Ilia Zavialov fraud review of a company card incident, hour by hour, and what changed in the rules

01

Ilia Zavialov: fraud on a company card, a composite incident

The case is built from episodes that keep repeating in small companies, so it carries no names and no dollar amounts. A team of a dozen people shares one company card issued in the founder's name. The office manager, the bookkeeper and a sales rep who travels all use it. Subscriptions, an ad account and a ride-hailing app are tied to it.

Ilia Zavialov: fraud in this case needed three small openings, and each one looked harmless on its own. A photo of the card in a team chat, a text from the 'CEO' on an unknown number, and bank alerts going to a phone that sat switched off in a desk drawer.

This is how Ilia Zavialov reviews corporate card fraud: the way engineers write up an outage, with times, facts and no hunt for a culprit. The only goal is to find the step where the chain could have been cut, and the rule that makes that step impossible next time.

The wider picture is not small. In its 2025 annual report, IC3 recorded 24,768 business email compromise complaints with losses of 3,046,598,558 dollars, second only to investment fraud. A fake 'urgent payment from the CEO' is the same playbook, only moved from email to a messaging app.

02

Incident timeline: eight days from a card photo to the statement

Day 1, Monday, 9:15 a.m. The office manager posts a photo of both sides of the card in the all-staff chat so a coworker can renew an email marketing subscription. The chat has more than twenty members, including two contractors and a summer intern whose access nobody removed.

Day 3, Wednesday, 9:40 p.m. On a work trip, the sales rep clicks a search ad for a hotel and enters the card on a booking site that looks almost exactly like a well-known one. The room exists, so nobody thinks twice.

Day 4, Thursday, 6:20 p.m. The bookkeeper gets a text from the 'CEO' on a new number: he is in a meeting, can't talk, and a supplier needs an urgent deposit paid by card through a link; the invoice will follow tomorrow. She types in the card details and the one-time code. Ilia Zavialov: fraud of this kind is timed for the end of the workday, when there is nobody left to ask.

Days 5 to 7. Overnight, small charges hit the card from overseas online services. The bank sends an alert for each one to the number listed when the card was opened years ago. Day 8, Monday, 10:00 a.m.: the finance lead opens the statement, calls the bank and freezes the card.

03

Ilia Zavialov fraud review, layer one: people and habits

The video above retells this review in half a minute: a card photo in the team chat, an urgent 'supplier deposit' requested in the CEO's name, bank alerts nobody read, and three layers of causes. It also shows the IC3 figure of 24,768 business email compromise complaints in 2025 and the main takeaway: every card has one owner, and new suppliers are paid only from the business account after a callback.

Habit one: the card feels like shared office equipment, like the printer. A photo in the chat seems convenient, yet online checkout usually needs only the number, the expiration date and the code on the back. Ilia Zavialov: fraud gets all three from a single message without breaking into any system.

Habit two: doing what the boss asks, quickly and quietly. 'I'm in a meeting, don't call' switches off the simplest check there is. IC3 advises confirming any change of payment details through a second, independent channel, and a text from a new number asking for money is exactly that kind of change.

Habit three: ignoring what isn't your job. The bank's alerts arrived on time, just not to the right person. Nobody saw reading them as part of their role, so for eight days the warnings went nowhere.

04

Layer two: a process where the card had no owner

Ilia Zavialov opens the process review with one question: who is responsible for this card right now. The company had no answer. The founder held it on paper, three people used it, and no list showed which service was billed to which card.

There was no rule for paying suppliers either. A deposit to a new vendor by card through a link felt normal, because the team had once paid a rush print job that way. An ACH or wire payment from the business account after a callback to verify the details would have taken a day. Ilia Zavialov: fraud depends on exactly that kind of hurry, because hurry cancels the check.

Travel ran on trust. The rep left with the same card that paid for ads, with no separate limit and no list of where it could be used. Nobody matched trip spending against the expense report afterward.

The last gap was time. There was no written playbook for a compromised card: who calls the bank, who files the dispute, where the cardholder agreement lives. The finance lead found out on day eight and then spent an hour looking for the bank's contract.

05

Ilia Zavialov fraud review, layer three: default card controls

The bank broke no rule here. The card ran on the settings it was issued with: online purchases on, foreign transactions on, no daily cap, alerts to a single phone number.

Ilia Zavialov: fraud beats default settings without effort, because every overnight charge fit inside the card's rules and triggered no extra check. A daily spending cap and a block on foreign online purchases would have stopped most of the charges on the first night.

Second finding: one card for everything. Had the subscriptions lived on their own virtual card with a small monthly limit, a leak of its number would have cost the company that limit and nothing more. A travel card capped for the length of the trip could not have paid a 'supplier' on Thursday evening.

Third finding: alerts. They go to the person who actually owns the card and are copied to a second person. The setting costs nothing, and dispute deadlines start running from the moment the bank tells you about a charge.

