It is one thing to house a company’s deposits, payments, and credit. It is something more to help that company protect and safeguard its funds as financial scams evolve.
Alabama-based Regions Bank is building on its growth in its home state and across the Southeast and Texas, in part, by diving deeper with business clients on how they can keep their money safe.
And we found what Regions is sharing with businesses can help protect everyday consumers, too.
“Fraud education is not a campaign that starts and stops. It’s year-round,” said Jeff Taylor, head of Commercial Fraud Forensics for Regions Bank.
“From Huntsville to Nashville, Houston to St. Louis, what we’re sharing is the latest information we’re seeing based on our constant monitoring of how scammers try to convince employees to hand over the digital keys to a company’s account. So, taking just an hour to listen to what’s going on can help you and your employees protect your company’s finances while also learning tips that can help protect your household, too.”
The next stop is Birmingham this month—another chance for operators in the bank’s hometown market to visit with experts and learn how to recognize red flags. Taylor was happy to share some key takeaways that apply to anyone, Regions client or not.
What businesses can put in place now
The most transferable lesson from these sessions is a simple verification ritual: Stop. Call. Confirm. When an email, text, or portal message asks for a payment, a vendor-account change, a new routing number, or an urgent wire, stop the process. Call the supposed requester on a number you already have on file—not the number in the message. Confirm the request before anyone hits send.
“A five-minute callback is easier to explain than a multi-million-dollar loss,” Taylor said. “Lookalike domains and compromised vendor threads are designed to feel familiar; the phone call breaks the script.”
Second, install dual controls on money movement. Set a dollar threshold and require two people with separate credentials to approve wires, ACH origination, and vendor-banking changes.
Banks like Regions offer companies systems called ‘treasury management’ platforms that can enforce role-based permissions and send alerts when payments are pending or when user access privileges change. Dual controls also reduce internal risks: one person should not both initiate payments and reconcile the same accounts.
Third, harden the payment rails themselves.
“Reconcile accounts daily, not monthly,” Taylor advised. “Enroll in a service like Positive Pay and ACH filters so your bank compares issued items and incoming electronic payments against what you authorized.”
He said companies can reduce paper-check exposure by converting vendors to electronic payments and locking remaining check stock. Criminals still harvest checks because clearing takes time; digital channels with dual controls and alerts shrink that window.
Fourth, treat ransomware and email compromise as operations problems, not only IT problems. Patch systems on a schedule. Use multifactor authentication everywhere money or data lives. Keep offline, tested backups. Write a one-page incident plan that names who calls the bank (and the verified number they will dial), counsel, and insurance, and who has authority to freeze payments. The FBI discourages paying ransom; recovery speed still depends on knowing the first hour’s steps before that hour arrives.
“We also encourage training accounts payable personnel, and those who manage vendors, on a recurring basis,” Taylor said. “Simulate what a phishing email would look like. Test whether they take the bait and click on the suspicious link or begin making a transfer. This isn’t about shaming people. It’s about giving them practice in a safe environment, so they’re ready when a scammer tries to target the business.”
Keep in mind: Fraudsters often pose as a trusted partner, like the bank, and may contact finance or payroll departments with the intent of obtaining user credentials or providing what they describe as a new link for logging into financial management systems. That’s a red flag. And remember: legitimate banks will NEVER ask for the combination of your User ID and Password.
Why the tour keeps moving
What Taylor advises – Stop. Call. Confirm. – and being wary of people asking about sensitive information – really applies to everyone. Consumers would be wise to follow the same precautions. Regions Bank has a section of its website – www.regions.com/STOPFRAUD – dedicated to empowering people with information.
Housing an account is a product. Helping a client protect that account is a practice. Dual controls, callback verification, Positive Pay, daily reconcilement, patched devices, and a written response plan are the practices. The fraud education tour is how Regions keeps putting those tools in front of the people who need them—across the footprint, and next, in Birmingham this September.
