How Small Businesses Can Protect Against Payment Fraud

Small businesses can protect against payment fraud by slowing down payment approvals, verifying account changes by phone, using dual controls, reviewing transactions daily, training employees and adding fraud detection tools such as Positive Pay, account alerts and treasury management services. The most important step is simple: do not rely on email alone when money or account information is involved.

At Banterra, we encourage businesses to follow a simple rule before changing payment instructions or sending funds:

STOP. CALL. CONFIRM.

• Stop before acting on the request.
• Call the vendor, employee or executive using a known phone number.
• Confirm the change directly before processing the payment.

That extra step matters. Business email compromise, often called BEC, has been reported in all 50 states and 186 countries, with more than $55 billion in exposed losses reported globally between October 2013 and December 2023, according to the FBI Internet Crime Complaint Center. In 2024, the FBI also reported more than $16 billion in total internet crime losses, with phishing, spoofing and fraud-related schemes continuing to affect businesses and consumers.

Why Payment Fraud Is A Serious Business Risk

Small business payment fraud can happen when criminals trick employees into sending money, changing vendor payment instructions, updating payroll direct deposit information or approving fake invoices. These scams often look like normal business activity, which is why they can be easy to miss.

For example:

• An accounts payable employee receives an email that appears to be from a trusted vendor asking to update ACH instructions.
• A payroll employee receives a message that looks like it came from an employee requesting a new direct deposit account.
• A bookkeeper receives an urgent wire request that appears to come from an owner, CEO or manager.

The risk is not limited to one payment type. Criminals may target ACH payments and wire transfers, paper checks, payroll files, vendor invoices and online banking credentials.

The goal is not to make payments harder for your team, but to make fraudulent requests easier to catch before money leaves the account.

Related Reading: A Complete Guide To Cybersecurity For Small Businesses

Common Payment Fraud Schemes To Watch For

What Is Payment Fraud?

Payment fraud happens when someone uses deception, stolen information, account takeover or false payment instructions to move money without proper authorization. For small businesses, this may involve ACH fraud, wire fraud, fake invoices, vendor impersonation, payroll direct deposit changes or business email compromise.

Common payment fraud schemes include:

• ACH Fraud: A criminal attempts to create, change or redirect an ACH payment.
• Wire Fraud: A scammer pressures an employee to send a wire transfer to a fraudulent account.
• Business Email Compromise: A fraudster uses a spoofed, hacked or look-alike email account to request payment.
• Vendor Impersonation Fraud: A scammer pretends to be a legitimate vendor and asks your team to update payment details.
• Payroll Fraud: A criminal requests a change to an employee’s direct deposit account.
• Fake Invoice Scams: A business receives an invoice for goods or services that were never ordered or completed.
• Urgent Executive Requests: A scammer impersonates an owner, CEO, manager or board member and asks for immediate payment.

ACH And Wire Fraud Red Flags

How Can Small Businesses Prevent ACH Fraud?

Small businesses can help prevent ACH fraud by requiring verbal verification for new or changed payment instructions, using dual approval for ACH files, limiting employee access by role, reviewing account activity daily, setting account alerts and using tools such as ACH Positive Pay when available.

ACH and wire fraud often starts with a request that feels routine. The message may use familiar names, vendor logos, invoice numbers or urgent language.

Before processing a payment, watch for these red flags:

• A vendor suddenly asks to change routing or account information.
• An employee requests a direct deposit change by email only.
• A wire request arrives near the end of the day or before a holiday.
• The sender says the payment is confidential or cannot be discussed.
• The email address is slightly different from the real sender’s address.
• The payment amount or destination does not match past activity.
• The request pressures your team to skip normal approval steps.
• The sender provides a new phone number for verification.
• The invoice includes updated remittance instructions without prior notice.
• The request comes from an executive who is unavailable for questions.

If something feels rushed, unusual or slightly different from the normal process, pause before acting.

Vendor Impersonation And Fake Invoice Scams

What Is Vendor Impersonation Fraud?

Vendor impersonation fraud happens when a scammer pretends to be a real vendor, contractor or supplier and asks a business to send payment to a new account. The request may involve updated ACH instructions, a new mailing address, a fake invoice or a change from check payments to electronic payments.

These scams can be difficult to spot because the fraudster may know details about your business relationship. They may reference a real project, use a copied email signature or send an invoice that looks similar to past invoices.

A safe vendor payment process should include:

• A current vendor contact list maintained outside of email.
• A rule that all payment changes require phone verification.
• A second employee review for new vendors and account changes.
• Documentation of who verified the request, when they called and which number they used.
• A review of invoice amounts, purchase orders and prior payment history.
• A waiting period for first-time payment changes when possible.

The safest verification call is made to a phone number your team already has on file, such as the number from the original vendor agreement, prior records or the vendor’s official website. Do not use the phone number listed in the suspicious email, invoice or payment change request.

Why “Stop. Call. Confirm.” Matters

Fraudsters often rely on speed. They want your team to react quickly, feel pressure and skip the normal review process. That is why STOP. CALL. CONFIRM. should be part of your written payment verification process.

Stop

Do not process the request based on email instructions alone. Pause when a request involves a new payment method, updated account number, changed routing number, new mailing address, urgent wire or confidential executive instruction.

Call

Call the vendor, employee or executive using a known phone number. This should be a number already stored in your records, listed in a signed agreement or published on the official website.

