Business Email Compromise: Stop Invoice and Payment Fraud

Business email compromise (BEC) is payment fraud carried out by email: a criminal poses as a vendor, the owner, an employee, or a closing agent and gets someone to send money or change bank details. There is usually no virus and nothing for security software to catch. What stops it is a fixed habit of confirming every new or changed payment instruction by phone, using a number you already had. If money has already gone out, contact your bank immediately to request a recall, then file a report at ic3.gov.

How Much Does BEC Cost Businesses?

The FBI’s Internet Crime Complaint Center (IC3) received 24,768 BEC complaints in 2025, with reported losses of about $3.05 billion. That makes it the second most costly crime type the FBI tracks, behind investment fraud. Divide the two numbers and the average reported loss is a little over $120,000 per complaint.

By comparison, ransomware complaints to IC3 showed about $32 million in reported losses the same year (a figure the FBI says excludes downtime and recovery costs). BEC gets less attention and takes far more money.

How Does a BEC Scam Work?

The FBI describes BEC as a scam aimed at anyone performing a transfer of funds, carried out by compromising or imitating a legitimate business email account. There are two main routes.

A real mailbox is taken over. Someone’s email password is stolen, often through a phishing email. The criminal reads the mailbox quietly, learns who pays whom and when, and then sends a payment request or “updated bank details” from the genuine account, sometimes as a reply inside a real conversation. Microsoft lists the signs of this kind of takeover, including inbox rules that forward mail to unknown addresses or hide messages in folders such as RSS Subscriptions.

A lookalike is used. The criminal registers a domain one character off from the real one, or simply sets the display name to the owner’s name on a free email account, and sends the request from there.

Either way, the mailbox that gets compromised may not be yours. If your vendor’s email is taken over, the fraudulent invoice arrives from their real address and passes every visual check. That is why the procedure below does not depend on anyone spotting a fake.

The Common Forms of Payment Fraud

Type	What the message says	Who usually receives it
Vendor bank change	”We have moved banks. Please use the attached details for this and future invoices.”	Accounts payable, bookkeeper
Fake or altered invoice	A real-looking invoice, sometimes a genuine one with the account number edited	Accounts payable
Owner or executive request	”I need a wire sent today, I am tied up in meetings, keep this between us for now.”	Office manager, bookkeeper
Payroll redirect	”I changed banks, please update my direct deposit before Friday.”	Payroll or HR
Closing or escrow instructions	”Revised wiring instructions for your closing are attached.”	Buyers, agents, law and escrow offices
Gift card request	”Pick up some gift cards for a client and send me the codes.”	Front desk, assistants

Any office that pays invoices is a target. Offices that handle large transfers on behalf of others, such as real estate offices, law and accounting firms, and contractors paying suppliers and subcontractors, have more at stake per transaction.

A Payment Verification Procedure You Can Adopt

Write this down, keep it to one page, and have the owner sign it so that staff know they are expected to follow it even when the request appears to come from the owner.

1. Treat Every Bank Detail Change as Unverified

New vendor, changed account number, new payroll deposit details, revised wiring instructions: none of these is acted on from an email, text message, or voicemail alone. No exceptions for urgency, and no exceptions for seniority.

2. Call Back on a Number You Already Had

Confirm the change by phoning the vendor or person on a number from your own records: a signed contract, a previous paid invoice, your accounting system, or their public website typed in by hand. Never use a phone number from the message that asked for the change, and never confirm by replying to it. The FBI’s guidance is the same: use a secondary channel to verify account changes.

Because voices can now be imitated, a callback you place is what counts, not a call you receive. See our post on AI voice cloning and deepfakes.

3. Use Two People for Large or Unusual Payments

Set a dollar amount above which one person prepares the payment and a second person approves it. Most business banking platforms support this as “dual approval” or “dual control.” Ask your bank what it offers.

4. Keep a Record

Note who confirmed the change, the number used, and the date. This takes a minute and gives you a clear record if a payment is ever disputed.

5. Send a Small Test Payment for New Payees

For a new or changed account, send a small amount first and confirm receipt by phone before sending the balance. This adds a day. For a five figure payment that is a reasonable trade.

6. Give Staff Explicit Permission to Slow Down

The procedure fails if an employee fears annoying the owner. Say it plainly: nobody will be criticized for holding a payment until it is verified, including when the owner is the one asking.

Ask Your Bank About Fraud Controls

Banks offer tools with names such as dual approval, payment alerts, ACH debit blocks and filters, and positive pay (the bank only honors checks or debits that match a list you supply). Availability and fees vary, so ask your business banker which of these your account supports.

What to Do in the First Hour

If a fraudulent payment has gone out, the order matters. The FBI’s instruction is blunt: time is of the essence.

