5 warning signs a B2B payment may be fraudulent

Most B2B payment fraud does not start with an obviously fake invoice. It starts with something smaller: a changed bank account number, an email that feels slightly off, or a request to move faster than usual. Finance and accounts payable (AP) teams that know how to spot these signals can stop most fraud attempts before money ever leaves the account.

Payments fraud remains an active concern for finance teams. In the WEX 2027 B2B Payments Trends Report, 28% of organizations claimed to have experienced payments fraud in the previous six months. At the same time, 44% identified managing payment risk, fraud and security as a major challenge in managing B2B payments.

Here are the five warning signs to watch for, based on how these attacks may actually unfold:

1. A last-minute change to vendor banking details
2. Unusual urgency or pressure to skip normal approval steps
3. Email addresses or vendor contact details that don’t quite match
4. Invoice or payment details that don’t reconcile
5. A request to change the payment method or destination

Each one is explained below, along with what to do the moment you notice it.

1. A last-minute change to vendor banking details

A vendor “updating” their bank account information right before a payment is due is one of the clearest signs of B2B payment fraud. This is the core mechanic behind vendor impersonation, a common form of BEC.

Here’s a typical scenario: an AP clerk receives an email that looks like it came from a regular supplier. The message references a real invoice number and asks that future payments go to a new account because of a “banking transition” or “audit.” Everything reads correctly except one detail: the account belongs to the fraudster, not the vendor.

What makes this tactic effective is timing. Requests often arrive close to a payment due date, when teams are moving quickly and less likely to pause for verification.

What to do: Never update banking details based on an email alone. Call the vendor using a phone number already on file, not one included in the request, and confirm the change verbally before processing any payment.

2. Unusual urgency or pressure to skip normal approval steps

Urgency is a tactic, not a coincidence. Fraudsters count on employees rushing through a request instead of following standard controls.

Common pressure signals include:

• A request marked “urgent” or “confidential” that discourages the recipient from looping in a manager or second approver.
• An email that appears to come from an executive, asking for a wire to be sent quickly and quietly.
• Pushback or guilt-tripping when someone asks to verify the request through a separate channel.
• A request timed for late Friday afternoon, right before a holiday, or during a period when key approvers are traveling.

What to do: Treat urgency itself as a red flag. Legitimate payment requests can withstand a short delay for verification. Apply the same approval steps regardless of who appears to be asking or how time-sensitive the request seems.

3. Email addresses or vendor contact details that don’t quite match

Look-alike domains are one of the easiest ways to catch a fraudulent message, but only if someone actually checks the address character by character.

Watch for:

• A domain that swaps a letter or adds a character (for example, an extra letter or a “rn” that looks like an “m”).
• A vendor contact suddenly emailing from a personal account, such as a free webmail address, instead of their usual company domain.
• A phone number in the email signature that differs from the one already in your vendor records.
• Reply-to addresses that differ from the sender address shown in the inbox.

What to do: Compare the full domain against your vendor master file rather than skimming the display name. If anything looks even slightly different, verify through a channel you already trust before responding.

4. Invoice or payment details that don’t reconcile

Fraudulent invoices often look professional. What gives them away is that the details don’t line up with your own records.

Signs to check for:

• The invoice amount, terms, or line items don’t match the purchase order (PO) or contract.
• An invoice number that duplicates or closely resembles one already paid.
• A first-time invoice from a vendor that isn’t in your approved vendor master file.
• Round, unusually large dollar amounts with no supporting documentation.

What to do: Run a three-way match between the PO, the receiving record, and the invoice before approval. Treat any new vendor requesting a large first payment as a reason to slow down and verify, not a reason to expedite.

5. A request to change the payment method or destination

Fraud attempts often include a request to shift how or where a payment is sent, since that’s what actually moves money into the fraudster’s control.

