Small businesses are a favorite target for payment fraud. They move real money, often have one person handling payments and rarely have a dedicated security team. The good news is that most attacks follow a few predictable patterns, and a handful of simple controls stop the majority of them.

The three most common schemes

Almost every payment fraud attempt we see on small businesses falls into one of three categories. Knowing them is the first line of defense, because each one relies on someone acting quickly without checking.

• Changed bank details, where a supplier appears to email new payment details shortly before a large bill is due

• Executive impersonation, where a message that looks like it comes from a founder asks for an urgent transfer

• Fake invoices, where a convincing bill arrives from a vendor you have never used or for work that never happened

Verify bank detail changes by phone

Changed bank details are the most costly scheme because the payments are often large and look completely normal. The rule is simple: never change a supplier’s bank details based on an email alone. Call the supplier on a phone number you already have on file, not one listed in the email, and confirm the change with someone you know.

It also helps to hold the first payment to any new bank account for a day and to notify the supplier when it is sent. If the change was fraudulent, the real supplier will tell you quickly that they have not been paid.

Slow down urgent requests

Executive impersonation works by creating pressure. The message says the payment must go out today, the founder is in a meeting and cannot talk, and the request should stay confidential. Every one of those details is designed to stop you checking. Agree as a company that no payment request is too urgent to verify through a second channel, and that founders will never be offended when someone calls to confirm.

Require two approvers for large payments

Dual approval is one of the most effective controls a small business can add. When any payment above a set amount needs a second person to approve it, a single compromised email account or a single mistake is no longer enough to send money. Choose a threshold that fits your business, such as $5,000, so the extra step applies only where the risk is real.

• Require a second approver above a set amount

• Require approval for every new vendor and every bank detail change

• Separate the person who creates a payment from the person who approves it

• Review the approval log each month

Lock down your accounts

Many fraud attempts begin with a stolen password. Turn on two-factor authentication for your email, your bank, your accounting software and every finance tool, ideally using an authenticator app, a passkey or a hardware security key rather than text messages. Give each person their own login, never share credentials, and remove access the same day someone leaves the company.

Use cards with controls

Company cards are another frequent target. Cards with individual limits, merchant category restrictions and instant freezing limit the damage if a card number is stolen. Use a separate virtual card for each online vendor, so a breach at one website affects only one card, and you can replace it without updating every other subscription.

Train the team once a quarter

Technology helps, but the final control is a person who pauses before paying. Spend fifteen minutes each quarter showing your team real examples of fraudulent emails and invoices. Make it clear that reporting a suspicious message is always the right call, even when it turns out to be genuine.

If something goes wrong

If you think a fraudulent payment has been sent, speed matters. Contact your bank or payment provider immediately, because funds can sometimes be recalled within hours. Freeze any affected cards, change passwords on compromised accounts and report the incident to the FBI’s Internet Crime Complaint Center. Then review which control would have caught it and put that control in place. At Ledgerly, our support team can freeze accounts and start a recall request around the clock.