One convincing email about changed bank details can cost a small business a whole payment. The defense is mostly process, not technology.
TL;DR
- Business email compromise uses fake or hijacked email accounts to redirect payments.
- The FBI received 21,442 complaints about it in 2024, with reported losses of about $2.77 billion.
- Confirm any change to payment details by phone, using a number you already have.
- If money was sent, contact your bank immediately and file a complaint at IC3.gov.
Business email compromise, often shortened to BEC, is a scam in which a criminal poses as someone the victim trusts, such as a supplier, a manager or a title company, and asks for money to be sent somewhere new.
How big is the problem?
In its 2024 Internet Crime Report, the FBI’s Internet Crime Complaint Center (IC3) recorded 21,442 business email compromise complaints with adjusted losses of about $2.77 billion. Only investment fraud caused larger reported losses that year.
How does the scam usually work?
- The setup. The scammer either breaks into a real email account or creates a lookalike address, such as one letter different from a supplier’s domain.
- The story. An email arrives saying the supplier has changed banks, an invoice needs paying urgently, or the boss needs gift cards for a client before a meeting.
- The pressure. The message stresses urgency and secrecy, so the person paying doesn’t stop to check.
- The payment. Money goes to an account the criminal controls and is often moved on quickly.
Which checks stop most attempts?
- Call to confirm any change in payment details, using a phone number from your own records, not one from the email.
- Require two people to approve new payees or changed bank details.
- Slow down urgent requests. A real supplier will understand a quick verification call.
- Look closely at the sender’s address, not just the display name, especially on replies in a long thread.
- Turn on multi-factor authentication for every email account, so a stolen password can’t be used to send messages from a real address. See how to lock down your email account.
Tip
Write your verification rule down and tell your suppliers about it: “We confirm all bank detail changes by phone.” It makes the check routine instead of awkward.
What should you do if money was sent?
Act fast. Contact your bank right away and ask it to try to recall or freeze the transfer. Then file a complaint at IC3.gov with as much detail as you can, including the emails, account numbers and amounts. Change the passwords on any account that may have been compromised, and check the email settings for rules the attacker may have added, as explained in what to do if your email is hacked.
Many BEC emails start as ordinary phishing, so it’s worth knowing how to spot a phishing email too.
Quick answers
Q: Does business email compromise only affect big companies?
A: No. Small businesses, nonprofits, schools and individuals are targeted too, including home buyers who receive fake wiring instructions before closing.
Q: Will antivirus software stop it?
A: Not on its own. These scams often contain no malware at all, only a convincing request. Clear payment procedures are the main defense.
Q: Can a sent wire transfer be recovered?
A: Sometimes, if the bank acts quickly. That’s why contacting your bank and filing at IC3.gov as soon as possible matters.
Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.
