Payment Fraud Red Flags Checklist
Most payment fraud is preventable with a few habits: verify changes to bank details out of band, scrutinise unusual order and payment patterns, and slow down when pressure and urgency are being applied.
What this checklist covers
- Recognise the common signs of payment and invoice fraud
- Verify changes to payment details independently
- Scrutinise unusual orders, refunds and chargeback patterns
- Build simple controls that slow fraud down
- Know what to do if you suspect fraud
6 min
Before you start
Fraud against businesses often arrives as a convincing email, a too-good order, or an urgent request to change bank details. Before tightening controls, review how your team currently handles payment changes, new customers, and refund requests, and where a single person can move money without a second check.
- Map who can change supplier or customer bank details, and how.
- Review how new customers and large first orders are vetted.
- Check your refund and chargeback handling for weak points.
- Identify any payment that one person can authorise alone.
This is general information only and not legal advice. If you suspect fraud has occurred, get professional advice and consider reporting it to the relevant authorities promptly.
Watch for the red flags
- A request to change bank details, especially with urgency or secrecy.
- An email address or domain that is subtly different from the genuine one.
- Pressure to bypass normal checks or act before a deadline.
- A new customer placing an unusually large first order on credit.
- Overpayment followed by a request to refund the difference elsewhere.
- Mismatched billing and delivery details, or reluctance to provide verifiable business details.
No single flag proves fraud, but several together should stop the transaction until you have verified it independently. Urgency is the fraudster's main tool — treating "do it now" as a reason to slow down, not speed up, defeats most scams.
Verify and control
- Verify any bank-detail change by calling a known, trusted number — never the one in the request.
- Require a second person to approve payments above a set threshold.
- Vet new credit customers and confirm their business details independently.
- Hold suspicious orders or refunds until checks are complete.
- Keep a record of the verification you performed.
Out-of-band verification is the single most effective control: confirming a change through a separate, trusted channel stops the most expensive scams cold. Pair it with dual approval for larger payments and most fraud loses its grip.
Common mistakes
- Acting on a bank-detail change without independent verification.
- Letting one person authorise large payments unchecked.
- Treating urgency as a reason to skip checks rather than apply them.
- Shipping large first orders on credit without vetting the customer.
- Refunding overpayments to a different account on request.
If fraud results in an unpaid or disputed balance, a free debt appraisal can help you assess any recovery options.
Key takeaways
- Verify any bank-detail change through a separate, trusted channel.
- Treat urgency and secrecy as reasons to slow down.
- Require dual approval for payments above a set threshold.
- Hold and check suspicious orders, overpayments and refunds.
Frequently asked questions
Someone emailed asking to change our supplier's bank details — what do I do?
Do not act on the email alone. Verify the change by calling a known, trusted number for the supplier, not any number in the request. This out-of-band check stops most payment-redirection fraud.
What is the biggest red flag for payment fraud?
Urgency combined with a request to change payment details or bypass normal checks. Several flags together should stop the transaction until you have verified it independently.
What should I do if I think we have been defrauded?
Act quickly: contact your bank, preserve the evidence, get professional advice, and consider reporting it to the relevant authorities. Speed can affect whether funds are recoverable.
Work the checklist, then get paid
Use the free Invoice Generator, then let Merion recover anything that goes unpaid — commission-only.