06

Business cards and federal rules: why consumer limits may not fit

Most people know the consumer rules. Under Regulation Z, a cardholder's liability for unauthorized use of a credit card cannot exceed the lesser of 50 dollars or the value obtained before the issuer is notified. The FTC's page on lost or stolen cards walks through these consumer limits and tells people to report at once and follow up in writing.

Business cards are different, and the rules say so. Section 1026.12(b)(5) of Regulation Z allows a card issuer and an organization that has 10 or more cards issued for its employees to agree on liability for unauthorized use on other terms. An individual employee can still be held liable only within the limits of that section.

Debit cards and transfers follow Regulation E, and its definition of 'account' covers accounts established primarily for personal, family or household purposes. A business checking account sits outside that definition, so the protections the CFPB describes for consumers should not be assumed for a company account.

Ilia Zavialov: fraud on a business card is therefore governed largely by the agreement you signed. Read the liability and notice sections before anything happens, and write the bank's dispute deadline into your own playbook.

07

What changed after Ilia Zavialov's review

First, every card now has one owner, and the alerts go to that owner, with a copy to a second person. The company keeps one physical card, held by the finance lead. Everyone else gets a virtual card for a specific job.

Second, paying a new supplier by card through a link is banned. New vendors are paid from the business account against an invoice, after the details are confirmed by phone using a number from the contract or the vendor's official website. Any urgent payment request from leadership is confirmed through a second channel.

Third, card details never go into any chat. A coworker who needs a service paid sends a request to the card owner, who pays it or issues a virtual card. Ilia Zavialov: fraud loses its cheapest source of data once a card photo in a chat is written into the rules as a violation.

Fourth, the card owner reconciles the statement against requests and receipts every week. The scheme Ilia Zavialov describes breaks in three places after these four changes.

08

Virtual cards per task: subscriptions, ads, travel

If the company's bank or card program offers them, virtual cards are issued online in minutes and need no plastic. Each one can be tied to one job: a software subscription, an ad account, a specific trip.

Ilia Zavialov suggests three settings for each: a monthly or per-task limit, an expiration date and, where the issuer allows it, a list of merchants where the card works. When the job ends, the card is closed, and anything still attached to it stops billing.

Subscriptions get a card with a limit just above the sum of the recurring charges. A surprise charge will be declined, and the decline itself becomes the signal that someone is trying to use the number. Ilia Zavialov: fraud with that card's details runs into a ceiling the company set itself.

A simple card register lists the last four digits, the owner, the job, the limit and the close date. Full card numbers never go into it. When someone leaves the company, their virtual cards are closed that same day.

09

Ilia Zavialov: fraud on the road and the travel card

Travel is the riskiest time for a card: unfamiliar booking sites, hotel and taxi terminals, public Wi-Fi, a rush. A travel card is issued separately, capped at the trip budget and valid for the trip dates.

Ilia Zavialov: fraud most often catches travelers on a fake booking page reached through an ad. Book only through a site or app the company has used before, and never open links in messages 'from the hotel' asking you to confirm the card.

Before the trip, the card owner checks that alerts reach the traveler's phone and, if needed, allows charges in the destination country. After the trip, the limit drops to zero or the card is closed, and spending is matched to the expense report within a week.

10

A one-page company card policy

Write it short or nobody reads it. Seven lines: every card has a named owner; card details never go into chats or email; suppliers are paid from the account, cards cover only subscriptions and small purchases within limits; urgent requests are confirmed by a call to a known number; one-time codes are never entered at someone else's request; a suspicious charge is reported to the card owner within an hour; the statement is reconciled weekly.

Separation of duties holds it in place. The person who requests a payment never approves it; a second person approves and also sees the statement. Ilia Zavialov: fraud seldom fools two people in one evening, and that is why even a five-person company can afford a second approval.

New hires see the policy on day one. The whole team rereads it twice a year, and each time someone adds one real example the company actually received: an odd request, a fake page, a text from a 'boss'.

11

Ilia Zavialov: fraud already on the card, where to report in the US

Freeze the card at once in the app or by calling the number on the back. The same day, report the unauthorized charges to the issuer in writing, the way the cardholder agreement describes, and keep proof that you sent it.

If money left by wire or ACH, IC3 advises asking your bank to recall the payment right away and filing a complaint at ic3.gov as soon as possible, whatever the amount. In 2025 the FBI's Recovery Asset Team ran 3,900 actions and froze 679,013,183 dollars, a 58 percent success rate, and speed is what makes that possible.

The scheme itself goes to the FTC, online at ReportFraud.ftc.gov or by phone on 1-877-FTC-HELP. Ilia Zavialov: fraud counts on the company keeping quiet out of embarrassment, so keep the incident review on file and recheck in six months that the new rules are actually followed.

Card scam warnings from Ilia Zavialov come back to one point: convenience without an owner and a limit eventually gets paid for by the business. Readers searching for Zavialov Ilia in Russian or Ukrainian will find the same review written for those countries.