alarming pop-up message on your screen. The scammers pretend to be from a well-known tech company, telling you there is a problem with your computer’s security. Their goal is to get your money, access to your computer, or both. They may ask you to pay to fix a problem you don’t really have, enroll your business in a nonexistent or useless computer maintenance program, or sneak on your computer network to grab confidential data they can use to commit identity theft.
Business Coaching Scams
Some scammers sell bogus business coaching programs, often using fake testimonials, videos, seminar presentations, and telemarketing calls. They falsely promise amazing results if you pay for their exclusive “proven” system to succeed in business. They also may lure you in with low initial costs, only to ask for thousands of dollars later. In reality, the scammers leave budding entrepreneurs without the help they sought and with thousands of dollars of debt.
Changing Online Reviews
Some scammers claim they can replace negative reviews of your product or service, add positive reviews, or boost your scores on ratings sites. However, posting fake reviews is illegal. FTC guidelines say endorsements — including reviews — must reflect the honest opinions and experiences of the endorser.
Some scammers claim they can replace negative reviews of your product or service, add positive reviews, or boost your scores on ratings sites. However, posting fake reviews is illegal. FTC guidelines say endorsements — including reviews — must reflect the honest opinions and experiences of the endorser.
Credit Card Processing and Equipment Leasing Scams
Some scammers promise lower rates for processing credit card transactions, or better deals on equipment leasing. These scammers resort to fine print, half-truths, and flat-out lies to get a business owner’s signature on a contract. Some unscrupulous sales agents ask business owners to sign blank documents. (Don’t do it.) Others have been known to change terms after the fact. Ask the salesperson to give you copies of all documents right then and there. If they refuse or put you off with a promise to send them later, that could be a sign you’re dealing with a scammer.
Some scammers promise lower rates for processing credit card transactions, or better deals on equipment leasing. These scammers resort to fine print, half-truths, and flat-out lies to get a business owner’s signature on a contract. Some unscrupulous sales agents ask business owners to sign blank documents. (Don’t do it.) Others have been known to change terms after the fact. Ask the salesperson to give you copies of all documents right then and there. If they refuse or put you off with a promise to send them later, that could be a sign you’re dealing with a scammer.
Fake Check Scams
Some scammers give you what seems like a plausible reason to overpay you with a check. Then, they’ll ask you to send the extra money back to them or to someone else. But the check will be fake, even though it might show up as “cleared” in your account. By the time the bank discovers the check was bad, the scammer already has the money you sent them. You’ll be stuck repaying the bank.
Some scammers give you what seems like a plausible reason to overpay you with a check. Then, they’ll ask you to send the extra money back to them or to someone else. But the check will be fake, even though it might show up as “cleared” in your account. By the time the bank discovers the check was bad, the scammer already has the money you sent them. You’ll be stuck repaying the bank.
Other Questionable Practices
Sometimes scammers hide behind other questionable practices — like claiming to offer big-money gig economy jobs, but then failing to live up to their money-making promises. Or they may try to sell you unnecessary services with the false claim that you need to pay to improve your business’s credit report. And after natural disasters strike, unlicensed contractors and scammers may show up with false promises that they’ll get your business back up and running with quick repairs, clean-up, or debris removal that never happens. For more advice on protecting your organization from scams, visit ftc.gov/SmallBusiness. If you spot a scam, report it to ReportFraud.ftc.gov. Your report can help stop the scam.
Sometimes scammers hide behind other questionable practices — like claiming to offer big-money gig economy jobs, but then failing to live up to their money-making promises. Or they may try to sell you unnecessary services with the false claim that you need to pay to improve your business’s credit report. And after natural disasters strike, unlicensed contractors and scammers may show up with false promises that they’ll get your business back up and running with quick repairs, clean-up, or debris removal that never happens. For more advice on protecting your organization from scams, visit ftc.gov/SmallBusiness. If you spot a scam, report it to ReportFraud.ftc.gov. Your report can help stop the scam.
Cybersecurity Best Practices for Your Small Business
Cybersecurity Best Practices for Your Small BusinessCybersecurity Best Practices for Your Small Business
Cyberattacks cause billions of dollars in business losses every year. Because smaller firms have limited resources, they’re especially vulnerable to these threats and the financial, reputational, and legal damage that can result. But even with a modest IT budget, you can take crucial steps to improve your business’s cybersecurity. Follow these best practices to help stave off security concerns.
- Have Robust Security Software
Help protect your business’s systems and data with reputable antivirus, anti-malware, and firewall solutions. Enable automatic updates to ensure you have the latest protection. - Backup Business Data
Regularly back up your critical business data, ideally with a trusted cloud storage provider. Test backups periodically to ensure you can quickly recover from a data loss. - Create a Company-wide Password Policy
Require employees to create complex passwords of at least 8 to 12 characters with a mix of uppercase and lowercase letters, numbers, and symbols. Passwords should be changed regularly. - Enable Multifactor Authentication
By implementing multifactor authentication, your business can help prevent unauthorized access to company devices and accounts by requiring a second verification factor to log in (such as a code sent to the user’s phone). - Secure Your Mobile Devices
If you provide smartphones, tablets, or laptops to employees, ensure they’re secured with strong passwords and mobile device management (MDM) software. This software allows your company to remotely manage a device and wipe sensitive company data if lost or stolen. - Address Wi-Fi Weaknesses
Change the default password on your router and use strong encryption such as WPA3. Businesses open to the public – such as stores, restaurants, and medical practices – should create a separate guest network to keep visitors off their internal network. - Limit Employee Access
To minimize the risk of data breaches, follow the principle of least privilege: Only let employees access the data and systems they need to do their specific jobs. - Boost Employee Awareness
Educate your team about common threats like phishing emails and business email compromise (BEC) schemes. Teach staff to spot suspicious emails, and reinforce the importance of verifying communications before complying with requests.
Strong cybersecurity measures are critical in today’s highly connected business world. If your budget allows, consider hiring an outside cybersecurity specialist to help you implement these measures effectively. Along with following these best practices, stay informed about the latest risks and conduct regular cybersecurity audits to ensure your small business is equipped to prevent or quickly recover from a cyber incident.
For business owners looking for more in‑depth guidance, this resource outlines practical steps to help protect your organization from common cyber and payment‑related threats.