An Increase in Employee Fraud

Fraud against small business on the rise

Talbot Boggs

March 03, 2009

Small businesses form the backbone of the Canadian economy. In 2007 they employed more than five million workers, nearly half the total private sector labour force.In fact, more than 98 per cent of all businesses in Canada are small businesses (those with fewer than 100 employees) and approximately 140,000 new small businesses start up each year.

In the past, many small businesses, including retailers, didn't pay much attention to credit card fraud because they essentially thought they were immune to it.However, it appears that credit card fraud against small businesses is growing. Visa Canada reports that about 70 per cent of credit card fraud and data security breaches now are perpetrated against small businesses.

The reason is that most small businesses think they are immune to the crime. "There is a shift by the criminal element to small businesses because many of them still believe they are impervious to it," says Michael D'Sa, senior manager of data security and investigations with Visa Canada. "When it does happen to them, it usually comes as a complete shock."

A survey by Visa Canada has found that only 25 per cent of store managers believe their businesses are somewhat vulnerable to credit card fraud and only31 per cent train their staff in fraud reduction procedures when they experience a problem.The situation is the same south of the border, where many small businesses engage in activities that can put customer information at risk, such as storing customer social security numbers, bank account numbers and copies of customers' cheques.

More than half of small businesses keep at least one of these sensitive pieces of information and 57 per cent don't believe that making customer data secure is something that needs formal planning. A well, 61 per cent of small businesses have never tried to get information about how they can properly handle and store customer information.

D'Sa says most of the problem could be eliminated if small businesses removed prohibited data and properly secured the data that was left. "Often, businesses will keep personal and credit card data on their customers for five or 10 years that is not needed," he says.

Small businesses need to understand their point of sale systems and examine what information they are keeping and what can be deleted. Businesses only need to keep the first and last four credit card digits, and the date, time and location of the transaction.

A lot of credit card fraud - between 70 and 80 per cent - is perpetrated by employees. D'Sa urges small businesses to do criminal background checks on employees and potential hires, and report any suspected cases of fraud or security breaches to police, the credit card company or their bank. "A lot of organizations might secure their perimeter but have no controls over the inside," D'Sa says.

In a brochure on the subject, Visa Canada urges small businesses to know about and comply to the Payment Card Industry Data Security Standard, which sets requirements for protecting sensitive transaction information. The standard, which has been in place since 2004, is supported buy major payment card brands and consists of 12 basic requirements for safeguarding account data.