The most effective fraud protection combines verification at the point of sale with monitoring after the transaction clears

Payment fraud against businesses happens in layers. A customer's card details get stolen and used online. A wire transfer request arrives from someone claiming to be your supplier. An employee processes a refund to an account that isn't yours. Each route looks different, but they all succeed because someone verified less than they should have.

The protection that works is not one tool—it's a sequence. You verify the person or business on the other end before you move money. You watch for patterns that don't match your normal activity. You document what you checked so you can prove you did your due diligence if something goes wrong. And you know which fraud losses you can recover and which ones you cannot.

Key Takeaways

  • Verify customer identity through multiple signals before processing payments—a single data point (like a matching name) is not enough.
  • Wire transfers and ACH payments are nearly impossible to reverse once sent, so confirmation calls to known phone numbers are standard practice for large transfers.
  • Chargebacks protect customers but not businesses; your only recovery route for most fraud is your payment processor's fraud tools or your bank's investigation.
  • Employee fraud is the most common type and requires segregation of duties—no single person should be able to initiate, approve, and reconcile payments.
  • Documentation of your verification steps protects you if a customer disputes a charge or if you need to prove you followed reasonable security practices.

Verify customers before you process their payment

A customer places an order online and provides a card number. The card is real and the charge goes through. Three weeks later, the actual cardholder disputes it and your processor reverses the payment. You've already shipped the product. This is friendly fraud or chargeback fraud, and it's the most common type of payment fraud against online businesses.

Prevention starts with matching multiple pieces of information before you ship. Check that the billing address matches the card issuer's records (your payment processor does this automatically through Address Verification Service, or AVS). Check that the CVV code on the back of the card is correct. For high-value orders, call the customer at a phone number you find independently—not one they provided—and confirm they placed the order. If the billing and shipping addresses don't match, ask why before you process the payment.

For in-person transactions, check the cardholder's ID against the name on the card. For phone orders, use the same verification steps as online orders. For recurring charges (subscriptions, memberships), send a confirmation email before the first charge and again before any price increase, so the customer has a clear record of what they authorized.

Protect wire transfers and ACH payments with a confirmation step

Wire transfers and ACH payments (bank-to-bank transfers) move money out of your account in hours or days. Once sent, they are almost never reversed. This makes them the target of business email compromise (BEC) fraud, where someone impersonates your supplier, your accountant, or your landlord and requests a large payment to a new account.

For any wire or ACH payment over a threshold you set (many businesses use $5,000 or $10,000), call the person requesting the payment using a phone number from your records—not from the email or message they sent. Confirm the payment amount, the account it's going to, and the reason. If you've never wired to that account before, ask the supplier why the account changed. If the request came by email, call the company's main phone line and ask to be transferred to the person who supposedly sent it.

Document the call: note the date, time, who you spoke to, and what you confirmed. If the call raises any doubt, do not send the payment. Legitimate suppliers will understand the delay. Fraudsters often disappear when asked to confirm by phone.

Monitor your accounts for patterns that don't match your business

Fraud often leaves traces before the damage is large. A sudden spike in chargebacks. Refunds going to accounts you don't recognize. Transactions from countries where you don't do business. An employee processing payments at 2 a.m. when your business is closed.

Review your payment processor's dashboard weekly. Most processors flag transactions that look unusual and let you dispute them within a window (usually 30 to 180 days, depending on the processor and card network). The sooner you dispute, the better your chances of recovery. Set up alerts for transactions above a certain amount or from new customers, so you see them in real time rather than in a weekly report.

For employee fraud, watch for refunds that don't match sales records, payments to vendors you don't recognize, or changes to supplier bank account information. If your accounting software allows it, set up approval workflows so that no single person can initiate and approve a payment without a second person reviewing it.

Separate duties so no one person controls the entire payment process

Employee fraud accounts for more money lost than external fraud in most businesses. It happens because one person can initiate a payment, approve it, and hide it in the books without anyone else seeing it.

The standard control is segregation of duties: the person who requests a payment is not the person who approves it, and neither of them is the person who reconciles the bank statement. If you have only one or two employees, this is hard but not impossible. You can approve all payments yourself, even if an employee requests them. You can reconcile the bank statement yourself, even if an employee records the transactions. The goal is that at least two people see each payment.

For larger teams, assign roles clearly: one person enters vendor information and payment requests, another person approves them, and a third person reconciles the bank statement to the accounting records. Rotate these duties periodically so no one person owns the entire process. Review bank statements yourself, not just summaries prepared by staff.

