What Should a Small Business Do After Payment Fraud?

The short answer

If your business sends money to a scammer, call your bank’s fraud line right away and ask them to recall or reverse the payment. Then alert your payment processor if card payments are involved, report the crime to the Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3) at ic3.gov, and warn any customers who may be targeted. Speed matters most, because the faster the bank acts, the better the chance of stopping the money.

What this tells Google and AI

Payment fraud planning sends no search signal. It protects your reputation. When scammers spoof your email to send fake invoices to your customers, the anger often lands on your reviews and in public posts that search engines and artificial intelligence (AI) tools read. A fast, honest response limits that damage.

What this means

Payment fraud is any trick that sends money where it shouldn’t go. Common types for small businesses:

• Business email compromise (BEC): a scammer breaks into or fakes an email account, then asks someone to wire money or change bank details.
• Fake invoices: bills for things you never ordered, such as directory listings, domain renewals, or search engine optimization (SEO) services.
• Vendor bank change scams: an email that looks like it’s from a real vendor says “we have a new bank account.”
• Customer-side fraud: stolen cards used to pay you, which later turn into chargebacks.

The outline asks for four escalation paths: bank, processor, customer, and law enforcement.

Made-up example: The bookkeeper at Clearwater Pool Service gets an email from their chemical supplier with new bank details. She pays the $8,400 invoice. A week later, the real supplier calls about the unpaid bill. The owner calls the bank’s fraud line within the hour, asks for a recall, files a complaint at ic3.gov, and checks the bookkeeper’s mailbox for hidden forwarding rules. Next time, a bank change needs a phone call to a number already on file.

Why it matters

• Time is everything with wires. IC3 says to contact your bank as soon as fraud is recognized, because acting fast may cut or stop losses.
• Small businesses are prime targets. Scammers count on one busy person paying bills without a second check.
• Your customers can be hit using your name. If your email is hacked, scammers may send your customers fake invoices.
• Insurance may not cover it. Read your policy before it happens so you know what’s covered.

Who this applies to

Every business that pays bills or takes payments. The risk is highest if you pay by wire or ACH (Automated Clearing House) transfer, pay vendors you only know by email, or have one person who both approves and sends payments.

How to do it

Prepare now:

1. Set a bank change rule. Any change to vendor bank details must be confirmed by phone, using a number you already had, never one from the email (see 10.6.3 Vendor Approval and Bank-Change Verification).
2. Split the job. One person approves payments, another sends them, when you have the staff (see 10.6.8 Separation of Duties).
3. Turn on bank alerts for wires, ACH payments, and new payees.
4. Lock down email. Turn on multi-factor authentication and check for forwarding rules (see 12.1.5 Email Forwarding Rules and 12.1.6 Email Security).
5. Make a response card with your bank’s fraud line, your processor’s support line, your insurer, and IC3’s website. Keep it printed.
6. Tell customers how you bill. Put a line on invoices that says you’ll never change bank details by email.

If it happens:

1. Call your bank’s fraud line now. Ask for a recall or reversal. IC3 also suggests asking about a hold harmless letter or letter of indemnity.
2. File a complaint at ic3.gov. Include the bank details of where the money went.
3. Alert your payment processor if your card or payment account was misused.
4. Secure email and accounts. Change passwords, turn on multi-factor authentication, and remove unknown forwarding rules (see 11.9.2 Account Takeover).
5. Warn customers if your email or invoices were spoofed. Call or email them from a clean account, and post a short notice if many are affected.
6. Report scams to the Federal Trade Commission (FTC) at ReportFraud.ftc.gov, and consider alerting your state attorney general.
7. Call your insurer to ask whether the loss is covered.
8. Write down what happened and change the process that let it through.

What proof to keep

• The fraudulent email or invoice, with full headers
• Bank recall request and case numbers
• IC3 and FTC complaint confirmations
• Processor case numbers
• Copies of any notices sent to customers
• Your updated payment approval rules

Common mistakes

• Waiting a day to see if it clears up. Every hour lowers the chance of getting money back.
• Calling the number in the suspicious email. That number goes to the scammer.
• Only fixing the payment. If email was hacked, the scammer may still be reading it.
• Paying “past due” notices from unknown companies. The FTC warns that scammers send fake invoices for things like domain registration and SEO.
• Skipping the customer warning because it’s embarrassing.

When to get help from a pro

Your banker: right away to recall funds. Cyber insurance agent: to check coverage. Attorney: if the loss is large or customers were harmed. Information technology (IT) security specialist: if email was hacked. Questions to ask:

• Can you recall this payment, and what do you need from me today?
• Does my policy cover payments made because someone was tricked?
• Do I have to notify customers whose data the scammer may have seen?

Bill’s note

[Bill: add a short note. For example, a fake invoice or bank change email you or a client received, how it was spotted, and the one rule that stopped it.]

How I did this for SiteSmarty

• [Date I did this:]
• [What I actually did, step by step: bank alerts, the bank change rule, and the response card for SiteSmarty]
• [What it cost and how long it took:]
• [What surprised me or what I’d do differently:]
• [Screenshot or photo to add, with private info blurred: bank alert settings and the printed response card]
• [Result so far:]

Questions people ask

Can I get a wire transfer back after fraud? Sometimes. IC3 says to contact your bank as soon as you spot it and ask for a recall. The longer you wait, the lower the chance.

Where do I report business payment fraud? Your bank first, then ic3.gov. Report scams and fake invoices to the FTC at ReportFraud.ftc.gov too.

What is business email compromise? A scam where someone hacks or fakes a business email account to trick people into sending money or private information.

How do I stop fake bank change requests? Confirm every change by phone using a number you already have on file, and never trust contact details in the request itself.

Audit check

• Question: Does the business have a written payment fraud plan and a rule that bank changes are confirmed by phone?
• Pass looks like: A bank change rule in writing, bank alerts turned on, a printed response card, and staff who know to call the bank first.
• Fail looks like: Bank changes accepted by email, one person approving and sending, no fraud line on hand.
• Evidence to collect: The written payment rules, bank alert settings, the response card, and records of past checks.

Where this fits

Do this first: 10.6.3 Vendor Approval and Bank-Change Verification, 10.7.6 Payment Security, 11.9.4 Data Breach Response

Do this next: 11.9.6 Severe Injury

Related pages: 11.9.2 Account Takeover, 12.1.5 Email Forwarding Rules, 12.1.6 Email Security, 10.7.7 Chargebacks, 10.6.8 Separation of Duties, 10.8.6 Cyber Insurance

Sources

• Internet Crime Complaint Center, "Business Email Compromise" (checked October 17, 2026)
• Federal Trade Commission, "Scams and Your Small Business: A Guide for Business" (checked October 17, 2026)
• Federal Trade Commission, "Run a small business? Pay your bills, not scammers" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.