B2B payment fraud happens when someone tricks your business into sending money to the wrong account or to a scammer pretending to be a vendor you trust
The most common version is called invoice fraud: a scammer sends a fake invoice that looks like it came from one of your real suppliers, with a small change — a new bank account number, a slightly different company name, or a typo in the email address. Your accounting team processes it like any other invoice and wires the money. By the time anyone notices, the funds are gone and the account is closed.
Another version is CEO fraud (sometimes called business email compromise). A scammer sends an urgent email that appears to come from your CEO or a senior manager, asking the finance team to wire money when ready for a "confidential deal" or "emergency expense." The pressure and the apparent authority make people move fast without checking.
A third type is vendor account takeover. A scammer gains access to your actual vendor's email account and sends a message saying their bank details have changed. You update your records and send the next payment to the scammer's account instead.
Key Takeaways
- The most common B2B fraud involves fake invoices that look nearly identical to real ones, with only the bank account number changed.
- Always verify payment instructions through a phone number or email address you find independently — never use contact details from the invoice or email itself.
- Set up a second-person approval requirement for any payment above a certain threshold, and make sure that person contacts the vendor directly.
- Train your accounting and finance staff to spot red flags: urgency, unusual requests, slight misspellings in email addresses, and requests to change payment methods.
- If you discover fraud, contact your bank when ready and file a report with the FBI's Internet Crime Complaint Center (IC3) so other businesses know to watch for the same scammer.
Verify payment instructions independently every time
The single most effective defense is to never use contact information from an invoice or email to confirm a payment instruction. If an invoice arrives with a new bank account number or a payment request email contains wire instructions, pick up the phone and call your vendor using a number you find yourself — from their website, from a previous invoice, or from your own records.
Say something like: "We received an invoice for $X dated today. Can you confirm your current bank account ends in [last four digits]?" A real vendor will either confirm the number or tell you it's wrong. A scammer will not answer because the phone number is not theirs.
This step takes two minutes and stops most fraud cold. The reason it works is that scammers can fake email and documents, but they cannot fake a phone conversation with the real vendor.
Require a second person to approve large payments
Set a dollar threshold — many businesses use $5,000 or $10,000, though yours might be higher or lower depending on your size — and require that any payment above that amount be approved by a second person before it goes out. That second person should not be the person who received the invoice or the initial payment request.
The second approver's job is to contact the vendor directly using independently verified contact information and confirm that the invoice is real and the payment instructions are correct. They should not rely on email or on the invoice itself.
This creates a natural checkpoint. A scammer might fool one person, but fooling two people who are checking independently is much harder. It also means that if the first person is under time pressure or distracted, the second person catches the mistake.
Spot the red flags in emails and invoices
Scammers often make small mistakes that real vendors would not. Look for email addresses that are almost but not quite right — for example, "amaz0n.com" instead of "amazon.com," or "payables@vendorname.co" when the vendor's real domain is "vendorname.com." These tiny differences are straightforward to miss in a busy day, which is why they work.
Watch for urgency language: "Please process when ready," "This is time-sensitive," "Wire funds today." Real vendors send invoices with normal payment terms. Scammers create pressure because it makes people skip their normal checks.
Be suspicious of requests to change payment methods or bank accounts, especially if they come by email. A real vendor will usually call you first or send a formal letter on company letterhead. If you get an email saying "We changed banks, please update your records," call the vendor before you do anything.
Also watch for invoices with round numbers or amounts that are slightly different from your usual orders. Scammers sometimes guess at what you might owe rather than copying a real invoice exactly.
Set up controls in your accounting system
Most accounting software lets you flag certain vendors or payment amounts for extra review. Use that feature. You can set rules like "any new vendor requires manager approval" or "any change to a vendor's bank account requires a phone call to that vendor."
Some businesses also use a three-way match: the invoice, the purchase order, and the receipt are all compared before payment is approved. If the amounts or details do not match, the payment is held until someone investigates.
Another useful control is to limit who can add new vendors or change vendor information in your system. If only one or two trusted people can make those changes, a scammer cannot slip in a fake vendor or update an existing vendor's bank account.
Train your team to ask questions
Your accounting and finance staff are your first line of defense. They see the invoices and payment requests before anyone else. Make it clear that it is better to ask a "stupid question" and delay a payment by an hour than to send money to a scammer.
Tell them specifically what to watch for: emails from vendors they do not recognize, requests to wire money instead of using the usual payment method, invoices that do not match the purchase order, and any message that creates a sense of urgency.
Encourage them to call you or a manager if something feels off, even if they cannot explain why. Instinct matters. Someone who has processed a hundred invoices from a vendor will notice when something is different, even if the difference is subtle.
Know what to do if fraud happens
If you discover that you have sent money to a scammer, contact your bank when ready — the same day if possible. The bank can sometimes freeze the account the money went to, especially if you call within a few hours. The longer you wait, the less likely the bank can recover the funds.
Report the fraud to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. This creates a record that helps law enforcement track patterns and warn other businesses. You will need details like the fake invoice, the email address it came from, the bank account number, and the date and amount of the transfer.
Also report it to your state's attorney general office and to the Federal Trade Commission (FTC) at reportfraud.ftc.gov. These reports help protect other businesses from the same scammer.
Frequently Asked Questions
What if a vendor says they sent an invoice but we never received it?
Call the vendor using a number you find yourself and ask them to resend it to your official email address. Do not use any contact information from a suspicious email. If the vendor cannot resend it or the details do not match what you expected, hold the payment until you have verified everything independently.
Can a scammer fake a phone call from my vendor?
Yes, using technology called spoofing, but it is much harder than faking an email. If you are suspicious, hang up and call the vendor back using a number from their website or a previous invoice. A real vendor will confirm the conversation happened.
How much money do businesses usually lose to B2B fraud?
The amount varies widely depending on the business size and how quickly the fraud is caught. Some losses are under $10,000; others are much larger. The point is that prevention is far cheaper than trying to recover money after the fact.
Should we use wire transfers for vendor payments?
Wire transfers are fast but hard to reverse, which is why scammers prefer them. If possible, use payment methods that offer more protection, like ACH transfers or credit cards. If you must use wire transfers, explore extra verification steps for those payments.
What if our vendor's email account was hacked?
This is vendor account takeover, and it is harder to spot because the email really does come from your vendor's account. The defense is the same: when a vendor asks you to change their bank account details, call them using a phone number you find independently to confirm the request is real.