AP Fraud Prevention: Protect Your Small Business from Payment Scams

It was the day before a holiday. Ten minutes after we transmitted payment to our bank to process a payment to a small, one-off contractor, the approver reached us and said he'd approved the invoice twice.

The first thing I did was go to our bank portal and flag the payment for reversal. I called and left a message for our banker. I had saved the reversal form they required, filled it out, and emailed it immediately.

The amount was under $500. No incentive for a lone contractor to refund anything. Our only hope was the bank.

It turned out to be a Christmas miracle. The holiday hours and bank holidays worked in our favor — they delayed delivery long enough for the reversal to go through. We got the funds back. We did pay for the reversal. But we got the money back.

Your public profile is an asset — and an attack surface. The same visibility that builds your brand tells a patient fraudster exactly who you are, what you own, and where to start.

Three months. That's roughly the window where your bank can be held responsible for fraudulent transactions — and even that isn't guaranteed. After that, the money is gone. Not delayed. Gone.

Not all financial institutions are equal. Some fight harder for small businesses than others. Most don't. Knowing who's in your corner before something goes wrong matters.

Even when your bank initiates a trace, the receiving bank has no obligation to respond. Whether you get an answer — let alone your money back — depends on inter-bank connections, availability, and each financial institution's own policies. There is no guarantee.

The 24-72 hour window is everything. That's when the transaction is still in play — and the only window where a tracer works immediately, the way your bank's fraud process was designed to work. Outside that window, you're no longer in the scenario your bank built this for. You're dependent on the receiving bank, and they are not required to respond.

Your bank's knowledge and your contacts there are critical assets. Only employees with banking authorization should contact the bank directly during a fraud event — not just any staff member. More importantly, banks want an authorized contact list established BEFORE an incident occurs. Set that up in advance. Scrambling to prove who's authorized when every hour counts slows everything down.

Catching a payment before it goes out saves everything: the money, the hours spent building a fraud case, and the affidavit paperwork your bank will require regardless of outcome. Recovery is a process. Prevention is a decision.

Your bank offers verification services that confirm a vendor's banking credentials are legitimate — do this during vendor setup and vetting, before any invoice ever arrives. Once a vendor's banking information is verified and on file, any change to their payment details should trigger an immediate verification call.

Here's the rule: if you receive an invoice or request with updated payment information — new bank account, new routing number, new ACH details — do not use any contact information on that invoice. Contact your known vendor representative directly, using the phone number and email address already in your system. Anything on a questionable invoice is suspect, including the contact details. Verify the change with a live person you already know before updating your vendor records or releasing any payment.

The same rule applies to any change in a vendor's profile — not just payment details. Updated address, new email, new contact name, new phone number: all of it warrants a call to your known vendor contact to confirm. These changes are exactly how scammers pre-position before submitting a fraudulent payment change request later.

If a vendor reports a company name change or merger, request a new W-9 before updating your records. You require a W-9 because your business is based in the United States. The IRS requires US businesses to collect W-9s from the vendors they pay — foreign and domestic alike.

The only exception: payments made by credit card or to pay a credit card bill. In those cases, the card network handles the reporting obligation. Every other payment method — ACH, check, wire, cash — requires a W-9 on file.

Some vendors will tell you that because the current order is under $600, they don't need to provide a W-9. Do not accept this. You cannot predict future spend — if you like a vendor's product or service, you may buy more. The $600 IRS 1099 reporting threshold applies to annual totals, not individual transactions. Collecting a W-9 at vendor setup — before any payment is made — eliminates the scramble at tax time if that vendor crosses the threshold. Make it a non-negotiable part of vendor onboarding. No W-9 on file, no payment issued.

Prior to January 1, 2026, the 1099 reporting threshold was $600. For payments made on or after January 1, 2026, it increased to $2,000 and will adjust annually for inflation. Thresholds and regulations can change — always consult IRS.gov and your tax professional for the most current requirements.

This is a legal obligation on the payer's side, not a preference. A vendor's location does not exempt them from this requirement. The IRS has 4 or 5 versions of the W-9 — there is a form that covers every type of company, contractor, and individual, regardless of origin. If a vendor is unsure which applies to them, direct them to irs.gov: the instructions on each form clearly describe who should use it. A legitimate vendor will have no trouble producing the right one. If they can't — or won't, even after being pointed to irs.gov — that is a definitive red flag. No valid business entity is exempt.

The new W-9 must reflect who actually needs to be paid — the legal entity receiving the payment. If the new W-9 carries a different EIN, that is a different legal entity. Do not update the existing vendor record. Create a new vendor record for the new entity and archive the old one. Mixing payment history, 1099 reporting, and contact records across two legal entities creates compliance exposure and makes audits significantly harder.