How to protect your business against ACH fraud and phishing scams

Fraud targeting businesses is becoming more common, and small and mid-sized organizations are often at the center of it. Even well-run businesses can be vulnerable, especially when day-to-day operations rely on trust, speed and routine financial processes.

Two of the most common threats are ACH fraud and phishing scams. ACH fraud involves unauthorized electronic payments from a business bank account, while phishing scams use deception to gain access to sensitive information.

These attacks often don’t rely on breaking into systems. Instead, they take advantage of human behavior – a rushed email, a familiar-looking request or a missed detail.

The good news is that understanding how these threats work can make them easier to spot and prevent. This guide outlines what to watch for and practical steps you can take to help protect your business.

ACH (automated clearing house) fraud occurs when someone initiates unauthorized electronic transfers from a business bank account.

ACH payments are commonly used for payroll, vendor payments and other routine transactions. Because they move electronically between accounts, they can be efficient. But they can also be vulnerable if proper controls are not in place.

ACH fraud can occur in several ways, including:

•  Stolen or compromised banking credentials
• Unauthorized access to account information
• Manipulated or redirected payment instructions

In a business setting, this might look like:

• A fraudulent request to update a vendor’s payment details
• An unauthorized withdrawal that goes unnoticed until after processing 

In short:

• ACH fraud involves unauthorized electronic payments
• It can happen quickly and may be difficult to reverse

Prevention depends heavily on monitoring and internal controls

Phishing is a type of fraud where attackers impersonate legitimate sources to trick individuals into sharing sensitive information.

In a business environment, phishing often appears as routine communication such as an email from a vendor, a request from leadership or a login page that looks familiar. Common phishing formats include:

• Emails posing as banks, vendors or executives
• Fake login pages designed to capture credentials
• Urgent or time-sensitive payment requests

A more targeted version of phishing is business email compromise (BEC), where fraudsters impersonate trusted contacts to request payments or sensitive information. 

• Unusual or urgent payment requests
• Slightly altered email addresses or domains
• Requests for sensitive account or login information
• Unexpected changes to payment instructions 

In short:

• Phishing uses impersonation to trick employees into sharing sensitive information
• It often appears as routine or urgent business communication
• It is a common entry point for fraud, including unauthorized payments

Phishing often relies on urgency, familiarity or authority to bypass normal review processes. More examples of these tactics are outlined in our guide to how social engineering scams work.

In many cases, phishing is the entry point that leads to ACH fraud. A typical sequence might look like this:

1.      A fraudulent email is sent, appearing to come from a trusted source

2.      An employee clicks a link or shares login credentials

3.      The attacker gains access or redirects payment instructions

4.      An unauthorized ACH transaction is initiated

These attacks are effective because they mimic everyday business activity. Payment requests, invoice updates and account access are all part of normal operations, which makes fraudulent activity harder to detect.

Even careful businesses can be targeted. Recognizing this pattern is one of the most effective ways to reduce risk.

Recognizing early warning signs can help prevent fraud before it happens. Some risk indicators are related to processes, while others are tied to employee awareness or system access.

• Lack of internal controls around payments: Without approval workflows or verification steps, unauthorized transactions may go unnoticed.
• No verification process for payment changes: Fraudsters often request changes to payment details; without confirmation, funds may be misdirected.
• Limited phishing awareness among employees: Staff unfamiliar with phishing tactics may be more likely to respond to fraudulent requests.
• Shared logins or weak passwords: This increases the risk of unauthorized access if credentials are compromised.
• Infrequent account monitoring: Delayed review of transactions can make recovery more difficult.

If one or more of these apply, your business may be more vulnerable to fraud. Addressing them early can significantly reduce exposure.

While fraud risks are real, there are practical steps businesses can take to reduce exposure. The most effective approach combines internal processes, employee awareness and secure systems.

• Verify payment requests through a second channel
• Establish approval workflows for transactions
• Limit access to sensitive financial information 

• Train staff to recognize phishing attempts
• Encourage caution with unexpected or urgent requests
• Reinforce a “pause and verify” approach 

• Use strong, unique passwords
• Enable multi-factor authentication where available
• Monitor account activity regularly 

Establishing clear processes can make a meaningful difference. Additional best practices are outlined in treasury user management guidance, which focuses on access controls and oversight.

If you’re unsure where to start, speaking with a specialist can help you identify safeguards that fit your business.

Protecting your business from fraud doesn’t have to be something you manage alone. Your bank can play an important role in helping you reduce risk.

M&T provides tools and support designed to help businesses monitor activity, control payments and strengthen account security. These capabilities include alerts for unusual activity, approval workflows and secure access controls.

Just as important, M&T offers guidance to help you build stronger internal processes and improve awareness across your organization.

In short:

• Monitoring tools can help identify unusual activity
• Payment controls add oversight before transactions are completed
•   Strong security combines technology with internal processes
• Partnering with your bank can improve confidence and reduce risk

You can learn more about these capabilities through M&T’s fraud reduction and risk management services.

ACH fraud and phishing scams are common, but they are often preventable with the right awareness and safeguards.

Understanding how these threats work – and how they often overlap – makes it easier to recognize risks early. Simple actions, like verifying payment requests and strengthening internal controls, can go a long way in protecting your business.

• ACH fraud involves unauthorized electronic payments
• Phishing scams are a common entry point for financial fraud
• These attacks often rely on human error rather than technical vulnerabilities
• Strong processes, employee awareness and secure systems help reduce risk

Taking a proactive approach to fraud prevention can help protect your accounts, your employees and your operations over time.

If you’d like to strengthen your approach, you can explore M&T’s fraud prevention services or speak with a specialist about options that fit your business.