Protecting Your Business From Fraud and Scams
How the most common small-business scams work, from fake payment changes to upfront-fee loan offers, and the simple controls that stop them.
Scammers love small businesses. You move real money, you are busy, and there is often one person handling everything. A rushed email from a "vendor" or a "lender" at 4:45 on a Friday is exactly how many owners lose thousands.
The good news is that most business fraud follows a handful of patterns. Once you know them, a few habits stop the majority of attacks.
Business email compromise and payment changes
In business email compromise (BEC), a criminal hacks or imitates the email of a vendor, employee, or executive and asks you to send money somewhere new. The classic version: "We changed banks. Please send this invoice to the new account below." According to the FBI's 2025 Internet Crime Report, BEC caused over $3 billion in reported losses, second only to investment fraud.
The call-back rule
Any request to change bank details or send an urgent wire gets a phone call to a number you already have on file. Never use the phone number or link in the email asking for the change.
Fake invoices and check fraud
Fake invoices look official and are often for small amounts that slip through: directory listings, "domain renewals", or office supplies you never ordered. Only pay invoices that match a purchase order or a vendor you recognize.
Checks are still a favorite target. Thieves steal them from the mail, then alter the payee or amount, or print counterfeits using your account number. Ask your bank about positive pay, a service where you send the bank a list of checks you issued, and it flags anything that does not match before paying. Paying vendors electronically when possible also cuts the risk.
Fake lenders and advance-fee loan scams
Owners looking for capital are prime targets. Scammers impersonate real lenders and funders, use look-alike websites and logos, and promise guaranteed approval regardless of credit. Then they ask for an "insurance fee", "processing fee", or "first payment" before releasing the funds. The money never comes.
A hard rule worth memorizing
No legitimate lender asks for an upfront fee via gift card, wire, or cryptocurrency before you receive your funding. Legitimate costs are disclosed in your agreement and usually come out of the funding or your repayments. See the true cost of financing for what real pricing looks like.
If an offer reaches you unexpectedly, look up the company yourself, call its published number, and confirm the person and offer are real. Pressure to decide today is a warning sign on its own.
Myth or fact? Tap to flip
Employee and insider fraud
Most insider theft happens when one person controls a process from start to finish. A few controls go a long way, even in a three-person business:
- Separate duties: the person who enters bills should not also approve and pay them.
- Review statements yourself: open bank and card statements every month and scan for unfamiliar payees.
- Require two approvals for payments above an amount you choose, and for any new vendor.
- Limit access: give employees only the banking permissions they need, and remove access the day someone leaves.
- Take vacations seriously: when someone else covers a role for a week, hidden schemes often surface.
Owner story
Marisol got an email from her mulch supplier saying its bank had changed, with an invoice for $18,400 attached. The logo and signature looked right. Her office manager followed their new rule and called the supplier's number from an old invoice. The supplier had never changed banks. Its email had been hacked, and two other customers had already paid the fake account.
Illustrative composite, not a real customer.
If you do get scammed, call your bank immediately and ask it to try to recall the payment, then file a report at the FBI's Internet Crime Complaint Center (ic3.gov). Speed matters: the faster a wire is reported, the better the chance of freezing it.
Fraud defenses to set up this month
0/7 doneWords to know
- Business email compromise (BEC)
- A scam where criminals hack or imitate business email to redirect payments.
- Positive pay
- A bank service that matches presented checks against the list you issued and flags mismatches.
- Advance-fee scam
- A fraud that demands payment up front for a loan or prize that never arrives.
- Segregation of duties
- Splitting money tasks so no single person controls a payment from start to finish.
Finished reading?
Track your progress through Stage 6: Protect & Plan.
Related lessons
Sole Proprietor, LLC, or S Corp? Choosing Your Structure
A plain comparison of the common business structures, what each one changes about liability, taxes, and paperwork, and when an S corp election starts to make sense.
Building a Cash Cushion for Your Business
How big your reserve should be, where to keep it, and a simple allocation habit that builds it without a windfall.
Bonding, Licensing, and Insurance for Contractors
Understand the bonds, licenses, and policies that let you bid bigger work and keep one bad day from sinking the company.