Prevent & Protect: Commercial Fraud Playbook

Business email compromise, invoice and vendor fraud, check fraud, payroll diversion, account takeover, card fraud, and insider theft.

Sometimes, if you act quickly. Funds can often be intercepted within hours, but rarely after days. Wires and checks offer some prospect of recovery; instant payments and cryptocurrency almost none. Call your bank for specific recovery options.

Payment-system remedies such as recalls and chargebacks; claims against the bank; civil claims against the fraudster or whoever received the money; and insurance. Sometimes multiple remedies can be pursued at once. The big takeaway is to notify your institutions quickly.

Call your bank's fraud line first. Then freeze the account, halt pending payments, reset credentials, preserve the emails and logs, and report to law enforcement the same day. Notify your insurer. Investigate afterward notification. Time is of the essence.

Absolutely. A false alarm costs a phone call. Waiting for certainty can cost the entire payment.

Two things: Verify every new or changed payment instruction by calling the counterparty on a number you already hold—never one supplied in the request. That single step defeats a compromised mailbox, a spoofed domain, and a cloned voice alike. Second, closely monitor your accounts.

This depends on a host of factors specific to each case. To determine liability, you’ll need to know how the payment was made, what your account agreement says, and where you are geographically (provisions vary by state or province).

Those with high payment volumes, urgent transfers, and many counterparties, like real estate, legal, construction, manufacturing, healthcare. But the real vulnerability is structural: any business where one person can both add a payee and release a payment.

Watch for urgency paired with secrecy, changed banking details, a sudden switch of communication channel, small oddities in a domain or invoice, or strange or unverifiable charges in your account.

There are several ways you can protect yourself. Layer your controls. Monitor accounts. Verify payment instructions. Require dual authorization. Use Positive Pay and ACH filters. Don’t mail checks. Educate yourself on the latest scams. Foster a culture of deliberate action, never rush payments.