Fraud rarely begins with an obviously suspicious transaction.
It may start with an email that appears to come from a trusted vendor. A payment request from an executive. A check that never reaches its intended recipient. An employee login that falls into the wrong hands.
By the time the transaction looks suspicious, the money may already be moving.
According to the Association for Financial Professionals, 76% of organizations experienced attempted or actual payments fraud in 2025. Checks remained the payment method most frequently affected, with 58% of organizations reporting check fraud.
These attacks are not limited to large corporations. Businesses of every size can be targeted, particularly when they regularly send wires, originate ACH payments, issue checks or maintain large operating balances.
Effective business fraud prevention starts with understanding how common schemes work. From there, companies can build layers of protection around their people, processes, accounts and payment activity.
Common Types of Business Fraud
Fraud tactics continue to evolve, but many incidents fall into several common categories:
- Business email compromise and vendor impersonation
- Check fraud
- ACH and wire fraud
- Online banking account takeover
- Internal or occupational fraud
Each scheme exploits a different weakness. Some target technology. Others exploit employee trust, rushed approval processes or limited oversight.That is why fraud prevention requires more than cybersecurity software. Businesses also need clear payment procedures, strong internal controls and banking tools that provide greater visibility and control.
Business Email Compromise and Vendor Impersonation
Business email compromise, often called BEC, occurs when a criminal impersonates a trusted person or gains access to a legitimate email account.
The message may appear to come from:
- A company executive
- An established vendor
- An attorney or title company
- A customer
- An employee requesting a payroll change
The criminal typically asks someone to send a payment, update banking information or redirect an invoice. The request often includes a sense of urgency, confidentiality or pressure.
Examples include:
“We recently changed banks. Please use the attached wire instructions.”
“I need this payment processed before the end of the day.”
“Do not call because I am in a meeting. Confirm by email once it is complete.”
The message may look convincing because the sender has researched the company, copied a real email signature or accessed an existing conversation.
Business email compromise remains one of the costliest forms of internet-enabled fraud. The FBI continues to identify it as a leading source of reported financial losses for businesses and individuals.
How to reduce business email compromise risk
Create a standard verification process for any request involving:
- New payment instructions
- A change to an existing vendor’s account
- An unusually large transaction
- An urgent wire request
- A change to employee payroll information
Confirm the request using contact information already stored in your records. Do not call the number provided in the potentially fraudulent email.
For significant or unusual transactions, require approval from a second authorized employee. This is commonly referred to as dual approval, dual authorization or dual control.
Employees should also be encouraged to question requests that fall outside normal procedures, regardless of who appears to have sent them. A strong fraud-prevention culture gives employees permission to slow down and verify.
Check Fraud
Checks remain a frequent target even as more businesses move toward electronic payments. In the AFP’s 2026 survey, check fraud affected a greater percentage of organizations than ACH or wire fraud.
Common check fraud schemes include:
- Check washing: A stolen check is chemically altered to change the payee, amount or both.
- Counterfeit checks: Criminals create unauthorized checks using a company’s routing number and account information.
- Altered checks: A legitimate check is intercepted and modified before it is deposited.
- Duplicate deposits: A check is deposited electronically and then presented again through another channel.
- Stolen check stock: Blank checks are taken from an office, vehicle or unsecured storage area.
Warning signs may include missing check numbers, unexpected checks clearing the account, altered images, unfamiliar payees or vendors reporting that payments were never received.
How positive pay can help
Positive pay is a treasury management service that compares checks presented for payment against information supplied by the business.
The company typically submits details such as:
- Check number
- Dollar amount
- Account number
- Issue date
- Payee information, when supported
When a check does not match the information provided, it is identified as an exception. An authorized user can then review the item and decide whether it should be paid or returned.
Reverse positive pay follows a related process but places greater responsibility on the business to review checks presented against the account and make payment decisions within the required timeframe.
Positive pay can provide an important layer of check fraud protection, but businesses still need to review exceptions promptly and maintain accurate issue files.
Other practical controls include:
- Storing check stock securely
- Limiting access to blank checks
- Reconciling accounts frequently
- Reviewing check images
- Avoiding unattended outgoing mail
- Moving appropriate payments to more controlled electronic methods
ACH Fraud
The Automated Clearing House network supports payroll, vendor payments, tax payments and other electronic transactions. Its convenience and reach also make ACH activity a target for fraud.
