An accounts payable clerk receives an email from a vendor she has paid for three years. The message is polite and routine: the vendor’s bank has changed, please send the next payment to the new account. The invoice number is correct. The amount is correct. The signature block is correct. She updates the payment details and sends $84,000.
Two weeks later, the real vendor calls to ask why it has not been paid. By then the money has moved through two accounts and is gone.
This is business email compromise, usually shortened to BEC, and it is one of the most expensive forms of cybercrime in the world. It does not rely on clever malware or a technical exploit. It relies on trust, timing and a believable email. This guide explains how the BEC scam works, how invoice fraud is carried out step by step, real cases that show what is at stake, and the verification steps that reliably stop it.
What Is Business Email Compromise?
Business email compromise is a scam in which a criminal impersonates a trusted person, such as an executive, a vendor, an attorney or an employee, usually by email, to trick a company into sending money or sensitive data. In invoice fraud, the most common version, the attacker either alters a genuine invoice or sends a fake one so that payment goes to a bank account the criminal controls.
The fastest ways to stop BEC are to verify every change to payment details by calling a known phone number, require two-person approval for payments and bank changes, enable multi-factor authentication on all email accounts, and report fraudulent transfers to your bank immediately, because the first hours decide whether money can be recovered.
Key Takeaways
- BEC is a fraud of persuasion, not mainly a technical hack. The attacker needs you to act, not to click.
- The FBI’s Internet Crime Complaint Center (IC3) has reported BEC losses of roughly $2.9 billion in 2023 and nearly $2.8 billion in 2024, and more than $55 billion in cumulative losses since 2013.
- Invoice fraud works because accounting teams process large volumes of payments and are trained to be efficient.
- The strongest defense is a verification procedure that does not depend on the suspicious email.
- Speed matters after a loss. Contact your bank and report to the authorities within hours.
What Is Business Email Compromise?
Business email compromise is a category of fraud that targets organizations that make wire transfers, ACH payments and other electronic payments. The attacker poses as someone the victim already trusts and asks for a payment, a change of bank details or confidential information.
Two features separate BEC from ordinary phishing:
- It is targeted. Phishing is often sent to thousands of people with generic bait. BEC emails are written for a specific person, company, supplier or project.
- It often contains no malware or suspicious link. A plain-text email asking for a payment change passes through many security filters because there is nothing technical to detect.
Attackers get into position in one of two ways. In the first, they spoof or imitate an identity: they register a domain that looks almost identical to a real one, or they forge the display name of an executive. In the second, they actually compromise a real mailbox, using stolen or phished credentials, and send messages from the genuine account. The second is far more dangerous, because the email truly comes from the real person’s address and sits inside a real conversation thread.
The term “business email compromise” is sometimes extended to “email account compromise” (EAC) when individuals, not companies, are targeted. The tactics are the same.
How Big Is the Problem?
The scale of BEC surprises many business owners, because the headlines tend to focus on ransomware and data breaches. Yet year after year, the FBI’s IC3 annual reports place BEC among the costliest cybercrime categories reported.
- In 2023, the IC3 recorded more than 21,000 BEC complaints with adjusted losses of about $2.9 billion.
- In 2024, losses were again close to $2.8 billion.
- Cumulatively, the FBI has counted more than $55 billion in exposed losses worldwide since 2013.
These numbers cover only the incidents that were reported. Many victims do not report out of embarrassment, fear of reputational damage or because they assume the money is unrecoverable. The true figure is almost certainly higher.
The average loss per incident is also high. Individual BEC losses commonly run into the tens or hundreds of thousands of dollars, and some reach millions. Compare that with a typical phishing attack, where the criminal may gain a single set of credentials. One successful BEC email can pay as much as a hundred smaller scams, which is why criminal groups invest heavily in it.
How Invoice Fraud Works, Step by Step
Invoice fraud is the BEC variation most likely to hit a small or mid-sized business. Here is how a typical operation unfolds.
Step 1: Reconnaissance
The attacker researches the target. Company websites list executives and finance staff. LinkedIn shows who works in accounts payable. Press releases name vendors, construction projects and acquisitions. Public contracts reveal suppliers and payment amounts. Leaked credentials and previous breaches reveal email addresses and password patterns.
The goal is to understand who pays whom, how often, how much, and who approves it.
Step 2: Gaining a foothold
The attacker then positions themselves in the payment conversation. There are two common routes:
- Mailbox takeover. A phishing email with a fake Microsoft 365 or Google login page captures an employee’s or vendor’s password. If multi-factor authentication is not enabled, the attacker simply logs in. If a session token is stolen, they may even bypass it.
