A payment request can look ordinary and still be fraudulent. It may arrive in the name of a vendor, a utility company, a bank, a government agency, or a service the business actually uses.
The request usually has three ingredients: a familiar name, a reason to act quickly, and a way to bypass the normal verification process. The goal is simple: get someone to send money, change payment details, or reveal information that makes the next attempt easier.
Payment changes sent by email
A vendor's email account can be compromised, or an attacker can register an address that looks nearly identical to the real one. The message says the vendor has new banking information and asks Accounts Payable to use it for the next payment.
That is business email compromise (BEC). The FBI's advisory documents the payment-redirection pattern.
The control is not a better-looking email. It is an independent verification step: call a known vendor contact using a number already on file, confirm the request outside the email thread, and record who approved the change.
Executive impersonation and gift-card requests
Small businesses are especially exposed to messages that appear to come from the owner, chief executive officer (CEO), controller, or another senior leader. Attackers can identify leaders and staff through a company website, social media, public filings, and email patterns. Then they send an urgent email or text: the executive is in a meeting, needs a quick favor, and wants the recipient to buy gift cards and send the card numbers or photographs of the codes.
The pressure is deliberate. The recipient may be trying to be helpful, may not want to interrupt a senior leader, and may have been told not to discuss the request. The money is effectively gone once the codes are sent.
Set a simple company expectation: no employee should buy gift cards, share gift-card codes, or release money because of an unexpected message that appears to come from an executive. Verify the request through a known phone number or an established internal channel first. If the business uses gift cards for a legitimate purpose, route the purchase through its normal approval process.
When someone catches and reports a fake request, tell them what they caught. Thank them, preserve the message, and warn anyone else the impersonator may contact. That response gives people a reason to bring the next odd request forward instead of quietly deleting it.
The FTC continues to warn employers about this exact impersonation pattern and advises staff to verify with a supervisor using a known contact method. FTC: No, that’s not your boss asking you to buy gift cards
Fake invoices, renewals, and listing demands
Small organizations commonly receive invoices for services they did not request: domain renewals, technical support, search-engine services, office supplies, online business listings, or advertising. A fake invoice may use a familiar logo, say that the payment is overdue, or arrive at the end of a busy month when a routine bill seems plausible.
The Federal Trade Commission recently warned small businesses that fake invoices can also be phishing attempts designed to reach business data or networks. Its guidance also identifies false directory listings, advertising, utility bills, and government notices as common pressure tactics. FTC: Pay your bills, not scammers FTC: Scams and Your Small Business
A bill is not proof that the business ordered something. Staff should confirm the vendor, purchase record, contract, and approval path before paying an unfamiliar invoice.
A text says your business card was compromised
A text may claim there is suspicious activity on the business credit card or bank account. It often asks the recipient to call a number, click a link, or move money to a supposedly safe account. The urgency is intentional.
Use the phone number printed on the business card, a banking application, or an independently verified website. Do not use the number or link in the text. The FTC has warned businesses about fake fraud alerts tied to business-card and bank-account activity.
Other requests that deserve a pause
The same playbook appears in several forms:
- A caller claims a utility will be disconnected unless payment is made immediately.
- A government or licensing notice threatens a fine, suspension, or urgent renewal fee.
- A payment-processing representative promises lower rates but asks for a signature before providing complete terms.
- A familiar customer asks to change where an invoice should be paid.
- A new vendor requests payment by wire, gift card, cryptocurrency, or another unusual method.
None of these are automatically fraudulent. Each deserves a verification step that does not rely on the message, call, or link that created the urgency.
A five-step payment-verification habit
A small business does not need a complicated fraud program to reduce these risks. It needs a routine people can follow when the request involves money or payment details.
- Pause. Treat an unexpected payment request or account change as unverified.
- Compare. Check the vendor record, contract, purchase order, and prior payment details.
- Verify independently. Call a known contact or use a known portal. Do not reply to the message that made the request.
- Require approval. Use a second reviewer for new vendors, bank-detail changes, or payments above a defined amount.
- Record and escalate. Keep a short record of the verification. If something appears fraudulent, contact the financial institution promptly and preserve the email, text, invoice, or call details.
What leaders can do this week
Start by identifying who can approve vendors, change payment details, release funds, add business cards, or alter card limits. Give those people one clear verification process and make sure everyone knows who to call when a request feels wrong.
Then review whether card and bank alerts reach the right people, whether the company has current vendor contacts on file, and whether the business can confirm a request when the primary approver is unavailable.
These are operational controls. They work best when they are written down, practiced, and reviewed after a close call or a change in staff.
Praeven's briefings and workshops let teams practice verifying a suspicious request and reporting it. The Security Program builds those habits into payment procedures, assigns responsibility for the response, and checks whether changes are working.