Key Takeaways
- Business email compromise (BEC) is a type of fraud where criminals impersonate trusted contacts to trick businesses into sending money or sharing sensitive information.
- Fake invoices, changes to vendor payment instructions and urgent requests from executives are common tactics used in BEC scams.
- Always verify changes to payment information by calling a trusted phone number already on file, not a number provided in a suspicious email.
- Establishing clear payment approval procedures, training employees and separating financial responsibilities can help reduce the risk of fraud.
- If your business suspects a fraudulent payment, contacting your bank immediately may improve the chances of recovering funds.
When a Familiar Email Isn’t What It Seems
Your accounts payable team receives an email from a longtime vendor. The message looks routine, referencing an outstanding invoice and asking that future payments be sent to a new bank account.
The sender’s name is familiar. The invoice matches an expected payment. Even the email signature looks legitimate.
There’s just one problem. The message didn’t come from your vendor.
This is how business email compromise can happen, and it’s one reason businesses need to look beyond the appearance of an email before authorizing payments.
According to the FBI’s Internet Crime Complaint Center (IC3), business email compromise is a significant source of reported financial losses from cybercrime. These scams often succeed not because a company’s systems are technically vulnerable, but because criminals exploit everyday business relationships and payment processes.
For business owners, controllers and accounts payable teams, understanding how these scams work is an important part of protecting company finances.
What Is Business Email Compromise?
Business email compromise, commonly called BEC, is a type of financial fraud in which criminals use deceptive or compromised email accounts to impersonate someone a business trusts.
The goal is typically to convince an employee to transfer money, change payment information or disclose sensitive business information.
Unlike phishing emails that may contain obvious spelling errors or suspicious links, a BEC scam can look like an ordinary business conversation.
Criminals may research a company’s employees, vendors and leadership before making contact. In some cases, they gain access to legitimate email accounts and monitor conversations until they find an opportunity to interfere with a payment.
That familiarity is what makes these scams particularly difficult to recognize.
Fake Invoices and Payment Changes
Invoice fraud is one of the more common forms of business email compromise.
A criminal sends an invoice that appears to come from a legitimate supplier or intercepts an existing payment conversation. The message may request payment for goods or services the business actually purchased.
Sometimes, the only noticeable difference is the bank account listed on the invoice.
For example, a construction company might receive updated payment instructions from what appears to be a regular materials supplier. If the accounts payable team processes the change without confirming it, the payment could be sent directly to a criminal.
Vendor Impersonation Fraud
Vendor impersonation fraud occurs when someone pretends to represent a company your business already works with.
The criminal might use an email address that closely resembles the vendor’s actual domain or send messages from an account that has been compromised.
A request to update banking information, resend an invoice or switch payment methods may appear reasonable, especially when it arrives during an ongoing business transaction.
Executive Impersonation
Not every BEC scam involves an outside vendor.
Criminals may impersonate a CEO, CFO or another senior leader to pressure employees into making unauthorized payments.
These messages often create a sense of urgency. An employee might receive an email supposedly from the CEO requesting an immediate wire transfer for a confidential transaction.
The message may discourage questions or instruct the employee not to discuss the payment with anyone else.
When an email appears to come from someone in authority, employees may feel pressure to act quickly rather than follow established approval procedures.
How Business Email Compromise Leads to Wire Fraud
Wire transfers are a common target because they can move substantial amounts of money quickly and may be difficult to reverse once completed.
A criminal may direct an employee to send a wire to a fraudulent account, often using a legitimate business payment as the reason.
However, business email compromise isn’t limited to wire transfers. Fraudulent instructions may also involve ACH payments or other electronic payment methods.
The underlying tactic is the same: convincing someone with payment authority to send funds somewhere they were never intended to go.
Warning Signs Your Finance Team Should Know
Business email compromise scams aren’t always easy to identify. Still, certain requests
should prompt additional verification before a payment is approved.
1. A Vendor Suddenly Changes Banking Information
An established vendor emails to say they’ve changed banks and need future payments sent to a different account.