- Lookalike domain. The attacker registers a domain such as acme-supplies.com instead of acmesupplies.com, or swaps a letter, for example replacing a lowercase “l” with a capital “I” or “rn” for “m”. They then email from an address that looks right at a glance.
Step 3: Silent observation
If the attacker controls a real mailbox, they do not strike straight away. They read. They learn the vocabulary, the tone, the typical invoice schedule, the names of approvers and the accounts used. They often create inbox rules that automatically hide or forward certain emails, for example any message containing words like “invoice,” “payment” or “wire,” so the real owner never sees the replies.
This stage can last days or weeks. It is the reason BEC messages feel so authentic.
Step 4: The switch
At the right moment, usually just before a large legitimate invoice is due, the attacker intervenes. There are three typical moves:
- Altered invoice. They take a genuine invoice and replace the bank details with their own, then forward it as if from the vendor.
- Bank change request. They send a short message, supposedly from the vendor, announcing a new bank account because of an audit, a merger or a change of banks.
- Fake invoice. They send a completely fabricated invoice for goods or services, relying on the target not checking whether the work was ever ordered.
The email often includes urgency. It may say the payment is overdue, that the account is under review, or that the original account is frozen.
Step 5: The payment
The victim processes the payment. Because it matches the amount and invoice number they expected, it does not raise any alarms. Most BEC payments are wire transfers or ACH transfers, which are fast and hard to reverse.
Step 6: Laundering
The stolen funds are moved quickly. They may pass through “money mule” accounts, be split into smaller amounts, converted to cryptocurrency, or sent overseas. Within hours, recovering the money becomes much harder. This is why a rapid report to the bank is so important.
Step 7: Repetition
If the scam is not discovered, the criminal returns. Once a payment succeeds, the attacker may keep sending “updated” invoices until someone notices. Victims have been hit several times in a row.
The Five Main Types of BEC Scams
The FBI and security researchers commonly group BEC into several patterns. Understanding them helps your team recognize variations.
1. Invoice and vendor payment fraud
As described above, the attacker impersonates a supplier or contractor, or compromises their email, and redirects payment. This is also called vendor email compromise (VEC) when the supplier’s own account is the one that is taken over. VEC is particularly dangerous because the fraudulent message arrives from a legitimate, known address.
2. CEO fraud
The attacker impersonates a senior executive and instructs a finance employee to make an urgent, confidential payment, often for an acquisition or a sensitive deal. The email stresses secrecy: “Do not discuss this with anyone yet.” Authority and urgency combine to bypass normal checks.
3. Account compromise
An executive’s or employee’s real email account is hacked and used to send payment requests to customers, vendors or colleagues. The contacts in the account’s address book become targets.
4. Attorney or advisor impersonation
The criminal poses as a lawyer, accountant or consultant involved in a confidential transaction. These attacks often hit at the end of the business week or near the close of a deal, when staff are under pressure and less likely to question instructions.
5. Data theft and payroll diversion
Not every BEC scam asks for money directly. Some target HR and finance staff to obtain employee tax forms, personal data or W-2 information. Others ask payroll to change an employee’s direct deposit details, sending the paycheck to the criminal’s account. The same technique is used against gift card purchases, where a fake executive asks an assistant to buy and send gift card codes.
Real-World BEC Examples
These cases show that BEC is not just a risk for small businesses. Even technology giants have been fooled.
A Lithuanian man and two U.S. tech giants. Between roughly 2013 and 2015, a scammer sent fake invoices, supported by forged contracts and letters, to employees at Google and Facebook, posing as a real hardware supplier. The companies paid more than $100 million in total before the fraud was discovered. A large portion was later recovered, and the perpetrator was convicted. The case showed that even highly sophisticated companies can be defeated by a convincing invoice.
Ubiquiti Networks. In 2015, the networking company disclosed that employees had transferred about $46.7 million after receiving fraudulent requests impersonating executives and outside parties. Some of the funds were later recovered, but a substantial part was lost.
Toyota Boshoku. In 2019, a European subsidiary of Toyota’s parts supplier reportedly lost around $37 million after criminals persuaded a finance executive to change the recipient bank account on a payment.
Government and nonprofit victims. In 2020, Puerto Rico’s government reportedly lost millions of dollars after fraudulent emails prompted a change to bank account information. Schools, hospitals, churches and municipalities have been caught too, often because payment procedures were informal.
The lesson is consistent. These organizations did not lack intelligence or technology. What they lacked at the critical moment was a verification step that could not be bypassed by a persuasive email.
Why BEC Works So Well
BEC succeeds because it exploits normal business behavior rather than technical weaknesses.
