The email looked completely normal. Same vendor name, same logo in the signature, and the tone matched your shipping supplier’s usual clipped style. The only thing different was a line near the bottom asking payments to go to a new bank account starting this month, due to an internal update on their end. Someone on your team wired the invoice amount without a second thought. Three weeks later, the real vendor calls asking why their payment never showed up.
That scenario isn’t rare anymore, and it isn’t just a big-company problem. A national survey of small business owners, conducted by Morning Consult for the Public Private Strategies Institute, found that 72 percent of small businesses were hit by fraud, scams, or ransomware last year. Collectively, that cost small businesses at least 131 billion dollars. Average losses ran close to 60,000 dollars for payment fraud and topped 90,000 dollars for email compromise specifically.
Follow the Money
Most fraud conversations get handed to IT. A firewall doesn’t catch a bookkeeper wiring money to a bank account that was quietly swapped in an email thread. What catches that is someone actually looking at the transaction before it goes out the door, asking whether this vendor’s details match what’s on file, and being willing to pick up the phone and confirm before hitting send.
Fraud against small businesses increasingly runs straight through the accounting function. Fake invoices and altered ACH instructions both show up first as a transaction, not as a suspicious link in an email. So does someone impersonating an owner or a vendor, right down to a convincing signature and a familiar tone. The dangerous part is how ordinary these transactions look. Nothing about them screams fraud in the moment, which is exactly why they work. AI is only making that ordinariness harder to spot. Seventy one percent of small business owners already expect artificial intelligence to make these attacks more frequent, and among businesses that have already been targeted, 76 percent say AI played a role in the attack itself.
Two Different Moments Where This Gets Caught, or Doesn’t
It helps to separate two things that get lumped together. Before a payment goes out, the job is verification. Does this vendor’s bank information actually match what’s on file, and has anyone confirmed a change request through a known phone number rather than the email that requested it? Requiring a second approval above a set dollar amount adds another checkpoint before the money moves. That’s where most fraud actually gets stopped, if it gets stopped at all, because once a wire clears, getting the money back is genuinely difficult.
After a payment posts, the job is different. Timely reconciliation and a regular review of the account won’t undo a payment that’s already gone out, but it will surface an unauthorized charge, a duplicate payment, or an unusual transaction fast, often within days instead of months. A duplicate invoice caught a week later is a phone call and a refund request. The same thing caught during an annual cleanup is a much harder conversation, and sometimes an unrecoverable one.
Checks remain a favorite target. In the 2026 AFP Payments Fraud and Control Survey Report, 58 percent of organizations reported experiencing check fraud in 2025, ahead of both ACH and wire transfers, largely because a check can be altered well after it’s written and mailed, long after anyone approved the original amount.
What This Looks Like Inside a Set of Books
This comes down to someone who actually knows what a business’s normal vendor activity looks like, well enough to notice when something’s off, whether that’s a bank account that changed without a heads up or the same amount billed twice in the same week. Treating a payment detail change as a reason to verify, rather than a reason to move faster, is a bookkeeping habit before it’s anything else. It’s also the kind of thing that only gets caught by someone who’s actually in the books often enough to know what normal looks like for that particular vendor, at that particular amount.
Ask one question this week. What would have to happen before someone here sent 25,000 dollars to a new bank account? If the answer is they’d get an email, you found the problem.