Payment Fraud Controls Small Businesses Overlook

Here are the controls I see overlooked most often, and what it takes to make each one work in practice.

1. Verifying payment-instruction changes outside the channel that requested them

A vendor emails to say their bank account has changed. The email looks right, the invoice looks right, and the request is polite and urgent. This is the classic setup for vendor-impersonation and business email compromise fraud. It works because the “verification” happens in the same email thread the attacker controls.

The control is simple to state. Confirm any change to bank details with a call to a phone number you already had on file, never one that appears in the request. The overlooked part is the record. Write down who called, which number they used, who confirmed the change, and the date. If you can’t produce that record later, then as far as any reviewer is concerned, the callback never happened.

2. Treating the vendor master file as a payment control

Many businesses guard the “send payment” button carefully and leave the vendor list wide open. Whoever can edit a vendor’s bank details effectively controls where money goes. Find out who has edit rights in your accounting system. Find out whether changes are logged, and whether anyone ever reviews that log. A short monthly review of vendor-record changes, signed off by someone who didn’t make them, closes a surprising amount of exposure.

3. Compensating for limited separation of duties

Textbook controls say no single person should create a vendor, enter an invoice, and release the payment. In a five-person company, one bookkeeper often does all three. That’s normal, but it needs a deliberate compensating control. Two options: the owner reviews a bank-generated payment report rather than a summary prepared by the same bookkeeper, or the bank portal requires a second approver above a set dollar threshold. Choose the threshold on purpose and write it down.

4. Using the controls your bank already offers

Banks commonly offer tools that small businesses never switch on. Typical examples are dual approval for outgoing wires and ACH, per-user payment limits, ACH debit blocks or filters, and check positive pay. Ask your bank which of these are available on your accounts. Then decide, in writing, which ones you’ll use. A control you have declined on purpose is a business decision. A control nobody knew existed is a gap.

5. Defining the exception path before you need it

Fraud rarely comes through the normal process. It arrives as an exception: “The owner is traveling and needs this wire out today.” “The usual approver is out.” “Just this once.” If your procedures don’t say what happens when the normal path is unavailable, staff will improvise under pressure, and that pressure is exactly what social engineering creates. Define who can approve an urgent payment and how that person’s identity is confirmed. Also define what evidence is kept. “Urgent” should trigger more verification, not less.

6. Controlling access to bank and accounting accounts

Shared logins, former employees who still have access, and accounts without multi-factor authentication all turn a payment control into a formality. If you can’t tell which person approved a payment, the approval doesn’t prove much. Review user access to your banking and accounting platforms on a schedule, especially when someone leaves the business, and remove shared credentials.

7. Keeping evidence that controls operated

This is the thread running through every item above. A control is only as strong as the record that shows it ran. For each key payment control, decide what evidence it should leave behind, such as a callback log, an approval in the bank portal, or a signed vendor-change review. Then decide who keeps that evidence and for how long. When something goes wrong, that record is how you work out what happened. It’s also how you show insurers, auditors, or customers that you acted reasonably.

Where to start

You don’t need a large compliance program. Start with a one-page payment-change procedure that covers how changes are requested, how they’re verified, who approves them, and what record is kept. Next, walk through your last few vendor-detail changes and check whether each one would pass that procedure. The gaps you find are your priority list.

If you want an independent review, ARE Global Consulting LLC scopes payment-control assessments around a single question and a defined record set. The deliverable is a control-and-evidence matrix and a prioritized closure list.

This article is general information, not legal or accounting advice. Your controls should reflect your bank’s products, your systems, and your own risk decisions.

About the author

Alfonso Ramon Evans is the founder and principal consultant of ARE Global Consulting LLC, an independent risk-advisory firm in Pittsburgh, Pennsylvania. He advises organizations on fraud risk and payment controls, identity verification, federal vendor and CMMC readiness, and SI workflow decision quality. Read Alfonso Ramon Evans’s founder profile.

This is public advisory analysis. Hypothetical examples are not client results. Service boundaries and information-handling requirements remain applicable.