I was quite surprised to receive a notification on my phone… I had just received a sizable and completely unexpected e-transfer.
In the interest of privacy, I won’t be naming anybody in this story. This could have happened to anybody… and it could have ended a lot worse.
I have autodeposit on my personal and business bank accounts, so that e-transfers automatically deposited and aren’t delayed by pesking e-transfer security questions. This was a legitimate e-transfer, not some fraudulent transaction. But sometimes a bunch of random circumstances align to make you question yourself.
It was late when I received the notification, so I decided to address the issue with my bank the following day.
The next day, I received an email from the sender before I was able to contact the bank. This gentleman’s story was simple; he was opening a restaurant and the payment was for his plumber. He made an oopsie and could I send the money back? He needed the money back quickly make payment.
My security senses tingled when I noticed the sender was using a Gmail account based in India. India has been linked to a significant number of cyber-enabled fraud operations over the years, and accidental e-transfer refund scams have become increasingly common in Canada. That didn’t mean this sender was a scammer, but it did mean I wasn’t going to assume everything was legitimate.
The first thing I did was indicate I would be reaching out to my bank. The sender email a photo of his plumber’s business cards. You can fake these kind of items with AI, so I wasn’t 100% convinced.
Later that day, I did reach out to my bank’s security department and told them all the details. I was told that everything looked honest and above board, and that I should go ahead and return the money. OK. I can do that. I had other things to do that day, so I made plans to return the money the following day.
Sometime between talking to the security department and me logging into my online banking, the security department had flagged my account for fraudulent activity! I could access my other accounts but this particular business account had been flagged for some reason and I couldn’t access my account to transfer a cent. Back on the phone with the security department and the only thing I was told was my account was flagged and I needed to go into the branch.
Once I was at my bank branch, I shared all the details of the transfers and emails. The branch manager spoke with me, and then spoke with the sender’s branch for about 10 minutes. After that, I was given the all-clear. My account was unlocked and I was able to send the money back to the sender.
The source of the lock? My drivers license on file had expired… so they needed to have in the the branch to ensure I was me, and to update my information. While a bit frustrating, it was grateful to know that the bank took security seriously.
The Hidden Cost of Free Email
Every step of this ordeal happened because it was difficult to establish trust. A business email doesn’t eliminate mistakes, but it gives clients, customers, suppliers, and banks one more singnal they’re dealing with the right business.
Using a personal email address for etransfers like this can be problematic, as this sender found out. The autocomplete in his browser completed the email with the wrong email provider name… et voila, I received a deposit. If you use something like [email protected] instead of [email protected], it can easily get confused, or get something mucked up with autocomplete.
The sender was panicked he had lost his money. The plumber recipient had to wait a few days to get paid for his work. And I had to spend time getting it all resolved at my end. This didn’t cost anybody money, but everybody paid with their time. A perfectly innocent mistake complicated by an inability to establish trust.
Business Email Is A First Step
Business email can help prevent mistakes and issues like this. Establishing trust makes a good first impression; however, it’s important to protect your domain security and sending ability. Business email is tied to your domain, allowing you to implement DMARC, DKIM, and SPF security mechanisms to protect your domain and email reputation.
The broader lesson here is that businesses should do everything they reasonably can do to make themselves identifable and trustworthy. Don’t let a free email cost you time, money, or reputation.
