Small businesses are frequent targets for fraud, and it rarely looks dramatic. It looks like a vendor's email, a normal invoice, or an employee updating their bank details. The good news is that a handful of simple controls stop most of it.
The schemes we see most often
- Changed bank details. An email that appears to come from a real vendor says they've switched banks and asks you to pay a new account. The email is fake, sometimes sent from a lookalike address, and the money goes to the fraudster.
- Payroll diversion. Someone impersonating an employee asks HR or payroll to update their direct deposit. The next paycheck disappears.
- Fake invoices. Bills for services you never ordered, such as directory listings or software renewals, sent in hopes someone pays without checking.
- Check fraud. Checks are stolen from the mail, altered, and cashed for larger amounts or to different payees.
- Inside jobs. When one person can create vendors, approve bills, and send payments, mistakes and theft can go unnoticed for a long time.
Controls that actually work
- Verify every change by phone. When anyone asks to change payment details, call them at a number you already have on file, never one from the email.
- Require two people for payments. Have one person set up a payment and another approve it, at least above a dollar amount you choose.
- Turn on bank fraud tools. Ask your bank about positive pay, which flags checks that don't match what you issued, and blocks or filters on unexpected electronic withdrawals.
- Use multifactor authentication on your bank, payroll, and accounting logins.
- Set card limits. Give each employee card a spending limit and restrict it to the categories it's meant for.
- Review statements yourself. Even if someone else keeps the books, look over the bank statement every month. People are less likely to take chances when they know the owner looks.
- Reconcile every month. Fraud hides longest in books that are months behind.
If something happens
Call your bank immediately. The sooner they know, the better the chance of stopping or recovering a payment. For email-based scams, also file a report with the FBI's Internet Crime Complaint Center at ic3.gov, then change passwords and review who has access to your accounts.
If this were our business
We'd turn on dual approval and positive pay this week, however small the business. Both take minutes to set up, and the scams they stop can erase months of profit.