Stop Fake Invoices and Payment-Change Scams at Your Small Business

The email looks routine. A vendor you've paid for years writes to say they've switched banks, and asks you to send this month's payment to a new account. The logo is right, the signature is right, and the invoice amount matches what you expected. Your bookkeeper updates the account number and pays.

A few weeks later the real vendor calls asking where their money is.

This is business email compromise, often called BEC. The FBI describes it as one of the most financially damaging online crimes, and its Internet Crime Complaint Center has published a public service announcement on business email compromise describing how widespread it has become. It doesn't need malware or a clever hack. It needs one convincing message and one person who acts on it without checking.

For small businesses in Jacksonville, Orlando, and across Florida, the good news is that the most effective defense is simple, cheap, and entirely in your control: never accept a change to payment or bank details through the same channel the request arrived on. Verify it using contact details you already had on file.

How the scam works

The FBI's business email compromise page and the U.S. Secret Service's guidance on BEC describe the same basic patterns:

• Vendor impersonation. A scammer sends an invoice or a "new banking details" notice that appears to come from a supplier you already pay.
• Executive impersonation. A message that looks like it's from the owner or a manager asks staff to make an urgent wire or buy gift cards.
• Compromised real accounts. Sometimes the email really does come from your vendor's mailbox, because the scammer has broken into it. That's why a correct sender address proves nothing.
• Look-alike domains. An address such as billing@acrne-supply.com instead of acme-supply.com is easy to miss on a phone screen.

The common thread is pressure plus a change: a new account, a new payee, an unusual amount, or a deadline that discourages anyone from slowing down.

The FTC's small-business guidance on business email imposters recommends putting verification policies in place, such as requiring employees to call and confirm transfer requests they receive by email. That one habit stops most of these attempts.

The rule: call back on a number you already had

Write this down as a policy, not a suggestion:

Any request to add a payee, change bank or remittance details, or send money in an unusual way must be confirmed by a phone call to a number we already had on file before the request arrived.

A few details make the difference between a policy that works and one that only looks good on paper.

Use the number on file, not the number in the message. If the email includes a phone number, a scammer may be waiting on the other end. Use the number in your vendor master record, a signed contract, or a past invoice you know was genuine.

Talk to someone you know. Ask for your usual contact by name. Confirm the change in your own words, such as "We received a request to change your bank account ending in 4821. Did you send that?" Don't read the new details aloud and ask them to say yes.

Hold the payment until it's confirmed. If you can't reach the vendor, the payment waits. A real vendor will understand a short delay; a scammer will push harder, which is itself a warning sign.

Have a second person approve. The person who updates bank details shouldn't be the only person who releases the next payment to that account. Two sets of eyes catch what one rushed person misses.

Treat urgency and secrecy as red flags. "Don't call, I'm in a meeting" or "this must go out today" are reasons to slow down, not speed up.

Lock down your own email too. The FTC also recommends email authentication (SPF, DKIM and DMARC), keeping software updated, and training staff. Those steps make it harder for scammers to impersonate your business to your customers.

How to measure whether the check is working

A policy nobody follows is worse than no policy, because it gives everyone false confidence. You don't need special software to find out whether your callback rule is really happening. Track a few things in a simple spreadsheet for a month or two.

1. Count every payment-detail change. Log each request to add a payee or change bank details: the date, the vendor, how it arrived (email, portal, phone, mail), and who handled it. If you don't know how many changes happen each month, you can't know whether each one was checked.

2. Record the callback for each one. For every change, note the number you called, where that number came from (vendor file, contract, earlier invoice), who you spoke with, and when. Your coverage number is simple: changes with a documented callback divided by total changes. The goal is every single one.

3. Check that payments waited. Compare the date a change was confirmed with the date the first payment went to the new account. Any payment that went out before confirmation is a gap in the process, even if it turned out fine.

4. Log the ones you stopped. When a callback reveals that the vendor never asked for a change, write it down and report it (see below). Those entries show that the check is catching real attempts, and they make good training examples for your team.

5. Spot-check monthly. Once a month, have someone other than the person who handles payables pick a few changes at random and confirm the log is accurate: the number called matches your records, and the dates line up.

6. Test it, gently. With staff aware that occasional tests happen, an owner or manager can send an internal practice request to change a vendor's details and see whether it gets called back. Use the results to coach, not to punish.

After two months you'll have a clear picture: how many changes you handle, whether each one was verified, and whether payments waited. That's the baseline you can improve on, and it's something you can show an insurer, an auditor, or your bank if they ask.

If money has already gone out

Speed matters. Contact your bank right away and ask them to try to stop or recall the transfer. Then file a complaint with the FBI at ic3.gov and report the fraud to the FTC at ReportFraud.ftc.gov. The Secret Service also investigates BEC; its BEC page explains how to reach a local field office. Keep the emails, headers, and invoices; don't delete anything.

Where we can help

We help small businesses in Jacksonville, Orlando, and across Florida put simple controls like this in place and measure whether they're working. That might mean setting up a payment-change log, adding an approval step to your accounting workflow, or checking that your email authentication is configured correctly.

Want a second opinion on where to start? Take our free assessment at rsoftware.net/assessment or email us at hello@rsoftware.net.

For more practical guides on secure AI, automation, and security for local businesses, follow R Software & Consulting on LinkedIn.

FAQ

What counts as a "payment-detail change"?

Any request to add a new payee, change a bank account or routing number, change a remittance address, or pay by a method you don't normally use (such as a wire instead of a check, or gift cards). Treat all of these the same way.

What if the email really comes from my vendor's address?

Verify anyway. Scammers sometimes break into a real vendor's mailbox and send requests from it. A correct sender address doesn't prove the request is genuine; a callback to a known number does.

Is a reply email or text good enough to confirm?

No. If the channel is compromised, the scammer will simply confirm their own request. Use a separate channel with contact details you had before the request arrived, ideally a phone call to a known person.

We're a very small team. Is a second approver realistic?

Even in a two-person office, the person who changes bank details can ask the other to release the first payment. If that's truly not possible, the callback becomes even more important, so log every one.

What's the first step?

Start a simple log this week. Record every payee or bank-detail change for the next month, along with the callback for each. You'll quickly see whether your process is holding up.

Written with help from our AI assistant.