That may be a legitimate business update, but it should never be accepted based on an email alone.
Any request to change payment instructions deserves independent confirmation, regardless of how familiar the sender appears.
2. An Unexpected Request for an Urgent Payment
A message from an executive asks for an immediate transfer and emphasizes that the payment cannot wait.
Urgency is often used to discourage employees from taking the time to verify a request.
If the payment falls outside normal procedures, that is reason enough to confirm it before proceeding.
3. An Email Address That Looks Almost Right
A fraudulent email address might contain an extra letter, a missing character or a slightly different domain.
For example, a criminal might substitute a similar-looking character in a vendor’s company name.
These differences can be easy to miss, particularly when employees are reviewing dozens of emails throughout the day.
4. A Request to Keep the Transaction Confidential
An email instructing an employee not to discuss a payment with coworkers or supervisors should raise questions.
While some legitimate business transactions require confidentiality, secrecy should never override established financial controls.
5. Changes to Normal Payment Patterns
A vendor that typically accepts checks suddenly requests a wire transfer. An invoice arrives for an unusually large amount. A payment is requested earlier than expected.
Any of these changes could have a legitimate explanation.
The important thing is to recognize when a request doesn’t match the usual way your business operates and take the time to verify it.
How to Protect Your Business From Email and Payment Fraud
Preventing business email compromise doesn’t require your employees to become cybersecurity experts.
It starts with clear procedures that make fraudulent requests harder to act on.
The following controls can help businesses reduce their exposure to payment fraud.
Verify Payment Changes Using a Trusted Phone Number
One of the most effective ways to reduce the risk of BEC is to independently verify changes to payment instructions.
If a vendor emails new banking information, call the vendor using a phone number your business already has on file.
Do not use a phone number provided in the email requesting the change. That number could belong to the criminal.
This process is known as out-of-band verification, meaning the confirmation takes place through a separate, trusted communication channel.
Even when an email appears legitimate, a brief phone call can help prevent a costly mistake.
Require More Than One Person to Approve Payments
For businesses that regularly process electronic payments, dual approval can provide an additional layer of protection.
Under this approach, one employee initiates a payment and another authorized employee reviews and approves it.
Separating these responsibilities reduces the likelihood that a single fraudulent request will result in an unauthorized transfer.
Businesses should consider approval requirements based on transaction amounts, payment types and their own operating needs.
Establish a Written Process for Payment Changes
Employees should know exactly what to do when a vendor requests updated payment information.
A written procedure can help ensure that changes are handled consistently, regardless of who receives the request.
Consider requiring employees to:
- Confirm the request directly with the vendor using previously verified contact information.
- Document when and how the request was verified.
- Obtain appropriate internal approval before updating banking details.
- Update the vendor’s information only after verification is complete.
- Review the first payment made using the new instructions.
These steps create a consistent process that employees can follow even during busy periods.
Keep Vendor Payment Records Accurate
Your vendor master file, the record of suppliers and their approved payment information, plays an important role in payment security.
Limit who can make changes to vendor banking details and periodically review those records for accuracy.
When possible, separate responsibility for maintaining vendor information from responsibility for releasing payments.
This helps reduce the risk of unauthorized changes going unnoticed.
Train Employees to Recognize Suspicious Requests
Your accounts payable and finance employees are often the first people to encounter a potential BEC scam.
Make sure they understand common warning signs and know how to report suspicious requests.
Training should extend beyond finance teams. Executives, administrative employees and anyone authorized to communicate payment instructions should understand the risks.
It is also important to create an environment where employees feel comfortable questioning unusual requests, even when they appear to come from senior leadership.
A verification call should be viewed as following company policy, not slowing down business.
Strengthen Email Security
Payment procedures are essential, but email security also matters.
Encourage employees to use strong, unique passwords and enable multifactor authentication wherever available.
Businesses should also work with their IT teams or technology providers to evaluate email authentication measures and account security settings.
