B2B payment fraud happens when someone impersonates your vendor, your customer, or your bank to redirect a legitimate payment to their account instead of yours

The most common form is invoice fraud: a criminal sends a fake invoice that looks like it came from a real vendor you work with, complete with their logo and bank details swapped for the criminal's. Your accounting team processes it as routine and wires the money. By the time anyone notices, the funds are gone and the criminal has closed the account.

The second major type is CEO fraud (also called business email compromise). Someone spoofs your CEO's email address or hacks their actual account, then emails accounting to wire money urgently for a deal, acquisition, or tax payment. The pressure and the familiar sender make it hard to question.

A third route is vendor account takeover: a criminal gains access to a vendor's email or payment portal and changes their banking details in your system. You send the next payment to the criminal's bank instead of theirs.

Unlike consumer fraud, B2B fraud often goes undetected for weeks because invoices are processed in batches and reconciliation happens monthly. By then the money is irretrievable.

Key Takeaways

  • Verify every payment request by calling the vendor directly using a phone number from your own records or their official website, not from the email requesting payment.
  • Set up dual approval for any wire transfer over a threshold amount, with the second approver using a separate communication channel to confirm the request.
  • Require vendors to register new or changed banking details through a formal process that includes a callback to a known phone number, not email confirmation alone.
  • Train accounting staff to spot red flags: slight email address changes, urgent language, requests to wire instead of ACH, and invoices that don't match your purchase orders.
  • Use payment authentication tools like SWIFT gpi or API-based payment platforms that verify the recipient bank and account holder name before the transfer completes.

Verify vendor identity before every payment, especially for new requests or changed banking details

The single most effective fraud prevention step is to call the vendor directly using a phone number you already have on file or find on their official website. Do not use a phone number from the email requesting payment—that is often the criminal's number. Ask them to confirm the invoice amount, invoice number, and the bank account where they expect payment.

If a vendor tells you they have changed banks or moved their account, treat this as a high-risk moment. Do not process the payment based on email confirmation alone. Instead, ask the vendor to submit the new banking details through a formal channel: a secure portal, a signed form, or a callback to a number you control. Some companies require vendors to re-register banking details in person or via video call before the change takes effect in the payment system.

For recurring vendors, update banking details only after a documented verification call. For one-time vendors or new invoices, the verification call should happen before the first payment leaves your account, not after.

Require dual approval and separate communication channels for wire transfers

A single person approving a wire transfer is the weakest point in most B2B payment systems. Set a threshold—often $10,000 to $50,000 depending on your company size—above which any wire requires approval from two people in different departments.

Critically, the second approver must verify the request using a communication channel separate from email. This means the first approver sends the wire request through your accounting system or a shared document, and the second approver calls the requester directly (or the vendor, if the request came from outside) to confirm. If the email was spoofed or the account was hacked, the criminal cannot intercept a phone call.

Some companies go further and require the second approver to verify the recipient bank details against a master list of approved vendors maintained outside the email system. Others use a rule that any wire to a new bank account, even from an existing vendor, requires a callback verification before processing.

Use payment platforms and authentication tools that verify the recipient before transfer

Traditional wire transfers and ACH payments do not verify that the person receiving the money is who they claim to be. The bank sends money to an account number; it does not check whether the account holder's name matches the invoice.

Newer payment platforms and authentication standards can close this gap. SWIFT gpi (Global Payments Innovation) is a standard used by banks for international wire transfers that includes a feature called Confirmation of Payee (CoP). When you initiate a transfer, the receiving bank checks whether the account number matches the account holder's name and returns a match, no-match, or close-match result. A no-match is a red flag that the account may not belong to the vendor you think you are paying.

For domestic ACH transfers, some banks and payment processors offer account verification services that work similarly: you provide the vendor's name and account number, and the service confirms whether they match before the transfer is sent.

API-based payment platforms (used by larger companies) can integrate these checks automatically. When accounting staff enters a vendor's bank details, the system verifies the account holder name in real time and flags mismatches before the payment is approved.

Train accounting staff to recognize invoice and email red flags

Criminals often make small mistakes that accounting teams can catch if they know what to look for. Email addresses that are almost correct—like vendorname.co instead of vendorname.com, or vendorname@gmail.com instead of their company domain—are common. Slight delays in email delivery or formatting that does not match the vendor's usual style are also warning signs.

