Protecting a Small Business Account From Fraud in Grenada

Fraud against business accounts in small Caribbean economies seldom looks dramatic. It is an email that appears to come from a regular supplier saying their bank details have changed, a cheque altered in the space after the amount, a staff member who has quietly added a payee to online banking, or a phone call from someone claiming to be the bank's security team and asking for a one-time code. The losses can be large and, once money leaves the island, recovering it is slow and often impossible.

Banks have their own defences, but much of the protection sits with the business itself: who can sign, who can approve payments, how bank details are verified and how quickly suspicious activity is reported. This guide sets out the main threats and a practical set of controls that work for a business with two staff as well as one with fifty.

The frauds that most often hit businesses

Payment diversion. A criminal gains access to an email account, or imitates one closely, and sends an invoice or a notice of new bank details. The business pays the fraudster instead of the real supplier. This is the single most costly scheme for many firms, and it targets both local and overseas payments.

Impersonation of executives. An urgent message apparently from the owner or a director, often while they are travelling, asks a staff member to make a confidential payment immediately.

Bank impersonation. Callers or text messages pose as the bank, warn of a problem with the account and ask for login details or one-time passcodes. Banks do not ask for full passwords or codes in this way.

Cheque fraud. Stolen blank cheques, altered amounts or payees, and forged signatures remain a risk where cheques are still widely used.

Insider fraud. Staff with banking access create fictitious suppliers, inflate payroll or divert customer receipts. Small businesses with one trusted person handling everything are especially exposed.

Card fraud against merchants. Stolen cards used for bookings or purchases, often online, that later come back as chargebacks.

Get the account mandate right

The account mandate is the instruction to the bank on who can operate the account and how. It is set when the account is opened, usually by a board resolution for a company, and many owners never look at it again. It deserves regular attention. Decide which people are authorised signatories, whether one signature is enough or two are required, and whether the rule changes above a certain amount. Set the same logic for online banking, where roles typically separate those who can create payments from those who can approve them.

Update the mandate promptly when people leave. A former manager who still appears as a signatory, or whose online banking login is still active, is a serious gap. When a director resigns or an employee with banking access leaves, notify the bank in writing with the required resolution or form, and confirm that access has actually been removed. Keep a current list of everyone with any banking access, what they can do and when it was last reviewed. Your bank can advise on the documents needed to change a mandate.

Think about absence as well. If the only person who can approve payments is the owner, a hospital stay or a long trip abroad can stall payroll. A second approver, or a defined arrangement for temporary authority, keeps the business running without loosening controls. Spread approvers sensibly: two signatories who are a married couple travelling together provide less continuity than they appear to.

Verifying bank details: the routine that stops most losses

Payment diversion succeeds because a busy person trusts an email. A fixed routine removes the judgement call:

1. Treat every request to change bank details, from a supplier, landlord, contractor or employee, as unverified, however genuine it looks.
2. Call the requester using a phone number from your existing records or their known website, never one supplied in the change request.
3. Speak to someone you already deal with, and confirm the new details digit by digit.
4. Have a second person record and approve the change in your supplier or payroll file, noting who verified it and when.
5. For the first payment to new details, consider sending a small amount and confirming receipt before paying the balance.
6. Be especially careful when a change request coincides with an unusually large invoice or arrives just before a holiday or weekend.

Online banking and device habits

Most online banking compromises start with a stolen password or a code handed to a fraudster. These habits close the obvious doors:

• Give each person their own login; never share one set of credentials across the office.
• Turn on every security feature the bank offers, such as tokens, app-based approvals and payment alerts by message or email.
• Use online banking only on devices kept updated and protected, not on shared or public computers.
• Set daily payment limits that match your normal activity, so a compromised login cannot empty the account in one go.
• Never give one-time passcodes to anyone who calls or messages you, even if they claim to be from the bank.
• Protect your business email with strong, unique passwords and two-step verification, because a hacked mailbox is how most payment diversion starts.
• Review the online banking audit log or payee list periodically for changes nobody remembers making.

If something goes wrong

Speed matters more than anything else. If you suspect a fraudulent payment, contact your bank's fraud or business banking team immediately, explain what happened and ask them to try to stop or recall the payment. For local transfers there may be a short window in which funds can still be frozen; for international wires the bank can send a recall request through the correspondent chain, but success is never guaranteed. The longer the delay, the more likely the money has moved on.

Report the crime to the Royal Grenada Police Force, and keep a copy of the report, since the bank and your insurer may require it. In an emergency the police can be reached on 911. Preserve evidence: do not delete emails, and keep the headers, attachments and any messages. Change passwords for email and online banking, check devices for compromise and notify suppliers or customers whose details may have been exposed. Afterwards, review how it happened and adjust controls. Check too whether your business insurance covers cyber or fraud losses; many standard policies do not, or do so only with specific cover.

Common gaps in small businesses

The recurring pattern in small-business fraud is concentration of trust: one person who receives invoices, enters bank details, makes payments and reconciles the account. Even when that person is honest, a single compromised email account or one moment of pressure from a convincing caller can cause a loss nobody catches until the supplier complains weeks later. Splitting those roles, even between the owner and one employee, is the most effective control available.

Other gaps include signed blank cheques left for staff to complete, cheque books kept in drawers that are never locked, bank statements that nobody reviews, payment alerts switched off because they are annoying, and no written procedure for changing bank details. None of these is expensive to fix. A one-page payments policy, agreed by the owners and explained to staff, covering who approves what, how bank details are verified and what to do when something looks wrong, turns good intentions into a routine that survives busy weeks and staff changes.

Talk to staff about fraud openly. Many losses happen because a junior employee felt unable to question a message that seemed to come from the boss. Make it explicit that checking an unusual payment request with the owner by phone is always welcome, never a nuisance, and that nobody will be criticised for delaying a payment to verify it.

Frequently asked questions