The Cybersecurity and Infrastructure Security Agency (CISA) offers additional guidance through its Secure Our World initiative.
No single safeguard can eliminate every risk. Combining secure technology with consistent financial procedures provides a stronger defense.
How Treasury Management Can Support Payment Security
For businesses processing multiple payments each week, having the right financial processes and banking resources in place can make a meaningful difference.
Treasury management is about more than moving money. It also involves managing cash flow, overseeing transactions and establishing greater visibility into how business funds are handled.
Depending on a business’s needs and the banking services available, treasury management and payment solutions can support more structured financial operations.
At InBank, our treasury management services are designed to help businesses manage their day-to-day financial activities.
Businesses looking to improve their accounts payable processes can also explore InPayables as part of a broader conversation about payment management.
Technology can support a company’s financial procedures, but it shouldn’t replace independent verification or internal oversight.
The strongest approach combines appropriate banking tools with employees who understand when to question a payment request.
What to Do if Your Business Falls Victim to a BEC Scam
Even businesses with established security procedures can encounter sophisticated fraud attempts.
If you discover that a payment may have been sent to a fraudulent account, acting quickly is important.
Contact your bank immediately. Explain what happened and provide the transaction details. Depending on the payment method and circumstances, the bank may be able to initiate recovery efforts or work with the receiving financial institution.
Report the incident to the FBI. Businesses can submit complaints through the Internet Crime Complaint Center. Provide as much information as possible, including transaction details, email communications and any known information about the recipient.
Preserve relevant records. Keep copies of suspicious emails, invoices, payment instructions and related communications. These may help with an investigation.
Secure potentially compromised accounts. If an employee’s email account may have been accessed, involve your IT or security team immediately. Review account access, change affected credentials and investigate whether additional messages or payment requests were sent.
Review what happened. Once the immediate situation is addressed, evaluate how the fraudulent request moved through your payment process and identify where additional safeguards may help.
For additional guidance, visit InBank’s fraud protection and security resources and our Fraud Watch alerts.
Protecting Your Business Starts With Consistent Habits
Business email compromise is a reminder that financial fraud doesn’t always begin with a sophisticated technical attack.
Sometimes, it starts with a convincing email and a request that seems like an ordinary part of doing business.
For companies managing vendor relationships, invoices and electronic payments, taking a few extra steps to verify unusual requests can make a significant difference.
Make payment verification part of your everyday operations. Give employees clear procedures to follow and encourage them to speak up when something doesn’t look right.
At InBank, we believe businesses benefit from having a banking partner who understands their operations and can help them navigate their financial needs.
Whether you’re reviewing your current payment processes or looking for ways to better manage your business finances, we’re here to help.
Explore InBank’s treasury management solutions or review our business fraud prevention resources to learn more.
Frequently Asked Questions About Business Email Compromise
What is business email compromise (BEC)?
Business email compromise is a type of scam in which criminals impersonate trusted business contacts or use compromised email accounts to trick employees into sending money or sharing sensitive information. Common examples include fraudulent invoices, fake vendor payment changes and requests that appear to come from company executives.
How can I verify a vendor’s new payment instructions?
Call your vendor using a phone number that your business has already verified. Do not rely on contact information included in the email requesting the change. Confirm the new banking details directly with an authorized representative before updating payment records or sending funds.
What are the best ways to prevent BEC scams?
Businesses can reduce their risk by requiring independent verification of payment changes, using dual approval for transactions, restricting access to vendor payment records and regularly training employees to recognize suspicious requests. Strong email security and clear internal procedures also help.
Can business email compromise affect ACH payments?
Yes. Although BEC is frequently associated with wire fraud, criminals can also use fraudulent emails to redirect ACH payments. Businesses should independently verify changes to payment instructions regardless of the payment method being used.
What should my business do if money is sent to a fraudulent account?
Contact your bank immediately and provide the transaction details. Report the incident to the FBI’s Internet Crime Complaint Center at IC3.gov. Preserve relevant communications and work with your IT or security team to determine whether any email accounts were compromised.