Altered checks and fake invoices: protecting a business account from fraud

Two doors, and how to close them

The most effective protection for a business account combines bank controls with office habits. On the bank side, that means positive pay for checks and ACH, dual approval for payments, user limits and alerts. On the office side, it means verifying every change to payment instructions by phone with a known contact, mailing fewer checks and reviewing activity daily. Most losses come from stolen or altered checks and from emails that trick an employee into sending money to a fraudster, and both are largely preventable.

I manage deposit relationships for small and mid-size companies at Frost Bank, and fraud is a subject I like to raise early, usually before an owner asks. The businesses that lose money are rarely careless. They are busy, they trust the people they deal with, and the fraudster is counting on exactly that.

How check fraud actually happens

Checks are stolen from the mail, from office outboxes and from vendors' mailrooms, then washed and rewritten for a larger amount or to a different payee, or used as a template to print counterfeits on your account. The scale is significant. FinCEN reported that financial institutions filed more than 350,000 suspicious activity reports on potential check fraud in 2021 and more than 680,000 in 2022, and it named business checks among the items criminals target through mail theft.

Because small businesses still write checks to vendors, landlords and contractors, they are exposed. A single altered check can take weeks to notice if nobody is reviewing cleared items, and the longer it takes to report, the harder recovery tends to be.

How payment scams and email impersonation work

Business email compromise is the other door. A fraudster impersonates a vendor, a customer, an executive or even your attorney, by hacking a real email account or creating a lookalike address, and asks for a payment or a change to bank details. The request often arrives at a believable moment: a real invoice is due, a closing is near, the owner is traveling. The FBI's Internet Crime Complaint Center reported more than 55 billion dollars in exposed losses from business email compromise worldwide between October 2013 and December 2023.

These schemes work because nothing looks wrong. The invoice is familiar, the tone is right, the urgency feels normal. That is why verification has to be a rule, applied every time, rather than a judgment call made by whoever happens to open the email.

Payroll redirection deserves special mention because it targets the people who are easiest to trust: your own staff. An email that appears to come from an employee asks HR or the bookkeeper to change where their paycheck is deposited. Treat these the same way as vendor changes. Confirm in person or by calling the employee at the number already in your records before changing anything, and send a confirmation to the employee's existing address after the change is made.

• A vendor asks to update its bank account before the next payment
• An executive emails from the road asking for an urgent wire
• An invoice arrives with new remittance instructions
• A payroll change request asks to redirect an employee's direct deposit
• A lookalike domain differs from the real one by a single character

Bank tools worth turning on

Positive pay is the most important control for any business that writes checks. You send the bank a file of the checks you issue, and the bank flags any presented item whose number or amount does not match, so you decide whether to pay it. Many banks offer a version that also checks the payee name. ACH positive pay or debit filters do the same for electronic withdrawals, allowing only the companies you authorize to debit your account.

Beyond that, set up dual control so one person enters a payment and another approves it, give every user their own login with limits that fit their role, and turn on alerts for wires, large ACH payments and changes to users. These services usually carry a fee, and they are among the last items I would cut to save money; my guide to business bank fees explains how to lower the bill elsewhere.

• Check positive pay, with payee verification if available
• ACH positive pay or debit blocks and filters
• Dual approval for wires and ACH files
• Individual user logins with role-based limits
• Alerts for payments, user changes and large items

Office habits that stop most losses

The single most effective habit costs nothing. Any request to change where your company sends money must be confirmed by calling a known phone number for that person or company, one you already have on file, not a number from the email requesting the change. Frost's own fraud guidance makes the same point, telling business customers to double-check the email address and always verbally verify new payment instructions. The FBI recommends confirming account-change requests through a separate channel as well.

The rest are similarly simple. Mail fewer checks, and when you must, drop them inside a post office rather than in an outdoor box. Store check stock securely. Reconcile accounts daily or at least weekly, not monthly. Separate duties so the person who sets up vendors is not the person who pays them. And make sure every employee who touches payments knows that verifying a request will never get them in trouble, even if the request turns out to be genuine.

Moving from paper to electronic payments

Every check you do not write is a check that cannot be stolen and altered. Paying regular vendors by ACH, with approvals inside your online banking, removes much of the check fraud risk and usually saves staff time and per-item fees. It shifts the risk toward payment instructions, which is why the verification habit above matters so much.

If your business still runs most payments on paper, or someone drives deposits to a branch every week, my guide on signs a business needs treasury management covers which services to add first. Cybersecurity on your own side matters too: email accounts protected with multi-factor authentication and computers kept up to date make impersonation harder. An IT provider such as Anthony Omini can review that side for a small office.

Moments when you are most exposed

Fraud clusters around change. When a business switches banks, opens a new location, hires a new bookkeeper or onboards a large new vendor, there is a burst of legitimate updates to payment details, and fraudsters try to slip a fake one in among them. During a bank switch in particular, tell customers and vendors to confirm any notice of new banking details by phone. I cover that in my guide to switching business banks.

Busy seasons are another risk. Year-end, tax deadlines and holiday periods put pressure on staff to move fast. Owners who travel are a favorite cover story for fake executive requests. A written rule, posted where payments are processed, removes the pressure: no change to payment details without a call-back, no exceptions.

Growth itself is a risk factor. A Dallas company that has gone from ten vendors to sixty, or from one person handling payments to three, often still runs on the informal trust that worked when it was small. Write down the process for adding a vendor, changing payment details and releasing a payment, and review it each time the team changes.

If it happens: the first hour

Speed matters more than anything else. If you suspect a fraudulent check, ACH debit or wire, call your bank immediately, using the number on your statement or the back of your card, and ask what can be stopped or recalled. Banks monitor transactions, but you know your business, and an early call gives the bank the best chance to act. Then change passwords on any email or banking accounts that may be compromised.

Report it. The FBI's Internet Crime Complaint Center takes reports of business email compromise and other internet fraud, and FinCEN directs financial institutions to refer potential victims of mail theft-related check fraud to the U.S. Postal Inspection Service. Talk to your insurance agent as well; some business policies include coverage for certain types of crime or fraud loss, and the policy may set notice requirements.

• Call the bank immediately and ask what can be stopped or recalled
• Secure email and banking logins and check for forwarding rules
• Report to the FBI's Internet Crime Complaint Center or postal inspectors as appropriate
• Notify your insurance agent and keep records of everything

A short review worth doing this month

Set aside an hour with whoever handles your payments. List every way money leaves the business, who can initiate it, who approves it and how changes to payee details are verified. Then compare that list against the tools your bank offers. Most businesses find at least one gap: a shared login, a wire that needs no second approval, a vendor change process that relies on email alone.

For business owners in Dallas–Fort Worth, I am glad to go through that list with you and recommend which controls make sense for your size and volume. No set of tools makes an account fraud-proof, and specific protections and liability rules vary by bank and account agreement, so read yours carefully and ask questions. Still, the combination of bank controls, daily review and a firm call-back rule closes the doors most fraud attempts against businesses rely on.

Questions people ask me