Payment fraud often exploits routine processes: a convincing message asks staff to change bank details, pay an urgent invoice, or bypass an approval. A small business can reduce risk by separating request, verification, and payment steps.
Set clear payment rules
Document who may create vendors, change payment instructions, approve invoices, and release funds. Use named accounts rather than shared logins. Define approval thresholds and a second approver for high-value or unusual payments. Make the process easy to follow under time pressure.
Verify changes through a trusted channel
- Do not rely on the phone number, link, or reply address in the change request.
- Call a previously verified contact using an existing vendor record or official website.
- Read back the requested account change and record who confirmed it and when.
- Have a second employee review the vendor record before the next payment.
- Watch for first-time, duplicate, out-of-pattern, or urgent payments.
Never ask a vendor to email sensitive banking details unprotected if a safer established method exists. Be cautious of executives' impersonation requests, altered invoices, lookalike domains, and unexpected QR codes. Staff should be allowed to pause a transaction without penalty when a request feels unusual.
Prepare for a suspected mistake
If funds may have gone to the wrong account, contact your bank immediately through a known number and ask about recall or fraud procedures. Preserve the original message and transaction details. Notify your internal response lead and follow your insurer or counsel's advice. Do not continue the conversation with a suspected impersonator.
Review vendor changes and payment exceptions periodically. Use bank alerts and dual authorization where available, but verify their setup with your financial institution.
Conclusion
Independent verification, clear approvals, and rapid escalation make payment changes safer. These controls support—not replace—bank procedures and professional advice for a suspected fraud event.