Payment Fraud in 2026: How Small Businesses Actually Get Hit - and How to Stay Safe

Why payment fraud is the #1 financial risk for SMBs in 2026

The scale is documented rather than anecdotal. The FBI's Internet Crime Complaint Center recorded USD 20.877 billion in reported losses across 1,008,597 complaints in 2025, up 26% year on year, with business email compromise alone accounting for USD 3.04 billion at an average of over USD 122,000 per reported incident^[1].

Ransomware gets the headlines. Payment fraud quietly takes more money out of small businesses every quarter - usually without anyone noticing for weeks.

The reason is simple: payment fraud doesn't need to break anything. No malware, no encrypted files, no ransom note. Someone just convinces your finance person to send money to the wrong bank account. By the time the real supplier asks where their payment is, the funds have already been moved through 3-4 mule accounts and are gone.

For a 5-50 person business, a single successful incident is typically €8,000-€120,000. In the cases we have been called into, recovery through cyber insurance on social-engineering wire fraud lands well below half the loss - these are policy-dependent and not a published rate, so treat them as our experience rather than a benchmark.

The 5 patterns we actually see

1. Supplier email takeover (the most common)

An attacker compromises *your supplier's* mailbox - not yours. They sit quietly, read months of email, and learn the relationship: how invoices look, what amounts are normal, who approves what.

Then they wait for a real invoice to go out, intercept it, and resend the same PDF with one change: the IBAN. The email comes from the real supplier address. The signature, formatting, and PDF template are identical. Only the bank account is different.

> Red flag: A long-standing supplier sends you "updated bank details" by email - especially close to an existing invoice due date. The FBI's own guidance on this pattern is to verify through a channel and a number you already had, never one supplied in the request^[2].

#### What this looks like in practice (anonymised, from a case we handled)

A 14-person design studio in central Europe had worked with the same print supplier for six years. In March the supplier's mailbox was compromised through a phished webmail password. The attacker read the thread quietly for five weeks.

When the studio's producer emailed to approve a €18,400 print run, the attacker replied *from the supplier's real address*, on the real thread, with the real invoice PDF - re-issued with a new IBAN and a one-line note: "we've moved banks this quarter, please use the details on the attached." No spoofed domain, no typos, no urgency. The studio paid the same day.

The fraud surfaced 19 days later when the supplier chased the invoice. €18,400 had already been split across three accounts. €2,900 was recovered. A single 40-second phone call to the supplier's known number would have stopped it - which is exactly why the UK's NCSC puts out-of-band verification of any bank-detail change at the centre of its business payment fraud guidance^[3].

2. CEO / founder impersonation

A finance employee gets a message - email, WhatsApp, sometimes SMS - that looks like it's from the founder: *"I'm in a meeting, need you to push through an urgent transfer to this account today, will explain later."*

The domain is usually a lookalike (techsuit.io → techsuit-io.com, or techsuıt.io with a Turkish dotless ı). On WhatsApp, the profile photo is the real founder pulled from LinkedIn.

> Red flag: Urgency + secrecy + a payment request that bypasses normal approval flow. Always.

3. Invoice manipulation inside your own mailbox

The attacker compromises *your* mailbox first - usually through a phished Microsoft 365 password with no MFA. Once inside, they set up a mailbox rule that auto-forwards or deletes any email containing words like "invoice", "payment", "bank", or "IBAN".

Then they impersonate your finance team to your customers, and your customers to your finance team. Money flows out before anyone realises both sides are talking to a stranger.

4. Payroll redirect

Around payroll dates, HR receives an email from "an employee" requesting that their salary be paid to a new account. It's plausible - people switch banks. The change goes through, and one employee's monthly salary lands in a fraudulent account.

Small loss per incident, but trivially easy to execute and often repeated month after month before being discovered.

5. Fake invoice / fake supplier

A finance inbox receives an invoice from a supplier that *looks plausible* - domain-matched email, professional PDF, reasonable amount. It might reference a real project or a generic line item like "consulting services" or "domain renewal".

If no one strictly checks supplier onboarding, the invoice gets paid. We've seen €400-€2,000 invoices clear without anyone noticing the supplier didn't exist.

Why small businesses are the preferred target

Three reasons:

1. 1Fewer controls. No dual-approval on wires. No callback verification. Often one person handling both the email and the bank.
2. 2Faster money movement. SMBs need to pay quickly to keep operations running. Fraud relies on that speed.
3. 3Lower scrutiny per transaction. A €15,000 wire at a 25-person company is normal. The same wire at a Fortune 500 triggers automated review.

The controls that actually stop it

You don't need an enterprise security stack. You need 6 specific controls.

Control 1 - MFA on every mailbox (no exceptions)

The single highest-ROI security control for an SMB. Microsoft measured MFA cutting the risk of account compromise by 99.22%, and by 98.56% even where the password had already leaked^[4] - and a compromised mailbox is how the invoice-manipulation pattern above starts. Microsoft 365 Conditional Access can enforce this for every user in one policy.

Control 2 - Mailbox rule auditing

Most BEC attacks set up forwarding or deletion rules. Microsoft Defender for Office 365 alerts on any new external forwarding rule. Without this, you can be compromised for weeks and never know.

Control 3 - Out-of-band callback verification

A non-negotiable rule for finance: any bank detail change, or any new wire over a threshold (€2,000-€5,000), is verified by phone - using the phone number you already have on file, not one from the email.

Print this on a card. Put it on the finance person's monitor. It will stop more fraud than any software.

Control 4 - Dual approval for wires

Two people must approve any outbound payment above a threshold. Most banks (across Israel and the EU) support this natively in the business portal. Enable it.

Control 5 - Supplier onboarding checklist

New suppliers don't get paid until: (a) someone has spoken to them on the phone using a number from their official website, (b) bank details are received via that verified channel, (c) a manager has approved the supplier record.

Control 6 - Domain protection (SPF, DKIM, DMARC)

Properly configured DMARC at p=reject prevents attackers from sending email *as your domain* to your customers. Without it, your customers are an attack surface you don't control.

What to do in the first 60 minutes after a fraudulent transfer

Speed matters more than anything else.

1. 1Call your bank's fraud line - not the branch. Request an immediate recall (in the EU, SEPA recall; in Israel, ask for "החזרת זיכוי דחופה"). Funds can sometimes be frozen if the receiving bank hasn't released them.
2. 2File a police report immediately. Your bank often won't act on a recall request without one.
3. 3Reset every password and revoke every active session on the compromised mailbox. Don't assume the attacker is gone.
4. 4Notify your insurer. Most cyber policies have a 24-72 hour notification window.
5. 5Check mailbox rules for forwarding and deletion - and audit the last 90 days of sent items.

The 30-minute mark is roughly when funds typically leave the first receiving account. Past that, recovery rates fall sharply.

What this costs to implement

For a 10-person business, the full stack - MFA, Defender for Office 365, mailbox rule alerting, DMARC, documented dual-approval and callback procedures - runs about €15-25/user/month on top of standard Microsoft 365 licensing.

A single prevented incident pays for the entire program for 5-10 years.