Small business fraud prevention comes down to a short list of controls that a company with a handful of finance staff can run every month: split payment duties, review the bank and card activity yourself, verify every change to vendor bank details by phone, and give people a way to report concerns. These controls target the schemes that hit small companies hardest, which are false billing, check and payment tampering, and payment redirection by email.
This guide explains where small business fraud prevention should start, using the 2026 ACFE study of 2,402 fraud cases and the FBI's 2025 internet crime data. It covers internal theft by employees and outside payment fraud, with a control table, a worked example and a response plan for the day you find a problem.
The Association of Certified Fraud Examiners (ACFE) runs what it describes as the largest study of occupational fraud. Its Occupational Fraud 2026: A Report to the Nations covers 2,402 cases from 143 countries, with total losses of more than $3.4 billion and a median loss of $104,000 per case. Certified fraud examiners surveyed for the study estimate that organizations lose 5% of revenue to fraud each year.
Organizations with fewer than 100 employees made up 22% of the cases and had the highest median loss of any size band, at $126,000. The report notes that the effect of these losses "is typically more significant at smaller organizations, since those losses likely represent a much larger percentage of the organization's revenue."
Much of the gap comes from how small finance teams are staffed. In a small company the same person often opens the mail, enters bills, prints checks and reconciles the bank account. The ACFE found that one-third of frauds happened because the victim lacked internal controls, another 19% because someone overrode existing controls, and 18% because of a lack of management review. Together those three weaknesses explain 70% of the cases in the study.
Asset misappropriation, meaning theft or misuse of the company's own resources, appeared in 90% of cases in the 2026 study. Several schemes were far more common in businesses with fewer than 100 employees than in larger ones:
| Scheme | Under 100 employees | 100+ employees |
|---|---|---|
| Billing schemes (fake or inflated invoices) | 28% | 18% |
| Expense reimbursement schemes | 19% | 10% |
| Check and payment tampering | 18% | 8% |
| Skimming (taking cash before it is recorded) | 17% | 6% |
| Payroll schemes | 13% | 8% |
| Theft of cash on hand | 13% | 8% |
Source: ACFE, Occupational Fraud 2026, Figure 24. Percentages exceed 100% because one case can involve more than one scheme.
Corruption, such as kickbacks from a supplier, was the single most common scheme at both sizes (40% of small-business cases). Billing and payment schemes are where a small business owner can make the fastest progress, because the fix sits inside the payables and banking workflow.
Small companies run far fewer anti-fraud controls than larger ones. The ACFE compared implementation rates by size, and the gaps are wide:
| Control | Under 100 employees | 100+ employees |
|---|---|---|
| Hotline or reporting channel | 24% | 85% |
| Management review | 41% | 79% |
| Proactive data monitoring and analysis | 17% | 58% |
| Surprise audits | 16% | 52% |
| Job rotation or mandatory vacation | 8% | 32% |
Source: ACFE, Occupational Fraud 2026, Figure 30.
Several of the controls small businesses skip are the ones the study links to the biggest reductions in losses. Where management review was in place, the median loss was $84,000 against $186,000 without it, a 55% reduction. Surprise audits cut the median loss from $149,000 to $74,000 and halved the median time to detection, from 16 months to 8 months. Proactive data monitoring was associated with a median loss of $70,000 against $150,000 without it.
Each of these controls can be run by an owner or outside reviewer who looks at the right reports on a fixed schedule and occasionally without warning.
The controls below follow the money from the bank account outward. Each one is sized for a business with one to five people touching the books.
Segregation of duties means no single person can start, approve, record and hide a transaction. With a small team you will not separate every step, so focus on the pairs that matter most:
Where you cannot split a duty, add a review. The owner reviews the bank statement directly from the bank portal each month, looking at payees, amounts and cleared check images. This single habit is the small-business version of the management review control the ACFE ranks first. Our guide to internal controls testing for small businesses explains how to check that these controls work in practice once they are in place.
Bank, credit card and payroll clearing accounts should be reconciled within a few days of month end, with the reconciliation reviewed and signed by someone other than the preparer. Unreconciled differences that roll forward month after month are a common place for theft to sit. A 5-day monthly close checklist gives a practical sequence for AP, AR and reconciliation sign-offs, and a small business bookkeeping checklist covers the daily and weekly tasks that feed it.
Billing schemes depend on getting a fake or altered vendor into the system. Keep these rules in writing:
If you are moving payables onto software, choose a setup that enforces approvals and logs who changed what. Our article on automated accounts payable solutions covers what to configure during rollout.
Ghost employees and inflated hours are classic payroll schemes. Compare the payroll register to an active employee list each quarter, require approval for every direct deposit change, and have the owner spot-check a pay run against timesheets. Unpaid payroll tax deposits are a separate risk, and owners should know that the IRS can hold responsible people personally liable through the trust fund recovery penalty. Our list of common payroll mistakes small businesses make covers the process errors that often sit alongside payroll fraud.
