How Small Businesses Actually Lose Money To Payment Fraud

The fraud that empties small business accounts is rarely sophisticated. It is a request to change payment details, arriving at the right moment, from an address that looks correct.

Business email compromise

The pattern is consistent. An attacker gains access to an email account — a supplier's, a client's, or your own — and watches. When a genuine invoice is due, they send updated bank details, or they intercept the real invoice and reissue it with their own account.

Because the request arrives inside a real thread, referencing a real transaction, with correct amounts, it survives scrutiny that a cold approach would not.

The control that works

One rule prevents nearly all of it: bank details are never changed on the basis of an email. Any change is verified by calling a number you already hold for that supplier, not a number in the message.

Write it down, apply it to everyone including the chief executive, and make clear that following it is never a career risk. Most losses occur because a junior member of staff did not feel able to question an urgent instruction apparently from a senior one.

Payroll diversion

The same attack targets payroll. An email purporting to come from an employee asks for their direct deposit details to be updated. Verify these changes through a separate channel — in person, or by calling the number in your records.

Cards and chargebacks

For businesses taking card payments, the exposure is different: chargebacks. Keep delivery confirmation and customer communications, use the address and security checks your processor offers, and understand your evidence obligations before a dispute rather than during one.

Speed of response

If a fraudulent payment is made, contact your bank immediately — recovery is sometimes possible within a short window and rarely afterwards. Report it to the bank, to law enforcement, and to your insurer if you carry crime or cyber cover.

The businesses that recover funds are the ones that noticed within hours, which is an argument for reconciling accounts daily rather than monthly.