Recognizing common online business and payment scams

A routine request can carry an expensive change

An invoice arrives from a familiar supplier. The amount looks right, the project name is correct, and the email asks for payment before the afternoon deadline. Only the bank account has changed. That single detail deserves an independent check, even when the rest of the message looks convincing.

Small businesses often rely on a few people who handle purchasing, customer service and payments at once. A scam can exploit that ordinary pressure rather than a lack of intelligence. A useful defense is a process that allows anyone to pause a questionable request without being criticized for slowing work.

This article uses U.S. official guidance and invented examples to explain common situations. It does not assess a particular invoice or guarantee that a payment is legitimate. If money has already moved, contact the financial institution promptly rather than spending hours trying to prove the entire story yourself.

Sources: [1] · [4]

Separate the invoice from the evidence of a purchase

A polished invoice proves only that someone produced a document. Match it with your own records: who authorized the purchase, what was ordered, whether it arrived or was performed, and whether the amount is correct. The FTC identifies fake bills and unwanted directory or advertising charges as recurring business scams.

For a hypothetical repair company, a bill for equipment maintenance should connect to a real order and the person who requested the service. If the recipient cannot find that connection, place the invoice in a review queue rather than guessing that another employee must have approved it.

Make this review possible for substitutes as well as the usual bookkeeper. A short purchase note can identify the supplier, approved amount, purpose and approving person. An absent owner or a busy Friday should not turn unfamiliar charges into automatic payments.

Sources: [1]

Treat new payment details as a separate request

The FBI describes business email compromise schemes in which criminals imitate trusted senders or exploit real email accounts. Familiar wording and a genuine conversation history therefore do not settle whether a new instruction is authorized.

Verify a change using a number or contact method established independently of the suspicious message. Call the known supplier contact from your existing records, or use a trusted official channel you locate separately. Do not use the new telephone number printed beside the new bank details as the only check.

Ask the contact to confirm the change itself, then record who verified it and when. Where staffing allows, have another authorized person review the altered destination before payment. If verification is unavailable, keep the payment on hold while following your contractual and business procedures. Urgency is a reason to check carefully, not permission to skip the check.

Sources: [2]

Keep login verification separate from message links

An unexpected account alert may claim that payments are frozen, a parcel is delayed or a password will expire. Phishing tries to make the link or attachment feel like the quickest solution. Instead, open the service through a known bookmark, its official app or an address you obtain independently.

Look for the claimed problem within that account, or contact support through the genuine service. A search advertisement, caller ID or familiar logo is not enough to establish identity. Avoid entering credentials into a page reached through an unverified message.

Multi-factor authentication, software updates and backups add protection, but they do not replace payment verification. A person can authorize a fraudulent transfer while correctly logged into a secure bank account. Protecting the account and deciding whether the underlying request is legitimate are related but different tasks.

Sources: [3] · [2]

Notice pressure and secrecy

Scammers may impersonate a utility, government office, manager or business partner and demand immediate action. Requests to buy gift cards and reveal their codes, or to keep a transfer secret from colleagues, should trigger a pause and a separate verification route.

Do not turn this into an oversimplified rule that every bank transfer is fraudulent. Legitimate businesses use electronic transfers. The concern is an unexpected, pressured or unverified demand, especially when the requested payment destination or method differs from the established arrangement.

A fictional example: a message apparently from the owner asks an assistant to purchase gift cards for clients during a meeting. The assistant contacts the owner using the usual internal number before doing anything. That pause protects both people; it is not an accusation against the owner.

Sources: [1] · [2]

Use a small payment checklist

Before releasing a payment, answer five questions in plain language. Is this a purchase we actually authorized? Does the amount match our records? Is the payee the correct organization? Have any account or contact details changed? Does the person approving payment have the authority to do so?

Keep the answers with the invoice or payment record. A useful note might say that the service matched an approved order and that unchanged account details matched the established supplier record. A vague note saying looks fine is much less helpful if a question appears later.

For a solo operator, the second check may be a deliberate pause followed by a callback and a fresh review. For a team, separate the person who changes supplier details from the person who releases money when practical. These are suggested controls, not a promise that a particular checklist prevents every loss.

Give staff a way to report uncertainty early

Name one person or channel for suspicious requests and a backup when that person is away. Explain that employees should report a mistaken click or unexpected payment promptly. Punishing an honest report can make the next incident harder to detect.

Use short practice examples based on the business's actual workflow: a changed supplier account, an unexplained renewal fee, a payroll-detail request or a fake delivery notification. Ask what the recipient would verify and which known channel they would use.

A training exercise should test the procedure, not embarrass someone. If the only correct answer is to ask the owner, but the owner is unavailable, the process needs a workable fallback. Write down when a payment can wait and who can authorize an exception after verification.

If money or account information was exposed

Contact the bank, card issuer or payment provider immediately through a trusted channel. Explain what happened and ask whether the transaction can be stopped, recalled or disputed. Recovery depends on the circumstances, payment method and applicable rules; reporting quickly does not guarantee reimbursement.

For suspected business email compromise, the FBI advises contacting your financial institution and reporting to its Internet Crime Complaint Center, IC3. The FTC also accepts fraud reports. Keep the original messages, invoices, transaction references and a clear timeline so you can provide accurate information.

If credentials or device access were exposed, use a trusted device to work with the affected service and qualified IT support on containment and account recovery. If a password was reused elsewhere, those accounts may also need attention. Do not assume that changing one password resolves every kind of compromise.

Sources: [4] · [2]

Be cautious about a second promise of rescue

After a loss, an unsolicited person may offer recovery in exchange for another payment or sensitive information. Do not let the understandable wish to recover funds remove the checks you would apply to any new service. Verify the organization, its role and its terms independently.

Keep the response focused: stop further suspicious activity, contact the legitimate provider, preserve records and follow the appropriate reporting process. Avoid posting full bank details, identity documents or customer information publicly while seeking advice.

A business incident may also raise customer-data, contractual, insurance or notification questions. Those depend on what happened and where the business operates. A generic scam article cannot determine those duties; involve appropriate professional help when information or systems may have been compromised.

Sources: [4] · [5]

Make the safe pause normal

Choose one improvement today: establish a callback rule for supplier-account changes, make purchase approvals easy to find, or identify the person who handles suspicious messages. Test that improvement with a realistic example before adding more complexity.

Review the process after a near miss without blaming the person who noticed it. If the request reached the wrong inbox, update the route. If verification relied on a telephone number that nobody maintained, fix the supplier record. The goal is a repeatable way to establish facts before money or sensitive information leaves the business.