Skimming and cash larceny are far more common in small businesses. Keep cash on hand low, deposit daily, and compare point-of-sale totals to deposits. Perform a surprise count of the cash drawer or a high-value inventory bin a few times a year. For retailers, our guide to retail inventory shrinkage accounting covers the journal entries and controls for inventory loss.
Mandatory vacation or job rotation was in place at only 8% of small victim organizations. Many internal schemes require constant attention to keep hidden, and a week in which someone else handles the mail, deposits and reconciliations often brings them to light.
A complete small business fraud prevention plan also covers criminals outside the company, who now target payments directly.
The FBI's Internet Crime Complaint Center (IC3) received 24,768 business email compromise (BEC) complaints in 2025, with reported losses of $3,046,598,558, according to its 2025 IC3 Annual Report. That is about 10% more than the $2,770,151,146 reported in 2024. The FBI describes BEC as a scam targeting businesses that regularly make wire transfer payments, carried out by "compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications." The same report says businesses reported losses of more than $30 million in 2025 to BEC scams involving AI, such as cloned voices or emails mimicking a CEO.
The most useful control is a call-back rule: any request to pay a new account, change bank details or send an urgent wire is confirmed by phone using contact details you already hold. Add a second approver for wires above a set amount, and turn on multi-factor authentication for email and the bank portal. Our article on cloud accounting security best practices for remote teams covers access settings in more depth.
Tax-season phishing follows the same pattern. In its 2026 Dirty Dozen list, the IRS warns that "Tax professionals and businesses remain targets of 'new client' or 'document request' emails" and lists warning signs including "mismatched or unfamiliar sender addresses, urgent payment demands, or links directing users to websites that do not clearly originate from IRS.gov."
Paper checks remain a target. In a 2023 alert on mail theft-related check fraud, FinCEN reported that check fraud suspicious activity reports passed 680,000 in 2022, nearly double the prior year. It also noted that "business checks may be more valuable because business accounts are often well-funded and it may take longer for the victim to notice the fraud."
Practical steps: pay vendors electronically where you can, drop outgoing checks inside the post office, ask your bank about check and ACH positive pay services that flag items you did not issue, and review cleared check images each month for altered payees.
The ACFE data shows a direct link between detection speed and losses. Frauds caught within six months had a median loss of $40,000, while those caught at seven to twelve months had a median loss of $100,000, two and a half times as much. One-third of frauds in the study were caught within the first six months.
Here is how that plays out in one business. A bookkeeper at a 15-person distributor sets up a fake supplier and pays it $2,500 a month.
| Scenario | Months before detection | Loss |
|---|---|---|
| No owner review; found at year-end by the outside accountant | 12 | $30,000 |
| Owner reviews the bank portal and new vendors monthly; found in month 2 | 2 | $5,000 |
| Difference | 10 | $25,000 |
In the second scenario the new vendor appears on the owner's monthly new-vendor report, the owner cannot recognize it, and a call to the listed phone number goes nowhere.
Tips detected 43% of frauds in the 2026 ACFE study, nearly three times as many as the next most common method, and 55% of those tips came from employees. Yet only about a quarter of small businesses had a hotline. A small company does not need a call center. A dedicated email address read by the owner or an outside adviser, a web form, or an anonymous third-party line all count as reporting channels, as long as staff, customers and vendors know it exists.
The ACFE also found that 84% of fraudsters showed at least one behavioral red flag, such as living beyond their means or refusing to share duties. Write a short code of conduct, cover fraud awareness in onboarding, and make it normal for anyone to question an unusual payment request without consequences.
Owner-level fraud is the hardest to stop with internal controls, since owners can override them. The ACFE reports a median loss of $475,000 for frauds by owners and executives against $50,000 for frauds by employees. For businesses with several owners or outside investors, an annual review or audit by an independent accountant adds a check that sits outside management.
If you suspect fraud, act in this order:
What is the most effective small business fraud prevention control? Owner review of bank activity and new vendors each month is the most practical starting point. In the 2026 ACFE study, management review was associated with a 55% lower median loss, the largest reduction of the 18 controls examined.
How much do small businesses lose to fraud? In the ACFE's 2026 study, organizations with fewer than 100 employees had a median loss of $126,000 per case, the highest of any size group. Because small companies have lower revenue, the same loss represents a much larger share of their income.
How can a small business prevent business email compromise? Confirm every request to change bank details or send an urgent payment by calling a phone number you already have on file. Require a second approver for large wires and turn on multi-factor authentication for email and banking. If money is sent, contact your bank at once and file a complaint at ic3.gov.
Can one person handle the books safely in a very small business? Yes, if the owner adds review steps the bookkeeper cannot control. The owner should read bank statements directly from the bank, approve new vendors and payroll changes, and see the monthly reconciliations. Periodic review by an outside accountant adds another layer.
How often should a small business review its fraud controls? Review them at least once a year and after any change in staff, banks or accounting software, so each control still matches who does what in the finance workflow.
Madras Accountancy supports US businesses and CPA firms with bookkeeping, account reconciliations, payables processing and month-end close, which gives owners clean records to review each month. To discuss your accounting workflow, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