Trust in routine. Paying invoices is repetitive. People develop habits, and habits skip questions. If the invoice looks like last month’s, it is easy to approve.
Authority and urgency. A message from the CEO or an overdue vendor triggers a strong desire to comply quickly. Attackers deliberately add deadlines, confidentiality requests and pressure.
Real context. When criminals read a genuine email thread, they can reply at the right moment with the right references. The message feels familiar because it is familiar.
No malicious attachment. Security tools are good at catching malware and known bad links. A short, plain-text email requesting an account change contains neither.
Remote and distributed work. Teams that work across time zones and rarely meet face to face are more used to handling requests by email, and less likely to walk over and ask.
Fast, irreversible payment systems. Wire and instant payments clear quickly. Once the money has left, there is little time to react.
Fragmented responsibility. In many companies, the person who receives the invoice, the person who approves it and the person who releases the payment are different people, each assuming that someone else has checked the details.
Red Flags of a BEC Email
No single warning sign proves fraud, but a combination should trigger a verification call. Train your team to look for the following.
- A change of bank details, especially if it arrives close to a payment date or comes with a new account in a different bank, city or country.
- Unusual urgency or pressure to pay immediately, skip the normal approval process or bypass a colleague.
- A request for secrecy, such as “keep this confidential” or “do not discuss with the team.”
- A slightly different email address or domain. Check the actual sending address, not just the display name. Look for swapped characters, extra words or a different top-level domain.
- A reply-to address that does not match the sender’s address.
- A change in tone or language, such as unusual phrasing, new sign-offs or grammatical quirks the sender does not normally use.
- Requests to communicate only by email or reluctance to talk on the phone.
- Payment to a third party or personal account instead of the company’s usual business account.
- An invoice for goods or services that nobody ordered, or one that references the wrong project, wrong purchase order or wrong amount.
- Unusual payment methods, such as gift cards, cryptocurrency or a switch from ACH to wire.
- Messages sent outside normal hours or while the sender is traveling, with a claim that they cannot take calls.
- A message that appears in the middle of a long thread but contains a sudden change of payment instructions.
Remember that in a true account compromise, the email address and tone may be perfect. That is why technical detection alone is not enough, and why a process that forces independent verification is so important.
How to Verify Payment Requests: The Steps That Stop BEC
The single most effective defense against BEC is a verification process that does not rely on the same channel the attacker controls. If the criminal is inside the email thread, replying to that thread to ask “Is this real?” simply asks the criminal.
1. Call back using a known number
Whenever a vendor, customer or executive requests a change to bank details or an unusual payment, phone the person using a number you already had on file from a contract, a previous invoice or your vendor management system. Do not use the phone number in the email’s signature or the invoice, because the attacker may have changed it.
Ask a specific question that the real person would know. Confirm the new account details aloud. Document the call, including the time, who you spoke to and what was confirmed.
2. Require two-person approval
No single employee should be able to add a vendor, change bank details and release a payment. Require a second person to review and approve:
- New vendors
- Changes to existing vendor bank information
- Payments above a defined threshold
- Any urgent or exceptional payment
This segregation of duties turns a one-person mistake into a two-person checkpoint.
3. Use a vendor change form and cooling-off period
Create a standard form for bank detail changes. Require signed documentation, such as a bank letter, and confirm it independently. For significant changes, add a waiting period of one or two business days before the first payment to the new account, and consider sending a small test payment first, confirmed by the vendor.
4. Match invoices against purchase orders
Issue purchase orders and use three-way matching: purchase order, receipt of goods or services, and invoice. A fabricated invoice for something nobody ordered should fail automatically.
5. Confirm executive requests in person or by a second channel
If an executive asks for an urgent wire, confirm by phone, a video call, a company chat platform or in person. Make it a company rule that no payment is released on the basis of an email alone, no matter who sent it. Executives should publicly support this policy so employees never feel they are being insubordinate by checking.
6. Make “stop and verify” culturally safe
Employees need to know they will be thanked, never punished, for pausing a payment to verify it. Many BEC losses happen because a junior employee felt too uncomfortable to question a request that appeared to come from the CEO.
7. Keep a verified vendor list
Maintain a central record of trusted vendors, contacts, phone numbers and bank accounts, updated only through the controlled process above. Review it at regular intervals.
8. Use bank-side protections
Talk to your bank about positive pay, payee verification services, payment holds, transaction limits and alerts. Some banks and payment systems now check whether the account name matches the intended recipient, which can catch a mismatch before the money moves.
Technical Controls That Reduce BEC Risk
Process controls are your core defense, but technology reduces the number of attacks that reach your staff and limits the damage when one gets through.
