The vendor you didn't check.
The worst surprises arrive through a counterparty nobody vetted. One ten-minute habit prevents most of them.
In thirty years of banking operations, I can count on one hand the losses that came from a stranger kicking down the front door. The rest came through the side door, politely, with an invoice.
The pattern barely changes. A company has worked with a vendor for years — a supplier, a contractor, a freelancer, a shop that makes the thing only they make. One day an email arrives: "We've changed banks. Please direct future payments to the account below." The logo is right. The signature is right. The tone is right, because the fraudster has been reading the real correspondence for weeks. Accounts payable, who is efficient and kind, updates the record. Three payments later, the real vendor calls asking where the money is.
No one in that story was stupid. Every step was reasonable. That's what makes it work.
Fraud doesn't usually look like a stranger.
It looks like a familiar name asking for one small change.
The ten-minute habit
You don't need an investigations unit. You need one rule, applied without exception, and it costs ten minutes:
Any change to payment details gets verified out-of-band. Call the vendor at the number you already had on file — never a number in the email asking for the change — and confirm with a human. Every time. No exceptions for familiar names; the familiar names are precisely the ones worth impersonating.
Any new counterparty gets ten minutes of daylight before the first dollar moves. State formation records (free, online, two minutes). A real address. A phone that answers. A person whose name appears somewhere other than their own email signature. You're not running an investigation — you're checking the thing exists.
Write down what you checked. One line in a shared file: who looked, what they saw, when. Not for bureaucracy — so that "how do you know?" has an answer six months later, when nobody remembers.
At the bank we called this KYC — know your customer — and we employed floors of people to do it. The principle scales down beautifully: know who you're dealing with before they're holding your money. The ten-minute version catches most of what the floor of people catches, because most of this fraud is built on the assumption that nobody will spend even ten minutes.
One more, because it's the season for it: the rule applies to exciting counterparties too. The investor who appears from nowhere, the partner with the too-good terms, the agency that needs a deposit this week. Enthusiasm is the enemy of verification. The deal that can't survive ten minutes of checking was never a deal.