Business email compromise is a scam where criminals impersonate a vendor, executive or employee by email to trick your business into sending money or sensitive data. Common versions include fake invoices with changed bank details and urgent wire requests "from the owner." They work because the emails look routine. Your best defense is a rule: verify every payment change by phone, using a number you already have.
This guide is for owners, bookkeepers and anyone who approves or sends payments. You'll learn how these scams unfold step by step, the red flags that should stop a payment, a verification policy you can adopt today with its real cost, and what to do in the first hour if money has already gone out.
How business email compromise works
Business email compromise (BEC) doesn't rely on malware or hacking skill as much as on persuasion. Criminals study how your business communicates, then insert themselves into a normal-looking conversation about money. The main variations:
| Scheme | What happens | Typical target |
|---|---|---|
| Fake or altered vendor invoice | A "supplier" says its bank details have changed and asks that the next payment go to a new account | Accounts payable, bookkeeper |
| Executive impersonation | The "owner" emails an urgent request for a wire transfer, often while supposedly traveling or in a meeting | Office manager, bookkeeper |
| Payroll diversion | An "employee" asks HR or payroll to change their direct deposit account | Whoever runs payroll |
| Gift card request | The "boss" asks someone to buy gift cards for a client and send the codes | Any employee |
| Customer-side fraud | Your customers receive fake invoices, apparently from you, with new payment instructions | Your customers |
The emails come from three kinds of addresses: a lookalike domain that differs by a letter or two, a display name that shows a real person's name over an unrelated address, or a genuinely compromised account, where criminals have taken over a real vendor's or employee's mailbox. The third is the hardest to spot because the email really does come from the right address.
Anatomy of a fake invoice scam, step by step
Here's how a typical vendor-invoice scam might unfold at a hypothetical wholesale distributor:
- Access. A supplier's sales rep falls for a phishing email, and criminals gain access to their mailbox.
- Reconnaissance. For weeks, the criminals quietly read emails. They learn who at the distributor pays invoices, the usual invoice format, amounts and timing.
- Setup. They create a mailbox rule so replies from the distributor are hidden from the real rep.
- The request. Just before a large invoice is due, the distributor's bookkeeper receives a message from the rep's real address: "We've switched banks. Please use the attached updated details for this and future payments."
- Pressure. A follow-up adds urgency: the old account is closing Friday, and payment must go out today to avoid a hold on the next order.
- Payment. The bookkeeper updates the vendor record and sends the payment. Everything looked normal.
- Discovery. Weeks later, the real supplier calls about an overdue invoice. By then, the money has usually been moved on.
Red flags that should stop a payment
- Any request to change bank account or payment details, however routine it sounds.
- Urgency, secrecy or pressure: "today," "confidential," "don't call, I'm in meetings."
- A request that bypasses your normal approval process.
- Small differences in the sender's address, or a reply-to address that differs from the sender.
- A change in tone, grammar or sign-off from someone you know.
- Payment to an account in a different name, location or country from the vendor's usual one.
- Requests for gift cards, or for payment methods the vendor has never used.
Any one of these is a reason to pause and verify. None of them proves fraud, and a compromised real account can show none of them. That's why the policy below doesn't rely on spotting red flags.
Worked example: what verification costs versus one loss
Suppose a hypothetical electrical subcontractor pays suppliers about $1.8 million a year. It adopts two rules: every bank-detail change must be confirmed by phone, and every payment over $5,000 gets a quick verification call before release.
Cost of the policy
- Payments over $5,000: about 20 a month × 5 minutes = 100 minutes a month, or 100 × 12 ÷ 60 = 20 hours a year.
- Bank-detail changes: about 12 a year × 15 minutes = 3 hours a year.
- Total: 23 hours × $40 an hour for the bookkeeper's time = $920 a year.
Cost of a single loss
One diverted payment for a large wire and conduit order might be $48,600. The policy's annual cost is $920 ÷ $48,600 = 1.9% of that one loss. And the loss may not be recoverable, while the supplier still needs to be paid, so the business can end up paying the same invoice twice.
