5 Fraud Protection Steps for Businesses

Last year, fraud cost businesses over $3 billion and that's just what got reported. No business is too small, too careful or too off the radar to be a target. Business Email Compromise (BEC) attacks still remain as the #1 threat but account takeover attacks are rising fast and AI is making fraud even harder to detect.

The good news? With the right awareness, tools and habits, fraud protection for your business is absolutely within reach. Let's break down what's happening and what you can do about it.

By the Numbers: 2026 AFP Fraud Survey Highlights

The Association for Financial Professionals surveys hundreds of corporate treasury professionals every year. Here are the key findings from their 2026 report:

• • 76% of organizations experienced attempted or actual payments fraud in 2025
  • 74% were targeted by Business Email Compromise (BEC), up significantly from 63% in 2024
  • 58% reported check fraud, the most-targeted payment method
  • 30% experienced ACH debit fraud and 25% experienced wire fraud
  • Only 17% of organizations are currently using AI tools to combat fraud

What We're Seeing for Wisconsin Businesses in 2026

The national stats tell part of the story but what does fraud actually look like on the ground? In our Commercial Fraud in Focus video series, our Information Security and Treasury Management teams walks through the fraud trends hitting businesses right now.

Here’s what we're seeing:

• • Fraud hits businesses of every size: The biggest misconception is that fraudsters only target large companies. In reality, the 76% of organizations that experienced fraud last year include plenty of mid-sized and small businesses.
  • Account takeover attacks are rising fast: Fraudsters impersonate your bank's fraud department, guide you to a convincing fake website and capture your credentials and multi-factor authentication codes in real time. Within seconds, they're creating wire and ACH recipients and moving money, often before the phone call even ends.
  • AI is making fraud harder to detect: Voice recognition and AI are now being used to record phone calls and capture trigger phrases like "yes, I approve." Businesses may need secret verification codes, something only the real person would know, to confirm identity over the phone.
  • Slow down and verify every time: Call known contacts at known numbers; never a number from an email. Train your teams yearly because it's not a matter of if fraud will happen, but when.

How to Spot Common Attacks (Before They Gain Access)

Fraudsters keep evolving their tactics but most attacks fall into a few familiar categories. Here's how to recognize each one before it costs you.

Business Email Compromise (BEC)

Attackers use email to impersonate someone you trust — an executive, vendor or trade partner — asking you to update payment instructions, change a bank account or share sensitive information. What makes these attacks dangerous is patience: Fraudsters often monitor compromised email accounts for months, studying patterns and terminology before sending a request that looks completely legitimate.

5 steps to spot a BEC attack:

• • Check the sender's email address closely: A single swapped letter can redirect funds to a fraudster. Look at the full address, not just the display name.
  • Verify the domain: More than half of organizations received emails from domains that looked almost identical to legitimate ones, with just a letter or two changed. Hover over links before clicking.
  • Watch for grammatical errors: A legitimate sender wouldn't make several typos.
  • Beware of urgency: "This needs to happen today" is a classic pressure tactic designed to make you act before you think.
  • Question unusual requests: Changes to vendor payment details, payroll information or new account setups that break from normal patterns.
  • Pick up the phone: Always verify any request to change account or payment information through a separate channel, using a phone number you already have on file.

Check Fraud

ACH fraud frequently starts with an intercepted check. Fraudsters extract the routing and account numbers and originate unauthorized electronic debits. It can also begin when a fraudster gains access to your banking credentials through phishing or an account takeover.

5 steps to spot check fraud:

• • Reconcile your accounts daily or weekly: The sooner you spot something wrong, the better your chances of recovering funds.
  • Review every ACH debit against known transactions: Look for unfamiliar payees, unexpected amounts or debits that don't match any invoice or payment you authorized.
  • Watch for small test transactions: Fraudsters sometimes run a tiny debit first to see if it goes unnoticed before attempting a larger withdrawal.
  • Set up ACH Positive Pay: Block any debit that isn't pre-authorized.
  • Monitor for vendor payment changes: If you receive a request to update a vendor's banking information via email, verify it independently before making any changes.

Account Takeovers

An account takeover happens when a fraudster gains control of a legitimate email account, banking login or vendor portal often through stolen credentials, phishing or social engineering. Once inside, they can send authorized-looking emails, approve payments and change account details without raising suspicion.

5 steps to spot an account takeover:

• • Watch for unexpected alerts: Login or password reset notifications you didn't initiate.
  • Look for unusual email activity: Emails you didn't send, replies to messages you never wrote or rules forwarding your emails to an unfamiliar address.
  • Enable two-factor authentication (2FA) or Multifactor Authentication (MFA): For all financial and email accounts.
  • Check URLs before entering credentials: Look-alike domains are a common entry point.
  • Keep security software current: Talk with your IT partner regularly to make sure your systems, firewalls and antivirus tools are up to date.

5 Steps to Prevent Fraud

You don't need to overhaul everything overnight but you do need to take action. Here are the steps that make the biggest difference:

1. Leverage fraud protection tools
   Solutions like Positive Pay catch discrepancies automatically, protecting your accounts from unauthorized checks and ACH debits without relying on manual review alone.
   
   
2. Put payment procedures in writing
   Set up dual controls and approvals so no single person can authorize a payment change alone. Define a clear process for updating vendor information, use verification procedures like secondary channels or two-factor authentication for new accounts and never share login credentials or personally identifiable information via email.
3. Reconcile your accounts regularly 
   Daily is ideal, weekly at an absolute minimum. The sooner you spot something wrong, the better your chances of recovering funds.
   
   
4. Conduct a cyber risk assessment
   Work with your risk management team to identify potential risks and threats specific to your business. Understanding your vulnerabilities is the first step to closing them.
   
   
5. Purchase crime and cyber insurance
   Talk with your insurance advisor about the specific coverages you should have in place should a breach occur. The right policy can be the difference between a manageable incident and a catastrophic loss.

What to Do If You're a Victim

If you discover fraud, act fast:

• • Contact your treasury management consultant immediately: Our team is here to help. Connect with an advisor to discuss your options and keep your business and finances safe.
  • File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov — regardless of the amount lost
  • For BEC or Email Account Compromise (EAC) victims specifically, report to BEC.ic3.gov as soon as possible

Timing matters. The faster you report, the better the chances that law enforcement can help recover funds. Fraud protection for businesses isn't about one big fix. It's about building a culture of vigilance that makes your company a hard target.