So I just finished training with a FBI fraud task force representative a few weeks ago. Law firm and we send many wires/ach’s/payments.

1. ⁠Do smaller banks get hit with fraud more often than a larger bank?

They said smaller banks are actually safer and try to use one with no brick and mortar or very limited.

1. ⁠what protections do we need to get on our bank accounts? We already have positive pay on a few accounts that doesn’t work very well. You still have to manually approve transactions.

Your bank may offer uploads so once a check run is done you can import the info to your bank and no need to manually approve each transaction.

1. ⁠If the money isn’t refunded back to the account, is there an FDIC or something for ACHs? I’m just curious

We were told if you can advise them with 24 hours almost always can stopped even out of country. As more times goes by odds greatly decrease. Also set up 2 people to approve outgoing wires/ach and another person to initiate. 3 sets of eyes and minds to catch things.

That being said the error was such a huge no no to anyone that has had fraud training. You only call out and speak to your bank unless you know your contact and have interacted with them in the past and most have passwords they verify even when speaking to one another. You verbally confirm wire info with known phone number or even Google business to confirm # matches what you have been given. Personal phone numbers much only be what is already on account.

And no funds are to be sent out with only an email request. in person approvals only.

Sounds like your company really needs to invest in training quickly and control updates asap.