An email arrives from a supplier you have paid for years. Same logo, same signature, same tone. It says they have switched banks and asks you to update their details before the next payment. You do, the payment goes out, and a week later the real supplier calls asking where their money is. This is business email compromise, or BEC. The FBI's Internet Crime Complaint Center (IC3) received 21,442 BEC complaints in 2024, with reported losses of about $2.77 billion, and it has recorded more than $55 billion in exposed losses worldwide between October 2013 and December 2023. Small businesses are attractive targets because one person often handles both the email and the payments.
How the scam usually works
Most attempts follow one of a few patterns. The most common is supplier impersonation: a criminal sends an invoice or a "new banking details" notice that looks like it comes from a vendor you already pay. Sometimes the supplier's real email account, or yours, has been taken over, and the fraudster reads the conversation for weeks before replying inside a genuine thread at exactly the right moment. Others rely on look-alike domains, where a supplier's address is copied with one character swapped, such as the number 1 in place of a lowercase l, which is easy to miss on a phone.
A second family of scams pretends to come from inside the business. A message that appears to come from the owner asks the bookkeeper for an urgent wire transfer or a stack of gift cards, usually while the owner is "in a meeting" or traveling. Large one-off payments are another favorite target: home buyers, title companies and contractors receive fake wiring instructions just before a closing or deposit payment is due.
The common thread is pressure plus a change to how money moves. That is exactly where a few controls make the biggest difference.
Warning signs to train your team on
The biggest red flag is any request to change banking or payment details, however routine it looks. Treat it as unconfirmed until someone has checked it another way. Urgency and secrecy come next: a request to skip the usual approval, keep something quiet or get it done before anyone can ask questions.
The details matter too. Look twice at a sender or reply-to address that differs, even slightly, from the usual one, and at a first-time payee, an unusual amount, or a payment to an account in a different name or country. Be wary of any request to move the conversation to text messages or a personal email address.
Process controls that stop it
Most payment fraud is stopped by process rather than technology, and the most effective habit costs nothing: call back on a known number. Before changing any supplier's banking details, phone them using a number from your own records or their website, never a number in the email asking for the change.
Beyond that, make payment changes a two-person job, where one person requests the change and another approves it. Even a three-person office can do this. Put new or changed payees on a short hold, and confirm a small test payment by phone before sending the full amount; together, those two steps catch most attempts. Then write it all down. A one-page payment procedure that everyone follows, including the owner, takes the awkwardness out of questioning a request from the boss.
Technical controls that close the door
Most mailbox takeovers start with a stolen password, so the first step is making every mailbox ask for multi-factor sign-in, starting with anyone who touches finance. Attackers who do get in often create rules that hide or forward replies, and Microsoft 365 and Google Workspace can alert you when these appear. External sender labels help as well, because staff can see at a glance when a message comes from outside the organization.
On your own domain, SPF, DKIM and DMARC make it much harder for criminals to send email that appears to come from you. For the money itself, use separate accounts for banking, with the bank's own alerts, dual approval and payee controls switched on.
If money has already been sent
Move quickly, and work through these steps in order.
- Call your bank immediately. Ask them to request a recall of the transfer and to contact the receiving bank. The FBI's advice is that time is of the essence: the sooner the banks act, the better the chance of stopping the money.
- File a complaint with the IC3 at ic3.gov as soon as you can, and contact your local FBI field office. The IC3's Recovery Asset Team works with banks to freeze fraudulent transfers, and most of the cases it handles involve business email compromise. In 2024 that process froze about $562 million.
- Secure the mailbox. Reset passwords, sign out all sessions, remove unknown forwarding rules and check what else the attacker could see.
- Check your notification duties. Every state has a data breach notification law. If the attacker could see personal information about customers or employees, such as Social Security numbers or financial account numbers, you may need to notify the people affected and, in some states, the attorney general. Health information brings in HIPAA's breach notification rule, and businesses covered by the FTC Safeguards Rule must report certain incidents affecting 500 or more customers to the FTC.
- Tell your insurer if you carry cyber or crime coverage, and keep copies of every email and transaction record.
This article is general information, not legal advice. Your attorney can confirm your notification duties after an incident.
How we help
Bitnode Technologies helps US small businesses lock down Microsoft 365 and Google Workspace, set up multi-factor sign-in, configure email authentication and put simple payment-approval steps in place, with remote support nationwide. Our free IT assessment includes a review of your email security, and we can walk through your payment process with you. To talk it over first, book a free 30-minute consultation.
Useful references
- Business Email Compromise: The $55 Billion Scam, FBI Internet Crime Complaint Center
- 2024 Internet Crime Report (PDF), FBI Internet Crime Complaint Center
- Business Email Compromise, FBI
- File a complaint, Internet Crime Complaint Center
Cover photo by Nathan Dumlao on Unsplash.