Why small businesses are a target
Small businesses pay invoices, manage vendors and move money every week, often with a few people handling it all. There may be no dedicated security team, staff may be busy, and one person may both receive and approve a payment. Scammers know that a routine-looking request at a busy time has a good chance of passing unchecked.
The most common approach is invoice fraud, and it needs no technical hacking. It relies on a believable message and a payment sent to the wrong account.
Three common patterns
Fake invoices
A fraudster sends an invoice for goods or services the business never ordered. It may look like it comes from a familiar company, copy a real logo, or arrive as an attachment or a link to a “payment portal.” In a small office, someone may assume another colleague ordered the service and pay it. Some fake invoices are for ordinary-seeming items such as office supplies, directory listings, domain renewals or software subscriptions.
Payment redirection
The scammer pretends to be an existing supplier, contractor or landlord and says the bank details have changed. The message may be sent from a lookalike email address, or from a genuine address that has been taken over. If the change is accepted, the next legitimate payment goes to the scammer’s account. The problem is often not noticed until the real supplier asks why they have not been paid.
Supplier and executive impersonation
A message appears to come from the owner, a manager or a senior colleague asking staff to make an urgent transfer or buy gift cards. The same technique can imitate customers or tax and regulatory bodies. The wording of these requests is covered more fully in the guide on executive impersonation emails. They often stress secrecy and speed, and may ask the recipient not to call.
Related tricks include a fake “overdue” notice, a payment confirmation that claims you have been overpaid and asks for a refund of the difference, and messages that look like a vendor’s request to confirm a login.
Warning signs
- A request to change bank account details, especially by email alone.
- An unexpected invoice, or one that differs from usual amounts, wording or format.
- Pressure to pay quickly, or to bypass normal approval steps.
- A sender address that is almost, but not exactly, the usual one. Lookalike web addresses and email domains can differ by a single letter.
- A request not to discuss the payment with anyone else.
- A new payment method, such as a different country, a personal account or cryptocurrency.
- Messages arriving at unusual times or from people who rarely handle payments.
Simple verification routines
You do not need expensive tools. Written habits that everyone follows are the most effective defense.
- Verify changes of bank details by phone. Call the supplier using a number you already had on file or from their official website, never the number in the message. Record who confirmed the change and when.
- Match invoices to orders. Before paying, confirm that someone actually ordered the goods or services and that they were received. A purchase order or simple approval note is enough.
- Separate duties where possible. Ideally the person who adds or changes a vendor’s bank details is not the person who approves the payment. In a very small business, even asking the owner to review changes helps.
- Set a second approval for new payees and large payments. Choose a threshold that suits your size.
- Keep a trusted vendor list. Store official contact details and bank information in one place, and compare any new request with it.
- Be careful with links and attachments. Go to the supplier’s portal by typing the address or using a saved bookmark, and treat unexpected attachments with care.
- Make it safe to question. Staff should feel comfortable pausing a request, even if it appears to come from the owner.
Account protections matter as well. Use unique passwords and two-step sign-in on business email and accounting software, because a taken-over mailbox makes impersonation far more convincing. A broader view of protections appears in guidance on small business cybersecurity.
If you have paid a fraudulent invoice
Act as quickly as you can, because speed can affect whether funds can be stopped.
- Call your bank right away and ask whether the payment can be recalled or flagged. Explain that it was a suspected fraud and ask about the next steps. Recovery is not guaranteed, and it depends on the payment type and timing.
- Check email security. If a mailbox was compromised, follow hacked account response steps, change passwords and review forwarding rules and signed-in devices.
- Warn the real supplier or colleague that their name was used, and let other staff know what to watch for.
- Keep evidence: the original messages with full headers if possible, invoices, bank records and notes of any calls.
- Report it to your local police or your country’s fraud-reporting service, and tell your insurer if you have a relevant policy.
- Review what failed. Treat it as a process gap, not a person’s fault, and adjust the routine.
If an employee made the payment, avoid blame. Fear of punishment makes people hide mistakes, and prompt reporting is what limits the damage.
A realistic mindset
No routine removes all risk, and scams keep changing. What helps most is making verification a normal step, so that checking a request by phone is routine rather than awkward. Even one extra phone call before changing bank details prevents many of the most costly cases.
This is general information, not legal, accounting or insurance advice. For particular circumstances, speak with your bank and a qualified professional.