How to Prevent Payment Rerouting Fraud in B2B Credit and AR

A polite, well-formatted email arrives in the AR inbox at 4:00 PM on a Friday. The subject line is mundane: "New Banking Instructions" or "Updated Remittance Details." The logo matches your customer's branding. The signature block looks authentic. The request is simple: the customer has changed banks and needs you to update their wiring instructions before the next payment run.

‍

If your team processes this request without secondary verification, the money for the next invoice will leave your account and settle in a fraudster's account. By the time the real customer calls asking why they haven't been paid, the funds are gone.

‍

This is payment rerouting fraud. It relies on social engineering rather than technical vulnerability, making it one of the hardest risks to block with software alone. The challenge for Credit Managers is balancing security with speed — you cannot treat every customer email as a threat, but you also cannot accept banking changes at face value. This guide outlines why these attacks are succeeding and what a practical verification framework looks like.

‍

The reality of the inbox

Fraud is no longer a theoretical risk for credit departments — it is an operational one. These attempts have grown more sophisticated. The emails are no longer riddled with typos; they use scraped data to mimic the tone and timing of legitimate business correspondence.

‍

This shift has expanded the Credit Manager's role. Managing credit risk now includes managing the integrity of master data. If your ERP is updated with fraudulent banking details because of a phishing email, your credit limits and payment terms are irrelevant — the cash is at risk the moment a payment runs.

‍

B2B finance teams are being targeted specifically because the combination of high payment volumes, lean AR staffing, and reliance on email creates predictable vulnerabilities. Understanding those vulnerabilities is the first step toward closing them.

‍

Root cause analysis: why rerouting fraud works

Reliance on email as a source of truth. Most credit and AR teams still use email as their primary channel for vendor and customer data management. If a customer sends a PDF form via email, the team processes it. But email addresses can be spoofed, and legitimate accounts can be compromised through Business Email Compromise (BEC). When a request arrives from a "trusted" address, human skepticism drops accordingly.

‍

The pressure for speed. AR teams are measured on efficiency and Days Sales Outstanding (DSO). When a "customer" claims they cannot pay an invoice until banking info is updated, the instinct is to remove that friction immediately. Fraudsters exploit this urgency — often citing pending deadlines or account closures — to pressure teams into bypassing verification steps.

‍

Static forms and PDF limitations. Many companies still rely on static PDF forms for onboarding and updates. These documents have no built-in security features. Anyone with a PDF editor can take a standard vendor setup form, fill it with fraudulent data, and return it. There is no digital audit trail to verify who actually completed the document or whether the contact is legitimate.

‍

Siloed communication. The AR specialist receiving the email often has no day-to-day relationship with the customer's actual contact. They cannot recognize that the tone is off or that the request is out of character. Without a shared system displaying contact history, the analyst is working without context.

‍

A framework for defense: the "out-of-band" verification protocol

Preventing rerouting fraud requires a shift from passive acceptance to active verification. This does not mean treating every customer as a suspect — it means establishing a standard protocol for specific high-risk actions, like changing bank details.

‍

Bectran's fraud detection and anomaly monitoring capabilities are built around this principle: flag the action class, not just individual suspicious actors.

‍

The Rule of Three

No banking change should be processed based solely on an incoming email. Apply a "Rule of Three" before any update is made:

‍

1. Source validation: Check the technical headers of the email. Does the sending domain match exactly? (e.g., is it @company.com or @company-update.com?)
2. Out-of-band confirmation: If the request came via email, verify it by phone — using the number already on file in your ERP or master data system, not the number in the request's signature block. If the request came via phone, verify it via a known email contact.
3. Internal approval: A single person should not be able to both input and approve a banking change. Segregate duties so that one analyst enters the change and a manager reviews the documentation before the system is updated.

‍

Moving to secure portals

The most effective way to eliminate email-based fraud is to stop using email for data exchange entirely. Modern credit departments are moving toward secure, self-service portals for master data updates.

‍

In this model, a customer who wants to change their banking information cannot do so via email attachment. Instead, they receive a link to a secure portal, log in using their credentials — often with multi-factor authentication — and submit the change directly. This shifts the burden of authentication to the system and creates an immutable audit trail: who made the change, when, and from which authenticated account.

‍

Use Company Radar alongside portal-based verification to confirm that the customer's business profile hasn't changed in ways that should prompt additional scrutiny — ownership transfers, new legal filings, or sudden operational changes that often precede fraud attempts.

‍

Strategic impact of secure master data

Solving the phishing problem protects more than a single transaction. It protects the entire revenue cycle.

‍

When a customer pays into a fraudulent account because your system contained the wrong banking details, the liability often falls on the supplier. The customer believes they have settled the debt. Recovering those funds typically means litigation, write-offs, and a damaged relationship — none of which a tight AR team has bandwidth to manage.

‍

Beyond loss prevention, clear verification protocols make teams faster, not slower. When analysts know exactly what steps to follow for a banking change, they stop second-guessing every unusual email and start moving. The process removes guesswork. Customers also respond well to security-first language: "For your protection, banking changes are submitted through our secure portal" signals professionalism, not friction.

‍

Your fraud prevention checklist

Fraud attempts targeting AR and credit teams are increasing in frequency and precision. The following actions can close the most common exposure points immediately.

‍

Immediate actions:

• Audit your intake channels. How do you currently receive banking updates? If the answer is email, your process is exposed.
• Update your policy. Mandate phone verification for all banking changes, effective immediately. Document it.
• Clean your master data. Ensure you have valid, secondary contact numbers for key accounts so your team has a verified number to call — before a fraudulent request ever arrives.
• Evaluate your tools. Platforms that allow customers to self-manage their data securely through authenticated portals remove email from the equation entirely.

‍

By treating master data changes with the same rigor applied to credit limit increases, you close one of the most common and damaging fraud vectors in B2B commerce.

‍

See how Bectran stops rerouting fraud

Receiving banking change requests by email with no secondary verification protocol? Fraudulent wiring instructions slipping through because your AR team has no flagging system for master data updates? Bectran's fraud prevention platform includes automated email domain verification that flags domain mismatches before changes are processed, ship-to address and bank account change alerts that trigger review workflows, secure self-service customer portals with MFA-enforced authentication for master data updates, segregated approval controls that require manager sign-off before banking changes are saved, and Company Radar for real-time business legitimacy checks — ensuring fraudulent rerouting attempts are caught at intake, not discovered after the wire has cleared. See how Bectran's fraud prevention works.

‍