Senior living and care providers are as vulnerable as any business or individual to scams from artificial intelligence, which are becoming increasingly sophisticated and have a risk that is “growing dramatically,” Shawn Lane, CEO of accounts payable automation company Ottimate, told the McKnight’s Business Daily in an exclusive interview.
“AI tools have doubled the amount of fraudulent requests that we’ve seen and captured in the last year, and they’ve gotten much better as well. The quality is much higher, and the language is much stronger,” Lane said.
“I think it’s dramatically worse, in particular, in healthcare. Foreign attackers are coming in,” he said. “Some of these are state-sponsored attackers. We’ve seen North Korean and Chinese attackers that have approached, and they’re very sophisticated.”
Operators can be scammed in billing in various ways, Lane said. Most commonly, however, fraud is attempted via an email or a phone call from someone that appears to be someone the victim knows, he said. The threats to businesses are similar to those faced by consumers.
“We’ve had numerous customers that have made payments, unauthorized payments, and had to catch them back. The training that you would provide for a business isn’t all that dissimilar than what you would provide for a consumer or for a frontline offeror,” Lane said.
‘They’re asking for money or an early payment, or they’re asking you to respond to, in our cases, RFPs [requests for proposals]. But in some cases, it’s medical documentation,” he added. “It’s essentially any message. …It’s usually with some urgency in the message. “
A common AI tactic, Lane said, is for an email to come from an address that looks almost exactly like one used by a known vendor, perhaps with one letter different.
Lines of defense
The first line of defense is training employees, he said.
“You teach people: Do not click on a link, any link ever, until you have verified it with the provider,” Lane said. “You don’t call the number that’s on the invoice or that’s on the email. Call the number that’s in your system.”
Second, he recommended, providers should centralize contact around money, so, for instance, all invoices go through the accounting department.
A third line of defense, he noted, are employee software systems that are able to catch likely scams before they cause problems.
“The volume is so high today that we find the software does 95% of the work. It’s going to catch most of them, but it’s still going to have a human element associated with it to try to determine whether this is fraudulent or not and to give you the right next steps to take,” Lane said.
Steps to take if an incident occurs
If a data breach happens or a fraudulent invoice gets paid, respond as soon as it’s discovered, Lane advised. The first step, he said, is to call the bank immediately — within the first hour if possible — and request a wire recall or a “swift indemnity.”
“We find that about 85% of the time, you can cancel the transfer before it happens. It’s only in rare cases that you can’t,” Lane said.
Secondly, he said, preserve the evidence.
“Call your IT team. Get them to put a hold on it, or at a minimum, just don’t delete the invoices,” Lane said. “Deleting them is one of the worst things you can do. You can’t prove it.”
If the incident is flagged within the first eight hours or so, file the information with the Internet Crime Complaint Center, which the FBI uses for its financial kill chain for domestic and even international wire transfers, he advised.
“If you can file that form, you get the police on the case … and that protects you from an insurance standpoint as well,” Lane said.
The next step, he said, is to call the business’ insurance company.
Even if you don’t discover the incident right away, Lane said, take the same steps to mitigate the risk.
Lane cited an example of the senior living community he worked with that received an email from a supposed employee asking to have the bank account in the individual’s record changed.
“And the stressed HR person changed it immediately, and they sent two weeks’ pay to someone. That’s a very common one, especially in senior living, where there’s 40% turnover,” he said. “That was a mistake. It was a mistake that they didn’t give the proper channels and they figured it out two weeks later when the employee didn’t get paid and complained.”
Even though two weeks had passed, Lane said, “they were able to file a swift indemnification with the bank and get the money returned. So it’s solvable most of the time, even despite a significant time frame.”
Know your vendors
Most vendors use the same invoice from month after month and year after year, so be sure to notice if something seems odd, he said. For example, Lane noted, “Cisco has very distinct lines around their invoices and particular SKU numbers they use.”
Also take note of whether the dollar amount on an invoice matches typical cost.
Additionally, Lane said, make sure the bank account and address information on the invoice lines up with the vendor information that is on file.
Click Here For The Original Source.