Know what fraud losses you can recover and what you cannot

Recovery depends on the type of fraud and how quickly you report it.

Chargebacks (customer disputes of card charges) protect the customer, not you. If a customer claims they didn't authorize a charge or didn't receive goods, the card network (Visa, Mastercard, American Express) sides with the customer in most cases. Your only defense is documentation: order confirmation emails, shipping records, delivery signatures, or a recording of the customer authorizing the charge. If you have that documentation, you can dispute the chargeback, but the process takes weeks and the card network decides the outcome.

Unauthorized card transactions (someone using a stolen card number) are the card network's responsibility, not yours, if you followed basic verification steps. Your processor handles the dispute and you are not liable for the loss.

Wire transfer and ACH fraud are your loss. Your bank may investigate if you report it within a few days, but recovery is rare. The money usually moves through multiple accounts and is withdrawn before the bank can freeze it. Prevention (the confirmation call) is your only real protection.

Employee theft may be recoverable through your business insurance (crime insurance or employee dishonesty coverage), but only if you report it quickly and have documentation. Some businesses also pursue civil or criminal charges, though recovery is slow and uncertain.

Set up basic security practices that reduce your exposure

Beyond verification and monitoring, a few standard practices reduce the chance fraud succeeds in the first place.

Use a payment processor (Stripe, Square, PayPal, etc.) rather than storing card details yourself. Processors handle the security compliance and fraud detection. They also provide dispute tools and chargeback protection that you would not have if you processed cards directly.

Require strong passwords for your payment accounts and accounting software, and use two-factor authentication (a code sent to your phone in addition to your password) for any account that can move money. Change passwords if an employee leaves. Limit access to payment systems to people who need it.

For online orders, use HTTPS (the padlock icon in the browser) so customer data is encrypted in transit. For in-person payments, use a card reader that connects to your processor, not one that stores card details on your device.

Keep records of all transactions, disputes, and refunds for at least three years. If a customer disputes a charge long after the fact, you need to be able to prove what happened.

Respond quickly if you discover fraud

The moment you realize fraud has occurred, your timeline matters.

For unauthorized card transactions, report them to your processor when ready. Most card networks require you to report within 30 days to be protected from liability.

For wire transfer or ACH fraud, contact your bank the same day. Ask them to freeze the account the money was sent to. If the account is at another bank, your bank can send a recall request, but success depends on how quickly the receiving bank acts. Most money is withdrawn within hours, so speed is critical.

For chargebacks, your processor will notify you. You typically have 7 to 10 days to submit a response with documentation. Gather your evidence when ready: order confirmations, shipping records, delivery proof, customer communications. The stronger your documentation, the better your chance of winning the dispute.

For employee fraud, find any evidence (emails, transaction records, bank statements) and consult with your accountant or attorney before confronting the employee. You may need to file a police report to support an insurance claim.

Frequently Asked Questions

What should I do if a customer claims they didn't authorize a charge?

Gather your documentation when ready: the order confirmation, any emails from the customer, shipping records, and delivery proof. If you have a recording of the customer authorizing the charge, that's your strongest evidence. Submit this to your processor as soon as you receive the chargeback notice. If the documentation is clear, you have a reasonable chance of winning the dispute.

How do I know if a wire transfer request is legitimate?

Call the person requesting it using a phone number from your records, not from the email or message they sent. Confirm the amount, the account it's going to, and the reason for the payment. If the account is new or the request is unusual, ask more questions. Legitimate suppliers will not mind the delay. If anything feels off, do not send the money.

Can I recover money if an employee steals it?

Recovery depends on your business insurance. Crime insurance or employee dishonesty coverage may cover the loss, but only if you report it quickly and have documentation. You can also pursue civil or criminal charges, but recovery is slow and uncertain. Prevention through segregation of duties is more effective than recovery.

What's the difference between a chargeback and a refund?

A refund is money you return to the customer voluntarily, usually because they returned goods or asked for their money back. A chargeback is a dispute the customer files with their card network, claiming they didn't authorize the charge or didn't receive what they paid for. Chargebacks are harder to defend and may result in fees from your processor.

Do I need to use a payment processor, or can I process cards myself?

Using a processor is simpler and safer. Processors handle security compliance, fraud detection, and dispute tools. If you process cards directly, you are responsible for security compliance (PCI DSS), which is complex and expensive. For most small and medium businesses, a processor is the better choice.