Turn on multi-factor authentication everywhere
Enable MFA for every email account, with particular attention to finance, executive and IT administrator accounts. Prefer phishing-resistant methods, such as hardware security keys or passkeys, over text messages. Block legacy protocols that do not support MFA.
Configure SPF, DKIM and DMARC
These three email authentication standards help prove that a message really came from the domain it claims to represent.
- SPF lists the servers permitted to send mail for your domain.
- DKIM adds a cryptographic signature to your outgoing messages.
- DMARC tells receiving servers what to do when SPF or DKIM checks fail, and sends you reports. Moving to a policy of quarantine and then reject makes it much harder for criminals to spoof your exact domain.
This protects your customers and vendors from criminals pretending to be you.
Defend against lookalike domains
Register obvious variations of your own domain. Use tools or services that monitor newly registered domains similar to yours. Configure your mail system to flag messages from lookalike domains or from senders who have never contacted you before.
Add external sender banners
Label messages from outside the organization with a clear banner. This helps staff notice when an “internal” executive email actually came from an outside address.
Monitor mailbox rules and sign-ins
BEC attackers often create hidden forwarding or deletion rules. Alert on:
- New inbox rules that forward mail outside the company or move messages to obscure folders
- Logins from unusual countries, devices or impossible travel patterns
- New OAuth app consents and unfamiliar connected applications
- Mass password reset requests
Disable automatic external forwarding unless your business truly needs it.
Use advanced email security
Modern email security tools use behavioral analysis and impersonation detection, not just malware scanning. They can spot unusual sender patterns, a first-time bank detail request or an executive name from an unfamiliar address. They are not perfect, but they add a useful layer.
Keep systems patched and limit privileges
Keep operating systems, browsers and email clients updated. Give finance employees only the access they need, and separate administrator accounts from daily-use accounts.
Process Controls and Employee Training
Technology cannot fully solve a problem that depends on human judgment. Training and clear procedures matter just as much.
Run realistic training
Generic annual videos are not enough. Teach your finance, HR, procurement and executive-assistant teams about BEC in particular, with real examples drawn from your industry. Include scenarios such as:
- A vendor bank change right before a big payment
- An urgent wire request from the CEO who is “in a meeting”
- A gift card request from a manager
- A payroll direct deposit change
Repeat the training regularly and update it when new variations appear.
Practice simulations
Run simulated BEC emails, and measure how often staff verify rather than click or reply. Treat the results as a learning opportunity, not a punishment.
Write down your payment policy
A clear, written policy removes ambiguity. It should specify who may approve payments, what thresholds trigger extra review, how vendor changes are verified and what to do when something looks wrong. Make sure it also covers when the approver is away, since criminals often strike during holidays and travel.
Limit what you share publicly
Think about what criminals can learn from your website, social media and press releases. Public org charts, out-of-office auto-replies and posts about travel or new vendors give attackers material. You cannot hide everything, but you can avoid giving away payment details and approval structures.
Create an incident response plan
Know in advance who to call, what to document and how to reach your bank 24 hours a day. A plan on paper saves precious hours when a fraudulent payment is discovered.
What to Do If You Have Been Hit by a BEC Scam
If you suspect that a payment went to a criminal, act immediately. The first hours are the best chance of recovery.
- Contact your bank right away. Call, do not just email. Ask them to initiate a recall or reversal of the wire or ACH transfer and to contact the receiving bank. Tell them it is a suspected fraud.
- Report to law enforcement. In the United States, file a complaint at the FBI’s IC3 (ic3.gov) and contact your local FBI field office. If the transfer was recent, the FBI may be able to work with financial institutions to freeze funds through its Recovery Asset Team. Outside the U.S., contact your national cybercrime or fraud reporting center.
- Preserve evidence. Keep the original emails with full headers, invoices, account details, call logs and payment records. Do not delete anything.
- Secure compromised accounts. Reset passwords, revoke active sessions, remove suspicious inbox rules and forwarding addresses, review connected apps and enable MFA. Do it from a clean device.
- Notify the real vendor or executive. Warn them that their identity or mailbox may be compromised, and ask them to check their own systems.
- Inform your insurer. Check whether your cyber or crime insurance covers social engineering fraud, and notify the insurer promptly because policies have strict reporting timelines.
- Check for further compromise. Review whether the attacker accessed other accounts, sent messages to other contacts or exfiltrated data. Consider bringing in a digital forensics specialist.
- Consider legal and regulatory obligations. If personal data was exposed, you may have breach notification duties. Speak with legal counsel.
