Verify every payment change

The most expensive email a small practice gets usually looks routine: a vendor, landlord or employee asking you to send future payments to a new bank account. Sometimes it comes from a lookalike address. Often it comes from the real person's mailbox, because someone has already broken into it. Either way, nothing in the email can prove the request is real. A phone call to a number you already had can.

Business email compromise brought 24,768 complaints and $3.05 billion in reported losses to the FBI's Internet Crime Complaint Center in 2025, second only to investment fraud. Wire and ACH transfers made up 86 percent of the payment methods reported in those complaints. Those are only the cases people reported.

The control

Adopt one rule and write it down: no one changes where a payment goes on the strength of an email, a text, or a call they didn't place. Then put these steps around it.

• Treat every change request as unverified. That includes requests that seem to come from your owner, your manager or a vendor you've paid for years, and requests made by letter, by PDF on letterhead or through a vendor portal.
• Call back on a number you already had. Use the phone number in your vendor file, your contract, or an invoice from before the request. Never use a number, link or contact taken from the request itself.
• Confirm details only the real contact would know. Ask them to confirm that they made the request, and the amount and date of your last payment to them.
• Have a second person approve the change. Someone other than the person who received the request approves the new details in your accounting system or at your bank before any payment goes to them.
• Don't let urgency shorten the check. A deadline, a threatened late fee or a request to keep things quiet is a reason to slow down.
• Write it down. Record who asked and how, who verified it, the number you called, and who approved it. Keep the original message.
• Confirm the first payment arrived. After the first payment to the new details, check with your known contact that they received it.

If you send ACH payments yourself, this control also fits your bank's rules. Since June 2026, Nacha's rules have required businesses that originate ACH payments to have risk-based procedures for spotting payments made under false pretenses, which is how Nacha classifies business email compromise. Nacha's examples of such procedures include change controls over payment instructions for vendor and payroll payments. Whether the rule reaches you depends on how you send payments, so ask your bank.

Payroll is a target too

The same scheme hits payroll as a direct deposit change: an email that seems to come from an employee asks you to update their bank account before the next payday. Have employees change their own details inside your payroll system, behind multi-factor authentication. When a change goes through, confirm it with the employee in person or by phone before the next payroll runs.

Warning signs

• The reply-to address differs from the sender's, or the domain is one character off, such as supp1ier.example for supplier.example.
• The new account is in a different name, state or country than before.
• The request lands just before a large or regular payment is due.
• You're told the old account is frozen, closed or “under audit.”
• Pressure, secrecy, or a request to skip your normal steps.

None of these proves fraud, and a request from a genuinely compromised mailbox can show none of them. The callback is what protects you.

In your books

Record the misdirected payment as a separate loss, not as payment of the vendor's bill. Whether you still owe the vendor depends on the facts and your agreement with them, so leave their invoice open until that's settled, and record any recovery against the loss when it comes in. A clean record of what was sent, when, and what came back is also what your bank, your insurer and law enforcement will ask for.

For federal income tax, a business theft loss is generally deductible in the year you discover it. If you have a claim for reimbursement with a reasonable prospect of recovery, such as a pending bank recall or insurance claim, the deduction for that part waits until you know with reasonable certainty what you'll get back. Your tax preparer can work through the timing with you.

Sources

1. 2025 Internet Crime Report, FBI Internet Crime Complaint Center, April 2026.
2. Business Email Compromise, FBI, updated April 8, 2026.
3. Business Email Compromise Response Action Plan, Nacha, July 2024.
4. Risk Management Topics: Fraud Monitoring Phase 2, Nacha, rules effective June 19, 2026.
5. Cyber Criminals Impersonating Employee Self-Service Websites to Steal Victim Information and Funds, FBI public service announcement I-042425-PSA, April 24, 2025.
6. Rapid Response Program fact sheet, Financial Crimes Enforcement Network, April 2026.
7. Publication 547, Casualties, Disasters, and Thefts, Internal Revenue Service, 2025 edition.
8. Breach Notification Rule, U.S. Department of Health and Human Services.

This guide is general information, not legal or tax advice for your situation. It's published under CC BY 4.0, so you're welcome to share it with credit.