Payment fraud can also hit your finances in ways insurance may or may not cover. Ask your insurance agent whether your policies cover social engineering or funds transfer fraud, and under what conditions.
A verification policy you can adopt today
- Bank-detail changes are never accepted by email alone. Call the vendor using a phone number from your existing records or their official website, never one from the email requesting the change.
- Confirm with someone you know. Ask for your usual contact by name and verify details they'd know.
- Add a waiting period. Hold the first payment to any new account for a set time, such as 48 hours, and confirm again before release.
- Require two people for large payments. One prepares, one approves, above a threshold you set.
- Owner requests follow the same rules. If the owner asks for an urgent wire, staff verify by calling the owner directly. Make it clear in writing that no one will be disciplined for verifying.
- Turn on multi-factor authentication for all email accounts, and review mailbox forwarding rules periodically.
These rules fit naturally into broader financial safeguards; see basic internal controls every small business should have and accounts payable management.
What to do in the first hour if you've been hit
Speed matters. The faster the bank acts, the better the chance of stopping or recovering funds.
- Call your bank immediately. Use the fraud line, report the transfer as fraudulent and ask them to request a recall from the receiving bank.
- Report it to law enforcement. In the U.S., the FBI accepts reports of internet-enabled fraud, and your bank may ask for a report number.
- Secure your email. Reset passwords, turn on multi-factor authentication, check for unfamiliar forwarding or filter rules, and review recent sign-ins.
- Warn the real vendor (or customer) through a known phone number, since their email may be compromised.
- Preserve evidence. Keep the emails with full headers, invoices and transaction records. Don't delete anything.
- Notify your insurer and advisors. Contact your insurance agent and, as needed, an attorney, especially if customer or employee data may have been exposed, since notification obligations may apply.
Common mistakes that let BEC scams succeed
- Replying to the email to "verify." If the account is compromised, the criminal answers. Always verify through a separate channel.
- Using the phone number in the suspicious email. It may ring the criminal. Use a number you already had on file.
- Exempting the owner. Staff who feel they can't question the boss are the ideal target. Put "verify owner requests too" in writing.
- Relying on spotting typos. Many BEC emails are well written and come from real accounts. Process protects you where instinct can't.
- Skipping multi-factor authentication. Stolen passwords are a common entry point. Multi-factor sign-in blocks many takeover attempts; see cybersecurity basics for small businesses.
- Waiting to report. Embarrassment costs time, and time costs recovery chances. Call the bank first, then sort out the rest.
Where AI can help
AI tools can help you prepare. An assistant can draft your payment verification policy in plain language, write a short training script for staff, and create realistic practice examples of suspicious emails for a team discussion. You can also paste in a suspicious email, with sensitive details removed, and ask it to point out red flags you might have missed.
Don't let an AI tool's reassurance replace the phone call. Criminals also use AI to write convincing, error-free messages, so "it looks legitimate" is never enough. The verification rule applies no matter what any tool says.
Frequently asked questions
Can money lost to business email compromise be recovered?
Sometimes, especially if the bank is contacted very quickly and the funds haven't been moved on. Recovery becomes much less likely with each passing day, which is why the first call should go to your bank's fraud line.
Does insurance cover business email compromise?
It depends on your policies. Some crime or cyber policies include coverage for social engineering or funds transfer fraud, often with specific conditions and limits. Ask your licensed insurance agent what you have.
How can I tell if an email is from a lookalike domain?
Check the full sender address, not just the display name, and compare it letter by letter with previous emails. Look for swapped letters, extra characters or a different ending. Still, verify by phone, because compromised real accounts pass this check.
Is a small business really a target?
Yes. Small businesses often have fewer approval steps and one person handling payments, which makes them attractive. The scams don't require a large company, just one routine payment.
Key takeaways
- BEC scams impersonate vendors, owners or employees to redirect payments, often from real, compromised accounts.
- Never accept bank-detail changes by email alone; call a number you already have.
- Require two people for large payments, and apply the rules to owner requests too.
- In the example, a verification policy cost about $920 a year versus a possible $48,600 single loss.
- If money goes out, call your bank's fraud line immediately, then report, secure email and notify advisors.
Comments
Post a Comment