Fraud & controls
The $50,000 email: how payment fraud finds thin finance teams
A spoofed vendor bank-change or a fake “urgent” request from the CEO is aimed squarely at small finance teams. Here’s how the scam works — and the two controls that stop it cold.
A routine email, a changed account number, and $50,000 gone.
The scenario
The email looks exactly right. It’s from a vendor the mission pays every month, the logo matches, the tone matches, and it says the same thing these emails always say: we’ve changed banks, please update our account for the next payment. The finance assistant updates the record and pays the invoice. The money lands in a criminal’s account, and by the time the real vendor asks where their payment is, it’s long gone.
This is business email compromise, and it is not rare or sophisticated. It’s a volume crime that specifically targets organizations with thin finance controls — a single person who can both change a payee and release a payment, working fast, trying to be helpful. Missions fit the profile almost perfectly.
The two moments a fraud gets through
Where a fake payment slips past
Fraud needs one person, one system, and a little urgency. Break any of the three and the scheme falls apart.
The good news is that the defenses are simple, cheap, and boring — which is exactly why under-resourced teams skip them. Two controls stop the large majority of these attacks.
First, separation of duties: the person who can change a vendor’s bank details must not be the same person who releases the payment. A fraudulent change then requires two people to both miss it, which rarely happens. Second, out-of-band verification: any change to payment details gets confirmed by a phone call to a known number — never by replying to the email that requested it. A thirty-second call to the real vendor ends the scheme.
The reason these controls so often don’t exist isn’t ignorance; it’s staffing. When one person is the finance department, separation of duties feels impossible. That’s precisely why it needs to be built into the tools a small team uses, not left to a headcount they don’t have.
The takeaway: ask one question of your own process — can a single person, on a single email, change where our money goes and then send it? If yes, you don’t have a fraud risk. You have an open door.
Payment fraud doesn’t break in. It emails politely, and waits for one busy person to be helpful.
Where SNDR fits
SNDR builds dual-approval and payee-change controls into the workflow, so no single person can both redirect and release a payment — the protection a corporate treasury takes for granted, sized for a team of one or two.