How to Prevent Fraud in a Small Team

Fraud prevention without assuming bad faith

It's worth starting by separating two very different things that both get called 'fraud risk' in a small business: the risk that someone inside the business behaves dishonestly, and the risk that someone outside the business deceives you or your team into sending money somewhere it shouldn't go. In practice, for most small UK businesses, the second is both more common and more likely to succeed, because it targets a moment of ordinary trust — a genuine-looking invoice, an email that appears to be from a real supplier or even a colleague — rather than requiring anyone inside the business to do anything wrong.

This distinction matters because it changes how you talk about fraud prevention with your team. Framing every control as 'in case one of you steals from us' breeds resentment and misses where the actual risk usually sits. Framing it as 'here's how we make sure nobody, including an outside criminal, can trick any of us into sending money to the wrong place' is both more accurate and much easier for a small team to accept and follow.

The external threat: invoice and payment fraud

The most common way small UK businesses lose money to fraud is through some version of invoice or payment redirection: a fraudster impersonates a genuine supplier, sometimes by compromising that supplier's actual email account, and sends what looks like a normal invoice with bank details that have been quietly changed. If the change isn't caught, the business pays a genuine-looking invoice straight into the fraudster's account, and the money is usually very difficult to recover once it's gone.

A close relative of this is impersonation of someone senior within the business itself — an email or message that appears to come from a director or founder, urgently asking for a payment to be made, often timed for when that person is known to be travelling or unreachable to confirm directly. Both variants rely on the same weakness: a payment being made on the strength of a message alone, without an independent check.

The defence against both is the same simple habit, applied without exception: verify any new or changed payment detail, and any urgent or unusual payment request, using a contact method you already have on file — a phone number saved from before, not one included in the message you're checking — before the money moves. This single habit, consistently applied, closes off the large majority of this kind of fraud.

Action Fraud, the UK's national fraud reporting centre, records invoice and mandate fraud as one of the most frequently reported types of fraud against UK businesses. Independent verification by phone remains the most effective single defence.

Separation of duties, applied to your real headcount

Separation of duties means the person who initiates a payment is not the same person who approves it, and ideally not the same person who releases it either. This is the classic internal control against both dishonesty and honest error, because it means a single person's mistake or bad decision doesn't automatically become money leaving the business — someone else has to look at it first.

In a team of two, true separation for every payment isn't realistic, but the principle still applies as far as it can: for anything above your higher approval threshold, at minimum send a written message to the other person describing the payment before it goes, even if they can't formally block it. This creates a pause and a record, which is most of what separation of duties is actually trying to achieve.

As soon as the team is large enough to genuinely split these roles — often from three or four people — do it properly, starting with your highest-value payment category first. The value of separation grows with the size of payments it protects, so prioritise accordingly rather than trying to formalise every payment type at once.

Card controls that catch problems early

Individual, named cards with clear per-person limits are a stronger fraud control than a shared card or shared account login, for a simple reason: individual cards create a clear record of who made a given transaction, which makes both honest disputes and dishonest activity far easier to identify and resolve. A shared card or login makes every transaction anonymous within the group that has access, which helps nobody, including the honest majority of the team.

Most current UK business banking and card products let you set individual limits, receive real-time transaction notifications, and freeze a card instantly if something looks wrong. Use these features actively rather than leaving them as a theoretical option — a card frozen within minutes of a suspicious transaction being noticed is a very different outcome from one where nobody checks the statement until the following month.

Cancel a leaver's card access on or before their last working day, every time, without exception, and treat this as a fixed line on your leaver checklist rather than something to remember unprompted in a busy week.

Monthly reconciliation as a detection control

Reconciliation — checking every transaction on a statement against expected, evidenced spending — is often thought of as a bookkeeping task, but it is also one of the most effective fraud detection controls available to a small business, because it's the point where an unexplained or unauthorised transaction is most likely to actually be noticed. A monthly cadence, done consistently, means an issue is caught within weeks rather than discovered months later when it's harder to investigate and, in the case of external fraud, harder to recover.

Make the check specific rather than a quick glance down the page: every transaction should be matched to a stored receipt or a known, evidenced purpose, and anything that isn't should be followed up directly and promptly, not left to roll into the following month unresolved. This is exactly the same routine described in the guide to team spending policy, and it deserves the same discipline here — reconciliation done consistently is one of the cheapest and most effective controls a small business has.

Signs worth taking seriously

Most fraud, both external and internal, shows small warning signs before it becomes a large problem, and a team that knows what to watch for is far more likely to catch it early. These aren't proof of anything on their own, but they're worth a closer, calm look rather than being waved away.

• A supplier's bank details change, especially by email, without a prior phone conversation confirming it.
• An urgent payment request that pressures speed or secrecy, particularly from someone senior who is hard to reach directly.
• A transaction with no matching evidence that nobody can explain when asked directly.
• A pattern of small, similar transactions that individually look unremarkable but together suggest testing of a limit.
• Reluctance from any one person to have their transactions reviewed as part of the normal monthly check.

What to do if you suspect fraud

If you suspect a payment has already been made fraudulently, contact your bank immediately — speed genuinely matters, since banks have a limited window in which a fraudulent payment can sometimes be recalled or frozen before it moves further. Report the incident to Action Fraud, the UK's national reporting centre for fraud and cybercrime, as soon as practical, since this both creates an official record and feeds into broader tracking that can help others avoid the same scam.

If the suspected issue involves someone within the team rather than an external fraudster, handle it calmly and factually: gather the evidence you have, don't accuse anyone before you've established the facts, and take advice from an employment adviser or solicitor before taking any formal action, since getting this process wrong can create legal risk of its own regardless of what actually happened.

In either case, resist the instinct to keep an incident quiet out of embarrassment. A short, honest debrief with the team — what happened, what's changed as a result — tends to strengthen trust and vigilance far more than silence does, and it often surfaces whether the same gap has nearly caught someone else too.

Keeping fraud prevention proportionate

None of the controls in this guide require expensive software or a compliance function — they are habits: verify by phone, separate the roles you can, use individual cards, reconcile monthly, and take small warning signs seriously. Applied consistently, they close off the overwhelming majority of the ways small UK businesses actually lose money to fraud, without turning a small team into a suspicious or bureaucratic place to work.