Business email compromise and fake invoice scams: how to stop paying the wrong account

What business email compromise is

Business email compromise (BEC) is a scam in which a criminal uses email to impersonate someone you trust, such as a supplier, your boss, a client, a lawyer or a property agent, and tricks you into sending money or sensitive information. The FBI’s Internet Crime Complaint Center (IC3) counts it as one of the costliest types of cybercrime, because the payments are large and the criminal needs no malware at all.

In its 2024 report, IC3 recorded 859,532 complaints across all cybercrime types and about US$16.6 billion in reported losses overall. Business email compromise accounted for about US$2.77 billion of that, according to coverage of the report by CyberScoop and CertifID. These numbers cover only what people reported, so the real total is higher.

The name is misleading. It affects individuals as well as businesses. Home buyers, tenants, charities, schools and families are targeted in the same way.

The most common versions

• Fake invoice. An email arrives with an invoice that looks like it came from a real supplier, with a bank account that belongs to the criminal.
• Change of bank details. A message that appears to come from a supplier or landlord says: “Our bank has changed, please pay the new account from now on.” The next genuine payment goes to the criminal.
• The “boss” request. A message that seems to come from a director or manager says: “I am in a meeting. Can you buy gift cards, or make a quick payment? Keep it between us.”
• Property and legal payments. Criminals who have read a real exchange between a buyer and a conveyancer or agent send fake transfer details just before settlement, when a large amount is about to move.
• Payroll diversion. “I have a new bank, please update my pay details.” The email looks like it is from an employee.
• Account takeover. The email is real. It comes from a genuine, hacked account, so the sender’s address is correct and the thread is real. This is the hardest to spot.

How the criminals do it

There are two broad methods, and the second is more dangerous.

1. Spoofing or lookalikes. They register a web address very close to a real one (for example, one letter swapped, or “-pay” added) or fake the sender’s display name. The message looks right at a glance. Our link safety checker flags lookalike names.
2. Breaking into a real mailbox. Using a stolen password from a phishing email or a data breach, they log in to someone’s email. They read for days or weeks, learn who pays whom and when, and then insert themselves into a real conversation at the right moment. Often they set a hidden rule to forward or hide replies. See our guide to securing your email for the settings to check.

In both cases the aim is the same: to make a change to where the money goes, at a moment when you are busy and the request looks like routine.

Warning signs

• A change in bank details, especially one that is sudden, urgent or secret.
• Pressure to pay today, or to avoid phoning “because I am travelling”.
• The sender’s address or domain is slightly different, or the reply-to address is not the one you expected.
• Unusual tone or wording, odd grammar or a request that does not match how this person normally writes.
• A request to use gift cards, cryptocurrency or a personal account.
• New bank details that belong to a different name, a different bank or a different country from the supplier.

The call-back habit that stops it

One habit beats nearly all of these scams: confirm any change of payment details by phone, using a number you already had before the email arrived. Not the number in the email. Not a number on the new invoice.

1. Pause. Treat any request to change bank details as a security event, not routine admin.
2. Verify through a separate channel. Phone the supplier or colleague on a number from your own records, a previous genuine invoice or the company’s official website.
3. Confirm the details out loud. Read the new account details to them and ask them to confirm.
4. Use two people. For new payees or large payments, require a second person to check and approve.
5. Make a test payment first if the amount is large and the account is new, and confirm that the right person received it.
6. Never rely on the email thread. If the account may be hacked, the thread cannot be trusted.

For families buying a home or paying a builder, the same rule applies: ask the professional for the bank details in person or by phone at the start, and be suspicious of any later “update”. CertifID, a company that sells fraud protection for property payments, advises not relying on unencrypted email for wiring instructions and verifying bank details yourself.

An illustrative example

This is a made-up scenario to show how smoothly the trick can run. It is not a real case.

A small building firm is paying a supplier for materials. The accounts person, Sam, has paid this supplier several times. A criminal has been reading the supplier’s hacked email for two weeks, and has seen the invoices go back and forth. On the day the next invoice is due, a message arrives in the same email thread: “Hi Sam, we have changed banks. Please use the new details on the attached invoice for this payment. Thanks.” The sender’s address is the real one, because the account has been taken over. The invoice looks the same, with a different account number.

Sam is busy and the request looks routine, so he updates the payee and pays. The supplier chases the payment a week later, and the money is already gone. Nothing was hacked at Sam’s end. A single call to the supplier’s known number before changing the payee would have exposed it in two minutes.

Rules a small business can adopt today

1. A written rule: bank-detail changes are never accepted by email alone. Anyone can follow it, including new staff.
2. Two sets of eyes: the person who sets up a payee is not the person who approves the payment.
3. A verified contact list: keep supplier phone numbers in a separate record that you trust, not copied from invoices.
4. Two-factor authentication on every mailbox, especially finance and owners. Our two-factor walkthrough shows how.
5. Banking limits and alerts: set daily payment limits, and turn on alerts for new payees.
6. Make it easy to say no: staff should feel safe stopping a payment and checking, even when a senior person is “in a hurry”.
7. Practise once: send a harmless fake bank-change request to staff, and see who phones to check.

If you have paid the wrong account

Speed matters more than anything else. CertifID says victims often have around a day to freeze funds and that the window may be shrinking. That figure is from a company in the business, not an official number, but it matches the common advice from banks: call immediately.

1. Call your bank at once. Use the number on your card or the bank’s website. Ask the fraud team to recall the payment and contact the receiving bank.
2. Keep everything. Emails (with full headers if you can), invoices, screenshots and payment receipts.
3. Report it. In the US, report to IC3 (ic3.gov). Elsewhere, use your national cybercrime or fraud agency; our Report a Scam page lists them.
4. Secure your email and your supplier’s. Change the password, turn on two-factor authentication, check for forwarding rules, and tell the real supplier or colleague that their account may be compromised.
5. Warn other contacts. The criminal may be sending the same trick to everyone in the mailbox.

Sources

• CyberScoop: FBI IC3 2024 cybercrime report, key statistics and trendsAccessed October 12, 2026
• CertifID: Breaking down the 2024 FBI IC3 Cybercrime ReportAccessed October 12, 2026

Published October 12, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.