The scams aimed at a small business, stopped where they work

Somebody sends your customer a copy of your invoice with their own bank account on it.

Every quote and invoice carries a code and a short address. Whoever holds it opens the document as it was issued — your official details, the amount, the number and where it stands — and is told on the document itself to check before paying. A customer comparing the account they were given sees only the last four digits of yours, and when theirs does not match, you are told at once.

The swapped-account invoice fails in front of the customer, before the money moves, and you hear about it the same day.

A message arrives in your name, from a number or an address that is not yours.

A page of your own lists your official numbers, addresses and accounts, and every check page links to it. Somebody sent a message in your name types what they were given; if it is not yours they are told so, and so are you.

Your customers can check that it is really you before they answer, without having to know who to ask.

Somebody registers an address one letter off yours, ready to send mail as you.

Once a week, for a domain shown to be yours, it looks for the near copies of it that exist and for new certificates in the public logs for names containing it. Each is told to you once, as what it is — never as proof that anybody is using it.

Needs: A domain of your own, shown to be yours.

You hear about the look-alike before your customers get mail from it.

A voice that sounds exactly like the owner calls and says to pay a new supplier today.

Whoever is told — on a call, in a voice note, by message — to pay, change bank details or send records out logs it here, and does nothing until the person it was supposedly from answers on their own account, with their second factor asked for again. Whoever logged it cannot confirm it. A refusal is kept as an attempt and told to whoever logged it.

A copied voice can call; it cannot sign in as the person it imitates, so it cannot get the payment made.

A supplier writes to say their banking details have changed.

Where each supplier gets paid is kept on their record, with every change, who made it and what it was before. Every bill is read before it is paid: did this supplier change banks lately, is there another supplier with almost the same name, have we had this invoice number before, is it sitting just under the approval limit — each asked as a question, with the fact that prompted it.

The one question worth asking is asked on every bill, every time, without anybody having to remember to.

A customer sends a proof of payment to get the goods released, and the money never arrives.

The proof is shown beside whether money like it has arrived in the bank lines you bring in — a cheque deposit counted as money that can still bounce — and with the signs a PDF's making leaves: made in an editor, changed after it was made, or sent before.

Needs: Your bank lines brought in, by feed or by statement, for the half that looks at the bank.

Goods go out against money that arrived, not against a picture of it.

A customer pays too much, then asks for the difference back before their payment bounces.

A refund on an invoice paid over its amount, from money not yet seen cleared in the bank, is held until somebody who runs the business says the money has cleared. Every other refund goes through as it did.

The overpayment scam stops at the refund, which is the only step in it that costs you anything.

A large first order arrives from a government department with a free email address.

A buyer calling itself a public body from a free mail address, or a first order far above what your customers usually pay, is flagged on the quote, with what to do about it: confirm the order with the buyer on a number you find yourself.

The fake purchase order is said before anything is shipped on credit.

A password is stolen, or somebody leaving takes the customer list with them.

Sign in with the phone's or the laptop's own fingerprint, face or screen lock, and a second factor wherever a role can move money. A sign-in from a new country, an export at an hour nobody works and a day of unusually many records opened are each said — to the person, and to whoever runs the workspace.

There is no password to steal, and the signs of a stolen login show themselves early.

Fakes of your product are sold under your name.

Each item can carry a unique code under a scratch panel, which the buyer checks for an answer on the spot. Every check is kept, including those on codes that are not yours, and failed checks are grouped by area — to about eleven kilometres, never closer.

Buyers can tell the real thing, and you can see roughly where the fakes are without accusing any one shop.

A prescription is photocopied, altered or taken to a second pharmacy.

Each prescription prints with a code a pharmacy scans: it opens what was actually issued, by whom under which registration, and every time it has been dispensed. The pharmacy records its own dispensing there, so a used script shows as used.

A prescriber's name on a script means what they wrote, once.