Do not reply to the suspicious email. Do not call the number included in the email. If the message is fraudulent, that number may connect you directly to the scammer.

Confirm

Confirm the details before sending funds. Ask whether the change was actually requested, verify the account or payment information and document the conversation. If the person cannot confirm the request, do not process the payment.

For more guidance, Banterra’s fraud education resources include information about scams, privacy, security, business email imposters, ACH and wire fraud, vendor impersonation fraud and related threats.

Payment Verification Steps Every Business Should Use

What Should Employees Do Before Sending A Wire?

Before sending a wire, employees should verify the request with an approved contact using a known phone number, confirm the payment amount and account details, require a second approval, document the verification and review the request for urgency, secrecy or email changes.

Use this checklist before approving ACH, wire, invoice, vendor, or payroll payments:

1. Review The Request Carefully
   Check the sender’s email address, payment amount, account details, invoice number, timing, tone, and any changes from normal payment activity.
2. Compare The Request To Existing Records
   Look at the vendor file, employee payroll record, contract, purchase order, or prior invoice history.
3. Verify Changes By Phone
   Call a known contact using a verified phone number already on file. Do not use contact information included in the suspicious request.
4. Use Two-Person Approval
   Require one employee to enter or prepare the payment and another employee to approve it.
5. Separate Duties
   Avoid giving one person full control over vendor setup, payment entry, approval, and account reconciliation.
6. Document The Verification
   Record the date, time, person contacted, phone number used and confirmation details.
7. Set Limits And Permissions
   Limit payment access based on job responsibilities. Review user access regularly, especially when employees change roles or leave the business.
8. Review Account Activity Daily
   Daily review can help your business identify unusual ACH, wire, check, or debit activity more quickly.
9. Use Alerts
   Set account alerts for high-dollar transactions, low balances, login activity, outgoing transfers, and other account changes.
10. Train Employees Regularly
    Train anyone involved in payments, payroll, vendor management, and account reconciliation. Fraud prevention is not just an accounting department issue.

Explore Treasury Management Tools

How Treasury Management Tools Can Support Fraud Prevention

Strong procedures are the foundation of payment fraud prevention, but the right tools can add another layer of protection. Banterra’s treasury management services are designed to help businesses manage payments, monitor accounts and streamline cash management processes.

Business owners and finance teams may benefit from tools such as:

• Check Positive Pay: Check Positive Pay can help reduce exposure to check fraud by comparing checks presented for payment against the check information your business provides.
• ACH Positive Pay: ACH Positive Pay can help businesses review certain ACH debits and decide whether to approve or return them based on approved or blocked lists.
• Fraud Detection Tools: Fraud detection tools can help flag unusual or potentially unauthorized activity.
• Account Alerts: Alerts can help your team monitor transactions and account activity more closely.
• Dual Controls: Dual controls require more than one user to complete certain payment actions.
• Cash Management Tools: Banterra’s Cash Management help businesses manage accounts, payments, transfers and account activity more efficiently.
• ACH Payments And Wire Transfers: Banterra offers tools for ACH payments and wire transfers that can support more efficient business payment processes when paired with strong internal controls.

No product or process can stop every fraud attempt. However, combining banking tools with employee training and written verification procedures can help reduce risk.

Build A Stronger Payment Fraud Prevention Plan With Banterra

Payment fraud prevention works best when it becomes part of your daily routine. Your employees should know when to pause, who to contact, how to verify a request and when to escalate a concern.

A strong small business payment fraud prevention plan should include:

• Written payment approval procedures.
• Required phone verification for payment changes.
• Dual approval for ACH, wire, vendor and payroll updates.
• Check Positive Pay or ACH Positive Pay when appropriate.
• Account alerts and regular account review.
• Employee training for business email compromise and vendor impersonation fraud.
• A documented response plan if fraud is suspected.
• Regular reviews of user access, limits and permissions.

If your business sends ACH payments, wires, payroll or vendor payments, we can help you review your current process and explore tools that fit your needs. Our team can also connect you with fraud education resources to help your employees recognize common scams.

Talk With Banterra About Fraud Prevention

Frequently Asked Questions

What Is ACH Fraud?

ACH fraud happens when someone attempts to send, redirect or withdraw money through the Automated Clearing House network without proper authorization. For businesses, this may involve unauthorized ACH debits, altered vendor payment instructions, payroll direct deposit changes or fraudulent ACH files.

How Do Businesses Verify Payment Changes Safely?

Businesses should verify payment changes by calling a known contact using a phone number already on file. Do not use the phone number listed in the email, invoice, or change request. After the call, document who confirmed the change, which number was used and when the verification occurred.

What Is Business Email Compromise?

Business email compromise is a scam where criminals use a spoofed, compromised, or look-alike email account to trick employees into sending money or sharing sensitive information. These scams often impersonate executives, vendors, employees or business partners.

Can Positive Pay Help Reduce Check Fraud Risk?

Positive Pay can help reduce check fraud risk by comparing checks presented for payment against the check information your business submits. If something does not match, your business can review the exception and decide whether the check should be paid or returned.

What Should We Do If A Fraudulent Payment Was Sent?

If a fraudulent payment was sent, contact Banterra immediately, notify any other financial institution involved, preserve emails and records and report the incident to law enforcement. You may also file a report with the FBI Internet Crime Complaint Center at IC3.gov. Quick action is important, but recovery is not guaranteed.