Business email compromise payment fraud is a scam where a criminal uses a hijacked or imitated email account to redirect a real payment, usually by sending new bank details for a supplier or an urgent request from an executive. The business pays a genuine obligation into the wrong account. Speed matters most afterwards: call your bank first.
What is business email compromise payment fraud?
Business email compromise payment fraud is the redirection of a legitimate payment through a fake or taken-over email conversation. The FBI's Internet Crime Complaint Center describes business email compromise as a scam targeting a transfer of funds, often carried out after a real business email account is compromised through social engineering or intrusion.
What makes it different from most fraud is that nobody inside needs to steal anything. The invoice is real, the amount is right and the staff member who pays it is doing their job. The one false fact is the destination account. That is why the loss often goes unnoticed until the real supplier asks why it has not been paid.
There are two main versions. In the first, the criminal poses as a supplier and asks for future payments to go to a new account. In the second, the criminal poses as a senior person inside the business and asks for an urgent, confidential transfer. Both rely on a message that looks routine to the person who acts on it.
Why email is the weak point
Payment details travel by email in most small and mid-sized businesses. A supplier sends an invoice as a PDF, and bank details sit at the bottom of it. Anyone who can read or imitate that thread can change one line. The payment system then does exactly what it is told.
What do business email compromise payment requests look like?
Business email compromise payment requests look ordinary, which is the point. They usually arrive in an existing thread, cite a real invoice and ask for one change. The warning signs are in the details: a new account, pressure to act fast, a reason not to call, and a sender address that is close to the real one.
Read for these features:
- A change of bank details, especially to a bank in a different country or region from the supplier's usual one, or to an account held in a name that is not the supplier's.
- Urgency with a reason. An audit, a year end, a blocked account or a late penalty. The reason is there to stop you checking.
- A request for secrecy. "Keep this between us until the deal is announced" is a classic executive impersonation line.
- Small differences in the sender. One letter changed in the domain, a reply-to address that differs from the from address, or a display name on a free email account.
- A change in tone or timing. A supplier who always writes formally suddenly writes in short lines, or a message arrives outside the sender's working hours.
- A follow-up that discourages a call. "I'm in meetings all day, email only" is a reason to call.
A message can show none of these and still be fraud. When the criminal is inside the real mailbox, the address is genuine and the thread history is real. The only reliable test is to confirm the request through a channel the email did not supply.
Changed vendor bank details in a business email compromise
A vendor bank-detail change is the most common route for business email compromise payment fraud, because it turns every future payment to that supplier into a loss. The criminal sends a letter or email announcing new account details, and the payables team updates the vendor record. The defense is a phone call to a number already on file.
An example timeline
The sequence below is an example with made-up names and amounts.
| Day | What happens | What the business sees |
|---|---|---|
| 1 | A criminal gains access to the email account of a supplier, Example Packaging. | Nothing. |
| 8 | The criminal reads invoice threads and learns that a 48,200.00 invoice is due on day 20. | Nothing. |
| 15 | From the real mailbox, the criminal sends a letter on the supplier's letterhead: the bank account has changed. | A routine admin message from a known contact. |
| 16 | The payables clerk updates the vendor master file. | A changed vendor record. |
| 20 | The business wires 48,200.00 to the new account. | A normal payment run. |
| 34 | Example Packaging chases the overdue invoice. | The first sign of loss, two weeks after the wire. |
Verifying the change
Call the supplier on a phone number from your own records, such as the original contract or an earlier invoice. Do not use a number in the change request. Ask a person you have dealt with before to confirm the new account details aloud. Then have someone other than the person who took the call approve the change in the vendor file. Keep a note of who called whom and when.
First hours after a business email compromise wire leaves
The first hours after a business email compromise wire leaves decide how much can be recovered. The FBI's guidance is to contact the originating bank as soon as the fraud is recognized, ask for a recall or reversal, and file a detailed complaint with IC3 that includes the banking information. Everything else can follow those two steps.
A step list for those hours, with who usually does each step:
- Call the bank that sent the wire. The treasury lead or owner calls the fraud or wire department, not a branch, and asks for a recall of the payment. Have the amount, date, beneficiary account and reference ready.
