Academy/Banking, Cash & Internal Controls
Vendor fraud
A vendor relationship can be quietly turned against the association, by an outsider or by someone on the inside.
Vendor fraud is when someone profits from the association's vendor relationships instead of protecting them: a fake vendor billed for work never done, a real vendor's bank details quietly swapped for a fraudster's account, or a board member or manager taking kickbacks from an overbilling contractor. Always verify a vendor payment change by phone, using a number already on file, not one in the request.
Two shapes vendor fraud takes
The first is invented: a person with access creates a vendor that does not exist, or barely does, and submits invoices for work nobody performed. The second is collusive: a real vendor and someone on the inside agree to overbill, and split the difference.
"A property manager created fake vendor accounts and submitted invoices for non-existent services, funneling $800,000 into personal accounts over three years."
Source: Behind Closed Doors: Eye-Opening Case Studies of HOA Fraud, JS Morlu LLC
The same source describes a landscaping company that colluded with a board member: the board member took kickbacks while the association was overbilled out of $300,000. Both cases are single case reports, not a study of how often this happens, but they show the mechanism clearly: someone who can approve or influence a payment has a financial reason to see it approved. Warning signs an HOA attorney lists for this pattern include missing or altered vendor documents, photocopies where you would expect an original, duplicate payments to the same vendor, and unexplained credits or overdraft charges.
The bank-detail switch
The more common version does not need an inside accomplice at all. A scammer sends an email that looks like it came from a real vendor, or from your own board president, saying payment details have changed. The FBI calls this business email compromise: a scam that uses a spoofed or hijacked email account to redirect a transfer, sometimes by impersonating an executive or officer directly.
"A fraudster who can email you fake bank details can just as easily supply a fake 'verification' phone number that rings their own desk."
Source: A vendor emailed new bank details, how do I verify a bank change request safely?, Stampli
That is why the verification call has to use a number the association already had on file before the email arrived, never one supplied in the request. The FBI's own prevention guidance backs this up: verify significant changes by phone, never by replying to the email itself (forward it instead, or start a new message), and require a second person's sign-off before honoring the change.
A second set of eyes stops both
Ghost vendors and bank-detail switches both rely on one person having enough control to make a payment happen unchecked. The fix is the same control that runs through this whole Course: no one person should authorize a vendor, hold the check, and reconcile the account for the same transaction. A property-management fraud guide puts it plainly: the person who prepares a check should not be the person who signs it, and the signer should not be the one reconciling the statement afterward.
If the association uses a management company, that company is expected to carry its own fidelity or crime insurance covering the funds it handles, separate from the association's coverage. Ask who at the management company approves a vendor bank-detail change, and whether that approval requires a second person, the same way it should on your own board.
Check yourself
Answer before you read the explanation, recalling it is what makes it stick.
A landscaping vendor emails saying its bank account changed and asks that this month's payment go to the new account instead. What should the treasurer do first?
The board member who negotiated the landscaping contract also approves every invoice from that vendor and reconciles the account each month. What control is missing?
An invoice arrives for landscaping work at a building the association does not own, from a company nobody on the board recognizes. What is the right first step?
- Behind Closed Doors: Eye-Opening Case Studies of HOA Fraud, JS Morlu LLC
- A vendor emailed new bank details, how do I verify a bank change request safely?, Stampli
- Business E-mail Compromise: The 5 Billion Dollar Scam (PSA 170504), FBI Internet Crime Complaint Center
- HOA Fraud: A guide to detection and prevention, FirstService Residential
- Danger! Warning Signs of Embezzlement, Mulcahy Law Firm, P.C.
- Selling Guide B7-4-02, Fidelity/Crime Insurance Requirements for Project Developments, Fannie Mae
Banking, Cash & Internal Controls
Next, learn how to keep a scam invoice from ever reaching the check register: read Invoice fraud.
Whether your fidelity or crime insurance policy covers a vendor-fraud loss, and what your bank requires before it will reverse a payment sent to a fraudulent account, both depend on the specific policy and bank agreement your association has. Check both directly.