1. Contact your bank’s fraud department immediately. Say that you are reporting a fraudulent transfer and ask for a recall or reversal. The FBI also advises asking for any indemnification documents the bank needs, because those can hold up the recall. Policies differ between banks, so ask what they will do and when.
2. File a complaint at ic3.gov the same day. Include the full transaction details: date, amount, sending and receiving account and routing numbers, the receiving bank, and the beneficiary name. The FBI asks for this regardless of the amount lost.
3. Contain the email account. If one of your mailboxes was involved, reset its password from a clean device, revoke all active sessions, and turn on multi-factor authentication. Do not send the new password by email, since the attacker may still be reading the mailbox.
4. Preserve the evidence. Keep the fraudulent emails (do not delete them), the invoice or instructions, and any phone numbers used.
5. Warn the other party. Use a known phone number to tell the vendor, customer, or employee who was impersonated. Their mailbox may be the one that was compromised.
6. Notify your insurer if you have cyber or crime coverage. Policies often have notice deadlines and their own requirements. See our overview of cyber insurance for small businesses.

Why Speed Matters

IC3 runs a Recovery Asset Team that works with banks to freeze fraudulent transfers, a process the FBI calls the Financial Fraud Kill Chain. In 2025 it handled 3,900 incidents and froze about $679 million of $1.16 billion in attempted theft, a 58% success rate. The FBI notes this works best when complaints are filed as quickly as possible. Recovery is possible, but it is not something to count on, and every hour reduces the odds.

After the First Day

Have the mailbox examined for what Microsoft’s compromised account guidance lists: forwarding addresses, hidden inbox rules, unfamiliar sign-in methods added to the account, apps granted access, and sign-in logs showing where the attacker connected from. If the mailbox held customer, patient, or financial records, you may have notification duties, so involve an attorney or your insurer early.

Technical Controls That Reduce the Risk

These lower the number of fraudulent messages and make takeovers harder. None replaces the callback.

• Multi-factor authentication on every mailbox. A stolen password alone should not open anyone’s email. Stronger methods such as passkeys resist fake sign-in pages. See MFA methods ranked.
• Sender authentication (SPF, DKIM, and DMARC). These DNS records let other mail systems reject messages that forge your exact domain. CISA is clear about the limit: DMARC protects your domain from being spoofed but does not protect against incoming spoofed email unless the sending domain uses it too, and it does nothing about lookalike domains.
• Blocking automatic forwarding to outside addresses, and reviewing inbox rules periodically.
• External sender tags and impersonation protection in your email filter, which flag messages that use an internal display name from an outside address.
• Staff practice. Include payment fraud scenarios in security awareness training, not only link-clicking tests.

Limits and Trade-Offs

Verification has a cost. Callbacks add minutes to each bank change, vendors occasionally find them tedious, and a test payment adds a day. For an office that pays a handful of long-standing vendors, the full procedure will rarely be triggered, and that is fine. The rule only needs to apply when payment details are new or different.

Two honest limits: no email filter catches a fraudulent message sent from a vendor’s genuine, compromised mailbox, and no procedure helps if people are allowed to skip it under pressure.

Common Mistakes

• Confirming a bank change by replying to the email that requested it.
• Using the phone number printed on the new invoice or in the email signature.
• Exempting the owner’s requests from the rule.
• Waiting until the next morning to contact the bank.
• Resetting the mailbox password but leaving the attacker’s forwarding rule in place.

Common Questions

Will my bank refund a fraudulent wire or ACH payment?

Do not assume so. The FBI notes that financial institutions have varying policies on recovering funds, and a recall request is not a promise of a refund. The outcome depends on your account agreement, how fast the bank was told, and any insurance you carry. Ask your banker now what help it provides with fraudulent transfers and which fraud controls your account supports.

Does cyber insurance cover BEC losses?

It depends entirely on the policy, so ask before you need it. Questions for your broker: does the policy cover a payment that staff were tricked into sending, what is that coverage called, what is its limit, and does it require that payment changes were verified in a particular way? Get the answers in writing and match your verification procedure to them.

Does multi-factor authentication stop BEC?

It stops a large share of mailbox takeovers, which is how many of these scams begin. It does not stop a request sent from a lookalike domain or from a vendor’s compromised mailbox, because your accounts were never involved. MFA and the callback procedure cover different parts of the problem, so use both.

Should we report an attempt even if no money was lost?

Yes. Report the message with your email program’s phishing button, tell whoever manages your IT so the sender or domain can be blocked, and warn the vendor or person who was impersonated, since their mailbox may be the one that was compromised. The FBI also publishes alerts on current BEC variants that are worth a look.

How We Can Help

Coastal Growth Co. helps small businesses in Orange County with both halves of this problem: the email side (multi-factor authentication, SPF, DKIM and DMARC, forwarding controls, mailbox reviews after a suspected takeover) and a one-page payment verification procedure that fits how your office pays bills. See our cloud and email services or get in touch. Scope and price are agreed before any paid work begins.