- Ask the bank to contact the receiving bank. The sending bank can ask the beneficiary's bank to freeze the funds. Ask what documents the bank needs from you, such as an indemnity or hold harmless letter.
- File with IC3. File a complaint at the FBI's Internet Crime Complaint Center with all banking details filled in, as the IC3 business email compromise page asks.
- Stop further payments to that account. The payables team checks for any other scheduled payments to the changed details and freezes the vendor record.
- Preserve the emails. IT keeps the full messages with their headers, not screenshots. Do not delete the thread or the criminal's mail rules.
- Secure the mailbox. Reset passwords, end active sessions and turn on multi-factor sign-in for the affected accounts. Check for forwarding rules that copy mail elsewhere.
- Tell the real supplier. Phone them on a known number. Their mailbox may be the compromised one, and other customers may be next.
- Call your insurer. Many policies have notice deadlines.
Write down the time of each call and the name of each person you spoke to. The timeline will be needed by the bank, the police and the insurer.
How business email compromise shows in the bank statement and payables ledger
Business email compromise shows in the records as a payment that looks correct in the ledger and wrong only when you read the beneficiary details. The bank statement shows the wire with the amount you expected. The payables ledger shows the invoice as paid. The supplier's own statement still shows it open.
That three-way disagreement is the clearest trace, so reconcile supplier statements, not only the bank. For each large payment in the period, compare:
- the beneficiary name and account on the wire confirmation with the vendor master file before the change;
- the invoice marked paid in your ledger with the supplier's statement of open items;
- the date the vendor record was last edited with the date of the payment.
A changed vendor record shortly before a large payment is worth a call even if nobody has complained. Sometimes the criminal asks for only part of an invoice to go to the new account, or a supplier receives a short payment and the balance is diverted. Those leave partly paid invoices that never close, and the method for tracing them is in how to reconcile partial payments against open invoices.
A reconciliation tool will not spot a fraudulent account number, because the payment is genuine on the statement. What it can do is make the comparison quick. PreciseBankFlow matches statement lines to your ledger and lists what does not clear, so a supplier's unpaid invoice that your books show as paid stands out sooner.
When a business email compromise loss may be an insider instead
A business email compromise story usually fits the evidence: an external email, a changed account, a single large payment. When it does not fit, consider that someone inside used the story as cover. Repeated "scam" losses, a new account in a person's own name, or changes made without any email at all point toward embezzlement rather than outside fraud.
Questions that separate the two:
- Is there an email at all? If the change request cannot be produced, with headers, the story is weak.
- Whose name is on the receiving account? A criminal's account usually sits under a business name or a third party. An account that traces back to an employee or a relative is a different case.
- Has it happened before? Two or three separate "scams" handled by the same person is unusual.
- Who changed the vendor record? If the person who changed it also approved and released the payment, controls failed regardless of who wrote the email.
If the answers point inward, the broader warning signs are covered in the signs of embezzlement to look for in the books, and the pattern for a trusted finance employee is in how bookkeeper embezzlement happens and is found. Handle the evidence carefully in either case, and keep the person under suspicion away from the records.
Payment callback controls against business email compromise
Payment callback controls are the main defense against business email compromise: any new or changed bank detail, and any unusual payment request, is confirmed by phone on a number already on file before money moves. Pair that with a second approver who did not take the call, and most redirection attempts fail at the first step.
A control set that suits a small finance team:
- Callback on every bank-detail change, using a number from the contract or the vendor file, never from the request.
- A waiting period of a few days between changing a vendor's bank details and the first payment to them, with a note to the supplier's known contact.
- Two people to change a vendor record and release a payment, and they are not the same pair every time.
- No exceptions for urgency or secrecy. Write it down so staff can point to it when a "director" pushes.
- Multi-factor sign-in on email and banking, and alerts when mail rules or forwarding are added.
- A monthly review of every vendor record changed in the period, matched to the callback log.
These controls cost a phone call and a little time. The loss they prevent is usually a whole invoice, and sometimes several.