Six weeks of revenue left her account before she noticed anything was wrong.
Her payment processor had been modified through the support portal to redirect every settlement deposit to an account she did not control. The actor used her publicly listed business phone number and EIN, both available in her state business registry and her merchant profile.
Six weeks of settlement deposits were redirected before the owner noticed a discrepancy during reconciliation. By then the receiving account had been closed and the funds were unrecoverable. The processor confirmed the fraud but noted the modification had passed their verification requirements at the time of the change.
The payment processor sits at the point where revenue converts to accessible cash. For a small business owner it is typically one of the least-secured accounts in the whole operation, treated as billing infrastructure rather than a high-value target. The processor accepted publicly available information as identity proof because its support system was not built to distinguish between an account owner and someone who had assembled the same data from public records. The gap was not a technical vulnerability. It was the mismatch between what the small business owner assumed the verification process would require and what it actually accepted. Closing that gap means knowing which specific information the processor uses to verify a support request, and making sure that information is not already indexed in a public business registry. A small business owner who has never mapped which fields their processor uses for support authentication has no way to know whether that information is already exposed. The modification in this case was processed as a routine support request because nothing about it distinguished it from a legitimate one.
The system every small business owner trusts is actively selling a roadmap straight to your front door. RuleDraft has the architectural fixes to break the cross-reference graph and secure your assets immediately.