Payment Mistakes to Avoid When Working with Virtual Assistants

The problem

Why this matters

Most payment mistakes don't look like mistakes until something goes wrong. They look like shortcuts, quick fixes, and reasonable assumptions. Here's what to watch out for — and why each one is more costly than it appears.

The Most Common Payment Mistakes

✕ Collecting bank details over email

The risk: Email is unencrypted by default. Details stored in inboxes are accessible to anyone who compromises the account — on either side. One phishing attack and every routing number you've ever exchanged is exposed.

Better approach: Send a Garded payment request link. The payee fills out their details in an encrypted form — nothing sensitive ever travels over email.

✕ Storing bank details in a spreadsheet

The risk: Spreadsheets are accessible to anyone with the file, have no access controls, generate no audit trail, and are frequently copied and shared without the owner knowing. That's not a payment record — it's a liability.

Better approach: Store payment details in a system with row-level security, access controls, and an audit log. Garded is built specifically for this.

✕ Paying based on emailed invoice without verifying bank details

The risk: Fraudsters spoof legitimate invoices with a single digit changed in the routing or account number. If you pay against an invoice rather than a verified stored profile, you have no defense against this.

Better approach: Cross-reference every payment against a verified Garded payment profile — not the invoice. The invoice shows what's owed. The profile shows where it goes.

✕ Skipping tax documentation at onboarding

The risk: No W-9 means no 1099. No 1099 means potential IRS penalties. Collecting tax documentation after the fact is awkward, slow, and often incomplete.

Better approach: Collect the W-9 and banking details at the same time during onboarding. Garded requests can include all required fields in a single secure submission.

✕ Accepting 'updated' bank details without verification

The risk: Business email compromise works by intercepting an existing email relationship and sending a convincing 'please update my payment details to this new account' message. If you comply without verification, the next payment is gone.

Better approach: Never update a payment profile based on an email request alone. Call the payee at a number you've had on file and confirm the change verbally before updating Garded.

The specific risk with virtual assistants payments

The exposure: VAs often have access to email, calendars, and project management tools — their communication channels are deeply trusted, making impersonation especially effective
The fix: Collect virtual assistants payment details through a Garded encrypted link — nothing sensitive travels over email or chat.

Worth knowing: If your VA has access to your email account, use Garded for all payment communication — you don't want payment details in an inbox they can access

Stop Making Payment Mistakes. Start Using Garded.

Collect, store, and verify payment details the right way — free to start.

Get started free No credit card required · Set up in minutes

Common questions

What's business email compromise (BEC)?

BEC is an attack where fraudsters gain access to or spoof a trusted email account and use it to manipulate payment flows — typically by sending fake invoices or fake 'updated banking details' requests.

How common is payment fraud for small businesses?

The FBI's Internet Crime Report consistently ranks BEC as the most financially damaging cybercrime, with over $2.7 billion in losses annually. Small businesses are targeted because they typically have fewer controls than large enterprises.

Is Garded a fraud guarantee?

No tool eliminates all risk. Garded eliminates the most common payment fraud vectors — email interception, insecure storage, and unverified account changes — which account for the vast majority of payment fraud events.