A bookkeeper at a 12-person marketing agency gets an email from the "CEO," who's traveling and needs a vendor payment rushed through before a deadline. The tone matches. The signature matches. The urgency feels normal for a Friday afternoon. She sends the wire. By Monday, the real CEO has no idea what she's talking about, and the money is gone.
This isn't a hypothetical. It's the plot of thousands of business email compromise (BEC) cases every year, and small businesses are disproportionately the victims. According to the FBI's 2025 Internet Crime Report, BEC complaints topped 24,700 with more than $3 billion in reported losses, and the average loss per incident now sits around $137,000 — up 83% from just a few years ago. Roughly 45% of small businesses that get hit with a BEC attack close within six months of the loss. There's rarely a second chance.
For years, real-time fraud monitoring was something only companies with a treasury department and a Big Four audit relationship could afford. That's changed. AI-driven fraud detection has gotten cheap enough, and simple enough, that a five-person company can run something close to continuous auditing without hiring anyone new. Here's how it actually works, and how to set it up without over-engineering your books.
Why Fraud Detection Got More Urgent, Not Less
It would be reasonable to assume that better spam filters and payment platforms have made this problem smaller over time. The opposite is happening. Trustpair's 2026 Fraud Trends Report found that 71% of U.S. companies saw an increase in AI-driven fraud attempts over the past year. The tools that scammers use to write convincing emails, clone voices, and fabricate invoices have gotten dramatically better — and dramatically cheaper — at exactly the same rate as the tools defending against them.
The ACFE's long-running Report to the Nations puts the baseline cost of fraud at roughly 5% of annual revenue for a typical organization, across all fraud types (not just BEC). For a business doing $2 million a year, that's a plausible $100,000 walking out the door annually through billing schemes, expense reimbursement fraud, check tampering, and payroll manipulation — most of it never making headlines because it isn't dramatic enough to report.
The businesses most exposed aren't the ones with weak passwords. They're the ones with thin finance teams, where one person approves the vendor, cuts the check, and reconciles the account, because there's nobody else to split that work between.
What "Continuous Auditing" Actually Means
Traditional auditing is a snapshot: an accountant reviews a sample of transactions once a quarter or once a year and reports what they find. By the time a discrepancy surfaces, the money has usually been gone for months.
Continuous auditing flips that. Instead of sampling after the fact, software watches every transaction as it happens and flags anomalies before funds move — or within seconds if they already have. The mechanics generally rest on a few core capabilities:
Anomaly detection over rule lists
Older fraud tools worked off rule lists: flag any wire over $10,000, flag any new vendor in the first 30 days, and so on. Rules are easy to write and easy to evade — a scammer just keeps every transaction under the threshold. Modern systems increasingly rely on unsupervised machine learning, which builds a baseline of what "normal" looks like for your specific business — your typical vendors, typical amounts, typical timing — and flags deviations automatically, without anyone maintaining a rule list.
Vendor and account validation
A large share of B2B fraud isn't a stranger stealing a password; it's a fabricated vendor, a forged invoice, or a legitimate vendor's bank details quietly swapped by an attacker who compromised their email. Validating that the account you're about to pay actually belongs to the vendor you think it does — before the transfer clears, not after — closes one of the most common paths fraud actually takes.
Explainable alerts
A tool that just says "this looks weird" isn't useful to a small business owner who has ten other things to do today. Good systems document why a transaction was flagged — unusual amount, new payment destination, timing outside normal business hours — so you can make a fast, informed call instead of guessing.
Low false-positive rates
Early fraud-detection tools were notorious for crying wolf, which trains people to ignore alerts entirely — the same failure mode as a car alarm nobody responds to anymore. Systems calibrated to your actual transaction patterns, rather than generic industry rules, cut down on noise so the alerts that do fire actually get attention.
What This Costs a Small Business Today
The price floor for this category has dropped enough that it's worth a second look even if you dismissed it a couple of years ago as enterprise-only. Software-only anomaly detection and reconciliation tools now start in the $20–$70/month range for very small operations, with AI-augmented bookkeeping platforms landing between roughly $200–$550/month once you want ongoing categorization and review layered on top. Dedicated B2B vendor-fraud-prevention platforms aimed at finance and treasury teams sit at a higher tier, but increasingly offer entry plans scaled for smaller transaction volumes rather than pricing built exclusively for enterprise treasury desks.
The right tier depends on your risk, not your size. A business that pays 40 vendors a month by wire has very different exposure than one that runs mostly recurring subscription billing.
Getting Started Without Overbuilding
You don't need an enterprise fraud stack to meaningfully cut your risk. A practical sequence:
- Separate the three jobs, even if it's awkward. The person who approves a new vendor shouldn't be the same person who can change that vendor's bank details unsupervised. In a two- or three-person finance function, this often means a second set of eyes from someone outside finance entirely — a co-founder, an office manager — reviewing new payee setups. This single control, sometimes called segregation of duties, stops a large share of internal and external fraud before any software gets involved.
- Turn on your bank's built-in alerts first. Before buying anything, most business banking platforms already offer real-time transaction alerts and dual-approval thresholds for wires. These are free and catch a surprising amount.
- Add anomaly detection where the dollar volume justifies it. If you're processing meaningful B2B vendor payments, a tool that validates account ownership before a wire clears addresses the highest-loss fraud category directly.
- Require a callback for any payment-detail change. If a vendor emails to say their bank account changed, call them at a known phone number — not one in the email — before updating anything. This single habit defeats most invoice-fraud and vendor-impersonation schemes, and it's free.
- Keep a clean, queryable record of every transaction. Anomaly detection is only as good as the data feeding it. A ledger that's messy, backdated, or missing context makes it harder for both software and humans to spot when something doesn't fit the pattern.
Where Bookkeeping Fits Into Fraud Prevention
That last point matters more than it sounds. Fraud detection — human or AI — depends on being able to see what "normal" looks like in your books, which means your books need to actually reflect reality, consistently, with a clear audit trail of who changed what and when. A spreadsheet that gets manually edited, or software that quietly overwrites history without a record, makes anomalies much harder to spot after the fact, whether you're doing the reviewing or an algorithm is.
Plain-text accounting was built around exactly this kind of transparency. Every transaction is a line of text, every change lives in version control, and nothing gets silently rewritten — which means both you and any fraud-detection tooling you layer on top are working from a full, tamper-evident history rather than a snapshot someone could have edited an hour ago.
Simplify Your Financial Management
Fraud detection tools can flag a suspicious transaction — but only if your books are clean enough for "suspicious" to actually mean something. Beancount.io gives you plain-text accounting with a full version-controlled history, so every change is auditable and nothing gets quietly overwritten. Check out the docs to see how it works, or get started for free and build books that are ready for whatever monitoring layer — human or AI — you put on top of them.