An unauthorized ACH debit can occur when someone obtains a company’s routing and account numbers. That information may be found on a check, compromised invoice or other business document. ACH credit fraud can occur when an unauthorized person gains access to online banking or manipulates an employee into initiating a payment.
Warning signs include:
- Unrecognized debits
- Unexpected changes to payment amounts
- New recipients or vendors
- Payroll changes that were not independently verified
- ACH activity outside the company’s normal pattern
ACH debit blocks and filters
An ACH debit block generally prevents ACH debits from posting to a designated account.
An ACH debit filter allows the business to establish approved originators or transaction criteria. ACH debits that do not meet those parameters may be blocked or presented for review, depending on the service configuration.
Companies should work with their treasury management team to determine whether a block or filter is more appropriate for each account.
Additional ACH controls may include:
- Dual approval for ACH batches
- Separate user permissions
- Transaction limits
- Alerts for completed or rejected payments
- Restricted access to payroll files
- Regular reviews of authorized users
- A dedicated account for certain payment activity
Wire Fraud
Wire transfers can move significant amounts of money quickly. Once the funds have been released and credited, recovering them may be difficult.
Wire fraud is frequently connected to business email compromise. A criminal may impersonate an executive, vendor, customer or closing agent and provide fraudulent payment instructions. Businesses should treat any change in wire instructions as a high-risk event, even when the request appears to come from a familiar person.
Controls that can help reduce wire fraud risk
Use a documented wire policy that requires:
- Independent verification of new or changed instructions
- A trusted phone number from an existing record
- Dual approval for outgoing wires
- Appropriate transaction and user limits
- Review of the recipient, destination and purpose
- Immediate escalation of unusual requests
Employees should never rely solely on email to verify a change in payment information.
It is also helpful to define who may request, enter, approve and release wire transfers. Access should be limited to employees who need it for their responsibilities.
Online Banking Account Takeover
Account takeover occurs when an unauthorized person gains access to a company’s online banking credentials.
Credentials may be stolen through:
- Phishing emails
- Fake login pages
- Malicious attachments
- Password reuse
- Malware
- Social engineering
- Compromised personal or business devices
Once inside an account, a criminal may attempt to add users, create new recipients, change contact information or initiate transactions.
Potential warning signs include:
- Login alerts at unexpected times
- Password reset notifications you did not request
- New users or payees
- Changes to contact information
- Transactions initiated from unfamiliar locations
- Multifactor authentication prompts you did not trigger
Ways to strengthen online banking security
Use unique passwords for banking systems and never reuse them across other websites.
Enable multifactor authentication whenever it is available. Multifactor authentication adds protection by requiring another form of verification beyond a password.
Businesses should also consider:
- Assigning individual credentials to each user
- Avoiding shared usernames
- Reviewing permissions regularly
- Removing access immediately when roles change
- Using transaction alerts
- Keeping devices and security software updated
- Avoiding online banking through public Wi-Fi
- Restricting administrative rights
- Using a dedicated workstation for payment activity when practical
Employees should never approve an unexpected authentication prompt. An unsolicited approval request may indicate that someone already has the password and is attempting to access the account.
Internal and Occupational Fraud
Not every fraud threat originates outside the company.
Occupational fraud can include:
- Fictitious vendors
- Unauthorized payments
- Expense reimbursement abuse
- Payroll manipulation
- Check tampering
- Theft of cash or inventory
- Financial statement manipulation
Smaller organizations can be particularly vulnerable because employees may hold multiple responsibilities and formal controls may be limited. The Association of Certified Fraud Examiners has found that organizations with fewer than 100 employees can experience substantial median losses from occupational fraud.
Separation of duties
One of the most effective internal controls is separation of duties.
Whenever possible, one person should not control an entire transaction from beginning to end. For example, the employee who creates a vendor should not also approve that vendor’s payments and reconcile the account.
Responsibilities can be divided among employees for:
- Creating vendors
- Entering payments
- Approving payments
- Signing checks
- Reviewing account activity
- Reconciling statements
- Updating user access
Smaller businesses may not have enough employees to separate every duty completely. In that case, an owner, executive or outside accounting professional can perform an independent review.
The goal is not to suggest that employees cannot be trusted. It is to protect the organization and its employees by creating accountability, visibility and consistent procedures.
Seven Business Fraud Prevention Controls to Prioritize
Every business has a different risk profile, but the following controls provide a practical starting point.
- Require dual approval: Require two authorized users for ACH batches, wires and other high-risk transactions when available.