Invoices that do not match your purchase orders are another red flag. If you have a PO on file for $5,000 and an invoice arrives for $50,000, that is a moment to call and verify. Similarly, requests to wire money instead of using your normal payment method (ACH, credit card, check) should trigger a verification call.

Urgency and pressure are hallmarks of CEO fraud. Phrases like "this needs to go out today," "do not discuss this with anyone," or "I am in a meeting and cannot take calls" are designed to bypass normal approval steps. Train staff that legitimate business does not work this way, and that a call to the CEO or CFO to confirm is always appropriate.

Create a simple checklist that accounting staff uses for every payment over a certain amount: Does the invoice match a PO? Does the vendor's email address match our records? Is the bank account the same as last time? If the answer to any question is no, the payment is flagged for a verification call before processing.

Monitor your vendor master file and reconcile payments monthly

Vendor account takeover happens when a criminal gains access to a vendor's email or your payment portal and changes their banking details in your system. The next time you pay them, the money goes to the criminal's account instead. You may not notice until the vendor calls asking why they have not received payment.

Prevent this by restricting who can change vendor banking details in your system. Ideally, only a single person or department can make these changes, and every change triggers a notification to a manager who reviews it. Some companies require that banking detail changes be approved by the vendor themselves through a separate secure channel (a phone call, a secure portal, or a signed form) before the change takes effect.

Reconcile your vendor master file monthly against your previous month's records. If a vendor's bank account changed without a documented reason, flag it and call the vendor to confirm before the next payment. This catches takeovers quickly, often before money is sent to the wrong account.

Recover funds quickly if fraud is discovered

If you discover that money was sent to a fraudulent account, contact your bank immediately—the same day if possible. Wire transfers and ACH transfers can sometimes be recalled or reversed if the receiving bank cooperates, but only within a narrow window (usually 24 to 48 hours for domestic transfers, longer for international ones).

Provide your bank with the transaction details: the amount, the date, the receiving account number, and the receiving bank's name and routing number. Your bank will contact the receiving bank and ask them to freeze the account and return the funds. If the receiving bank is in the United States, they are required to attempt recovery. If the account is overseas, recovery is much harder and often impossible.

File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. This creates an official record and helps law enforcement track fraud patterns. Also report the fraud to your state's attorney general and to the receiving bank's fraud department directly.

Document everything: the fraudulent invoice or email, the payment confirmation, the date you discovered the fraud, and all communication with your bank. This documentation is necessary for your insurance claim and for any legal action you may pursue.

Frequently Asked Questions

Can we recover money sent to a fraudulent account?

Recovery is possible but time-sensitive. Contact your bank the same day you discover the fraud. If the receiving bank is in the United States, they are required to attempt recovery, though success depends on whether the account is still active and whether the funds have been moved. International transfers are much harder to recover. The longer you wait, the lower your chances.

What should we do if a vendor's email account is hacked but we do not know it yet?

You cannot prevent this entirely, but you can limit damage. Verify banking detail changes through a phone call to a number you have on file, not through email. If a vendor's email is compromised, they will usually discover it quickly when they see invoices or communications they did not send. Call them proactively if you notice unusual requests from their email address.

Is ACH safer than wire transfer for B2B payments?

ACH transfers are slower (one to three business days) and have lower limits, which gives you more time to catch fraud before money leaves your account. Wire transfers are faster and harder to reverse. For routine vendor payments, ACH is safer. For time-sensitive payments, use wire only after dual approval and a verification call.

Do we need to buy fraud insurance for B2B payments?

Cyber liability insurance and crime insurance can cover losses from payment fraud, but they often have high deductibles and require you to prove you followed reasonable security practices. Prevention is cheaper than insurance. That said, once you have strong controls in place, insurance is a reasonable backup for large transactions.

How do we know if a vendor's banking details are real?

Call the vendor directly using a phone number from your records or their official website and ask them to confirm their bank name, account number, and the account holder's name. If your bank offers account verification services or SWIFT gpi with Confirmation of Payee, use those tools to verify the account before sending money. Never rely on email alone.