Business email compromise and invoice fraud: how it works and how to stop it

Business email compromise is fraud by email. A criminal pretends to be someone you trust (a supplier, your boss, an employee, a lawyer, a title company) and asks for money or information. There is often no virus, no attachment and nothing for antivirus to catch. The email simply asks you to do something you do every week, with one detail changed.

The FBI's Internet Crime Complaint Center reports BEC year after year as one of the costliest cybercrimes it tracks. Small businesses are frequent targets because they move real money by wire and ACH, often with one person approving payments and no IT team watching the mail.

The criminal's email usually comes from one of three places:

• A spoofed address, where the display name says "Jane Smith, CEO" but the address behind it is a free webmail account, or the From line has been forged.
• A lookalike domain registered for the job: acme-supplies.co instead of acmesupplies.com, or a letter swapped (rn for m, a zero for an o). On a phone screen, these are very hard to spot.
• A real, compromised mailbox. The attacker has phished a password at your supplier, or at your own company, and is sending from the genuine account. This is the most convincing version, because the email sits in the real thread, quotes the real invoice and sounds like the real person.

Criminals who have been inside a mailbox for weeks know when invoices fall due, who approves them and how people sign off. Some now follow up with a phone call or voice message, and voices can be faked. The answer is the same in every case: verify through a channel the criminal does not control.

The money controls matter most, because they work even when the email is perfect.

1. Out-of-band verification. Any new payee, and any change to a supplier's or employee's bank details, gets confirmed by calling a number you already had: from the contract, a past invoice, or the supplier's website. Never use the number, link or contact in the email asking for the change. Write the rule down and tell suppliers you follow it; good ones will be glad.
2. Dual approval. Payments above a set amount, and every change of bank details, need a second person to sign off in your banking portal. Most business banking platforms support approval workflows; ask your bank to turn them on.
3. No exceptions for urgency or seniority. Tell staff in writing that the owner will never be annoyed by a verification call, and that no real request needs to bypass the rule. Scammers lean on urgency because it works.
4. Payroll changes in person or through the payroll system. Require employees to change direct deposit details themselves inside the payroll provider's portal (with MFA), not by emailing HR.

These make it harder for criminals to get into your mailboxes, or to pass themselves off as you.

• MFA on every mailbox. A compromised mailbox is the most dangerous version of BEC, and stolen passwords are how most mailboxes get compromised. Turn on MFA for every user in Microsoft 365 or Google Workspace, as covered in our small business checklist and our guide to two-factor authentication.
• Watch for mailbox rules and forwarding. Once inside, attackers often create inbox rules that forward copies of mail to an outside address, or move replies containing words like "invoice" or "payment" into an obscure folder so the real owner never sees them. Block automatic forwarding to external addresses unless you need it: in Microsoft 365 this is set in the Defender portal's outbound spam policy, and in Google Workspace it is a Gmail setting in the Admin console. Every few months, look at each user's rules (in Outlook, Settings > Mail > Rules; in Gmail, Settings > Filters and Blocked Addresses).
• SPF, DKIM and DMARC for your domain. These three DNS records tell other mail servers which servers may send email as your domain, and what to do with messages that fail the check. SPF lists your sending services, DKIM signs your mail, and DMARC sets the policy. Start DMARC at "p=none" with reports switched on, fix any legitimate senders that fail (your newsletter tool, your invoicing software), then move to "quarantine" and eventually "reject". Your email provider's help pages walk through the setup. This protects your customers and suppliers from fake email using your exact domain; it does not stop lookalike domains.
• External sender banners. Both Microsoft 365 and Google Workspace can flag messages that come from outside your organization. A banner on an email from "your CEO" is a strong hint that something is wrong.
• Short, regular training. Show staff real examples of the scams in the table above, and practice the call-back. Our guide to spotting phishing emails is a good handout.

Endpoint protection, the subject of our endpoint protection guide, matters for ransomware and malware, and can catch password-stealing software on a laptop. It is not the main defense against BEC, because most of these scams never touch your devices at all.

Speed matters more than anything else. Work through this in order, starting now.

1. Call your bank immediately. Use the fraud number on your card or the bank's website, not the email. Tell them the payment was fraudulent and ask them to recall the wire or ACH and to contact the receiving bank. The sooner the receiving bank hears, the better the chance the money is still there.
2. File a complaint at IC3.gov the same day. Include the amount, date, both banks and account numbers, and the emails. The FBI's Recovery Asset Team works with banks to try to freeze funds reported through IC3 complaints, and it can only help while the money has not been moved on. For a large loss, also call your local FBI field office.
3. Preserve the evidence. Keep the emails (with full headers), invoices, bank confirmations and any call records. Do not delete the compromised mailbox or the attacker's rules before taking screenshots; investigators and insurers will want them.
4. Secure the mailbox. If one of your accounts was used, reset the password, sign out all sessions, turn on MFA, and remove any forwarding rules or connected apps you did not set up.
5. Call your insurer. Check whether your cyber or crime policy covers social engineering or funds transfer fraud. Many policies require prompt notice.
6. Warn the people involved. Tell the real supplier or employee that their name was used. If the attacker came through their mailbox, they need to fix it before the next victim pays.

If customer or employee data was also exposed, our guide on what to do after a data breach covers the next steps.