Examples include:

• A vendor that normally receives a check suddenly asking for a wire instead.
• A request to split a payment across multiple accounts.
• Banking details tied to a different country than the vendor’s known business address.
• Any request to send payment through gift cards or other non-standard rails, which are almost never legitimate for B2B transactions.

What to do: Apply a waiting period before honoring a first payment to new banking details, and confirm any change to payment method or destination with an independent callback, not a reply to the same email thread.

What to do the moment you spot a warning sign

If any of the signs above show up, act before the payment goes out.

• Pause the payment. Don’t process it while verification is in progress, even under deadline pressure.
• Verify independently. Use a phone number or contact method that predates the suspicious request.
• Escalate. Involve a second approver or your fraud and security team rather than resolving it alone.
• Notify your bank immediately if a payment already went out. Financial institutions may be able to recall or freeze funds, but only if you act quickly.
• Document and report the attempt. Internal documentation supports future prevention, and significant incidents may also be reportable to the Internet Crime Complaint Center (IC3) at ic3.gov.

Building fraud prevention into your AP process

Spotting red flags matters, but it works best alongside structural controls that reduce how much damage a single mistake can cause.

• Vendor verification at onboarding. Confirm banking details through an independent channel before a new vendor enters your system, not after the first payment request.
• Segregation of duties. Require different people to add a vendor, approve an invoice, and release a payment.
• ACH fraud filters. ACH blocks or filters can limit which originators are allowed to debit your accounts.
• Ongoing training. Since BEC relies on social engineering rather than technical hacking, regular training on current tactics helps employees recognize new variations.

Payment method also affects fraud exposure. Checks and ACH debits carry static account information that, once compromised, can be reused. Virtual cards work differently: WEX virtual cards generate single-use card numbers that finance teams can restrict by vendor, transaction amount, and expiration date, which can help limit how a compromised number could be used even if it were intercepted. That’s a different kind of protection than catching a red flag in an email, and it’s worth evaluating alongside the verification habits above rather than instead of them.

FAQ

What is business email compromise (BEC) in B2B payments?

BEC is a fraud tactic where someone impersonates a trusted party, such as a vendor, executive, or colleague, usually by email, to trick an employee into changing payment details or releasing funds. In B2B payments, BEC most often shows up as a vendor impersonation request to update banking information or a spoofed executive request for an urgent wire. 

What should we do if we already sent a fraudulent payment?

Contact your bank immediately and ask about recall or reversal options, since the chances of recovering funds drop quickly after a payment settles. Document everything you know about the request, including the email or message that initiated it, and report the incident to your internal security team. Significant incidents involving wire transfers or BEC can also be reported to the FBI’s IC3 at ic3.gov.

Are virtual cards safer than ACH or wire transfers for B2B payments?

Virtual cards can reduce certain types of fraud exposure because a single-use number tied to a specific vendor, amount, and expiration date has limited value if it’s exposed. ACH and wire transfers rely on static account numbers that don’t expire and can be reused if compromised. No payment method removes fraud risk entirely, so virtual cards work best paired with vendor verification and approval controls rather than as a replacement for them.

How often should we update our vendor verification process?

Review vendor verification procedures at least annually, and sooner if your organization has experienced an attempted fraud incident or added new payment channels. Fraud tactics evolve, including the recent rise in AI-enabled voice and video impersonation, so a process built for email-only threats may need updates to address newer methods.

If your team wants to reduce how much damage a single missed red flag can cause, take a look at how vendor-level and transaction-level controls on virtual cards fit into your existing approval process.

For more insights and updates on corporate payments, check out:

• Your guide to virtual card rebates
• How to create an anti-fraud culture
• How to prevent B2B payment errors before year-end

Learn more about how WEX payment solutions can be tailored to your business, so you can accelerate and streamline operations while creating lasting growth and success for your organization.

The information in this blog post is for educational purposes only. It is not legal or tax advice. For legal or tax advice, you should consult your own legal counsel, tax, and investment advisers.

Copyright ©2026 WEX Inc. All rights reserved. The information in this document is subject to change without notice.