- Use positive pay: Compare issued-check information against checks presented for payment and review exceptions within the required decision window.
- Establish ACH controls: Consider debit blocks or filters for accounts that should not accept unrestricted ACH debits.
- Verify payment changes independently: Confirm new or modified instructions using trusted contact information already on file.
- Separate payment responsibilities: Do not allow one employee to create, approve and reconcile the same transaction without independent review.
- Reconcile accounts frequently: Daily or frequent reconciliation can help identify suspicious activity faster than waiting for a monthly statement.
- Train employees regularly: Fraud training should include current examples of phishing, vendor impersonation, payroll redirection, urgent wire requests and authentication scams.
Fraud controls work best in layers. A technical tool may catch one type of transaction, while an alert employee or approval process may stop another.
What to Do if You Suspect Business Fraud
Speed matters when a suspicious transaction is discovered.
Take the following steps as soon as possible:
- Contact your bank immediately. Provide the transaction amount, date, recipient and any available supporting information.
- Secure affected systems. Change compromised credentials, disconnect infected devices when appropriate and contact your technology or cybersecurity provider.
- Preserve evidence. Keep emails, payment instructions, account records, login alerts and other related information.
- Notify company leadership. Follow your internal incident-response and escalation procedures.
- Contact law enforcement when appropriate. Businesses may also submit internet-enabled fraud reports to the FBI’s Internet Crime Complaint Center.
- Review related activity. Determine whether other payments, accounts, users or vendors may have been affected.
Do not wait for every detail to be confirmed before contacting your bank. Early notification may improve the chances of stopping or tracing a transaction, although recovery cannot be guaranteed.
How Treasury Management Supports Business Fraud Prevention
Many important fraud controls are delivered through a company’s treasury management platform.
Depending on the business and its banking services, these may include:
- Positive pay
- ACH debit blocks and filters
- Dual payment approval
- User entitlements
- Transaction limits
- Account alerts
- Online access controls
- Payment reporting
- Account reconciliation tools
The right combination depends on how the company collects money, pays employees, works with vendors and assigns financial responsibilities.
At InBank, treasury management is part of the broader banking relationship. Our bankers and Treasury Management team work with businesses to understand how money moves through the organization, identify areas of exposure and evaluate controls that may support stronger payment processes.
Technology is important, but so is having access to people who understand your company and can help you navigate questions when something does not look right.
Business Fraud Prevention FAQs
What is the most common type of business payment fraud?
Checks continue to be the payment method most frequently affected by attempted or actual fraud among organizations surveyed by the Association for Financial Professionals. Business email compromise is also a significant threat and can result in substantial losses.
Can positive pay prevent all check fraud?
No. Positive pay can help identify checks that do not match a company’s issued check information, but it does not eliminate every form of fraud. Businesses must submit accurate information, review exceptions promptly and maintain additional internal controls.
What is the difference between an ACH debit block and an ACH debit filter?
A debit block generally prevents ACH debits from posting to the account. A debit filter allows specified transactions or approved originators while restricting other activity. Available functionality and processing requirements may vary, so businesses should review their options with their bank.
Who is responsible for a fraudulent business transaction?
Responsibility can depend on the payment method, timing, account agreement, security procedures and circumstances of the transaction. Commercial account protections may differ from consumer account protections. Businesses should review their agreements and report suspicious activity immediately. Legal counsel can provide guidance regarding a company’s specific circumstances.
How often should a business review it fraud controls?
Review controls at least annually and whenever the company changes banking platforms, employees, payment processes or vendors. Controls should also be reviewed after any attempted or confirmed fraud event.
Build a Stronger Defense Around Your Business
Fraud prevention is not a one-time project. It is an ongoing discipline built around informed employees, defined procedures, appropriate banking controls and consistent oversight.
A good place to begin is by reviewing:
- How your business sends and receives payments
- Who can access each account
- Who can create and approve transactions
- How payment changes are verified
- Which alerts and treasury controls are currently active
- What employees should do when they notice suspicious activity
An InBank business banker or Treasury Management team member can help you evaluate tools such as positive pay, ACH controls, transaction alerts and dual approval based on your company’s operations.
Talk with an InBank banker about building stronger controls around your business accounts and payment activity.
This article is provided for general informational purposes only and is not intended to provide legal, accounting, cybersecurity or financial advice. Fraud-prevention services may reduce risk but cannot prevent or detect every fraudulent transaction. Product availability, terms and functionality may vary.