- Learn and improve. Once the immediate crisis is over, hold a review. Identify which control failed, update your procedures and train the team.
Do not blame the employee who processed the payment. In most cases the process had a gap, and the individual followed what looked like a legitimate instruction.
Special Advice for Vendors and Small Businesses
If you are a vendor
Your customers may be targeted using your name. Protect them, and yourself, by:
- Publishing a clear statement of how you communicate bank changes, such as “We never change bank details by email alone.”
- Using DMARC to protect your domain.
- Securing your own mailboxes with MFA.
- Telling customers whom to call to verify changes.
- Acting quickly if you learn that a customer received a fake invoice in your name.
If you are a small business
Small companies are attractive targets because they often have fewer controls and one person handling finance. You do not need an enterprise budget to improve.
- Turn on MFA for all email accounts today.
- Adopt a simple rule: never change bank details without a phone call to a known number.
- Involve a second person, even if that person is the owner or an outside bookkeeper, for any new payee.
- Use a bank account with transaction alerts and limits.
- Consider cyber insurance that covers funds-transfer fraud.
- Back up your processes in a short, written checklist.
The cost of these basics is tiny compared with a single lost payment.
Quick BEC Prevention Checklist
- Every bank detail change is verified by phone using a known number
- Two people approve new vendors and payments above a threshold
- MFA is enabled on every email account
- SPF, DKIM and DMARC are set up, with DMARC moving toward enforcement
- External email is clearly labeled
- Automatic forwarding to outside addresses is disabled or monitored
- Finance, HR and executive assistants receive BEC-specific training
- A written payment policy exists and is known to everyone
- Your bank’s emergency fraud contact is saved and accessible
- An incident response plan is ready and tested
Frequently Asked Questions
What is the difference between business email compromise and phishing?
Phishing is a broad technique used to steal credentials or deliver malware, often with mass messages. BEC is a targeted fraud that aims to trick a person into sending money or data. Phishing is often used as the first step in BEC, to take over the mailbox that is later used for the scam.
What is invoice fraud?
Invoice fraud is a type of BEC in which a criminal submits a fake invoice or alters a real one so that payment is sent to a fraudulent bank account. It may involve a hijacked vendor email account, a lookalike domain or a forged document.
How do scammers find the right invoice at the right time?
Usually by reading real email. After taking over a mailbox, they watch conversations for pending invoices, payment schedules and approvers, then step in at the moment a payment is due. Some also use information from earlier breaches or public contracts.
Can you get your money back after a BEC scam?
Sometimes, but speed is critical. If you report to your bank and law enforcement within the first hours, there is a better chance of freezing funds before they are moved out of the receiving account. After several days, recovery rates fall sharply. Never assume the money is lost until you have contacted the bank.
Does email security software stop BEC?
It helps but does not stop it completely. Many BEC messages contain no malware and may come from a genuine, compromised account. The most reliable protection combines email security, MFA, employee training and a strict payment verification process.
Are small businesses really targeted?
Yes. Criminals look for weak controls, not only for large bank balances. A small company with a single finance person and no verification rule can be easier to defraud than a large corporation.
Who is liable for a fraudulent payment, the buyer or the vendor?
It depends on the facts, contracts, jurisdiction and the controls each party had in place. In many cases the party that made the payment bears the loss, but disputes about negligence do happen. Consult a lawyer for advice on a specific situation. This article is general information and not legal advice.
Why do attackers target accounts payable?
Accounts payable staff have the authority to release money and handle large volumes of repetitive requests. A realistic invoice is more likely to be processed without question than in almost any other part of the company.
What should I do if I receive a suspicious payment request?
Do not reply to the email or use contact details in it. Call the supposed sender on a known phone number, tell your manager or security team and report the message. If it is part of a thread that looks genuine, treat the account as possibly compromised.
How can I tell if my own email account was used in a BEC attack?
Look for unexpected inbox rules, forwarding addresses, sent messages you do not recognize, unusual sign-in locations and complaints from contacts about odd emails. Reset your password, sign out all sessions, enable MFA and have IT or a security professional review the account.
Final Thoughts
Business email compromise is expensive, but it is also one of the most preventable types of fraud. The BEC scam succeeds not because attackers are unstoppable, but because many organizations still allow a payment to move on the strength of an email alone.
If you take only one action after reading this guide, make it this: never change payment details, and never release an unusual payment, without independent verification through a channel the sender does not control. Add multi-factor authentication, two-person approval and clear training, and you remove the conditions that invoice fraud depends on.
Criminals are patient and professional, but they are also lazy about one thing. They look for the easiest company to defraud. Make yours the one that picks up the phone and checks.
