Business email compromise (often called invoice fraud) rarely involves malware. Instead, criminals impersonate someone you already pay and convince your team to send money to a new account. It’s one of the most expensive forms of cybercrime because the payments are real and often hard to recover.
How it usually works
- A vendor’s mailbox gets hacked, and attackers quietly watch real conversations about invoices and payment dates.
- Or they register a lookalike domain (one letter different from your vendor’s) and reply inside an existing email thread.
- At the right moment, they send “updated” bank details, often with a reason like an audit, a bank change, or a past-due balance.
Because the emails reference real invoices, amounts, and people, they look completely legitimate.
Red flags
- Any request to change bank account or remittance details
- Pressure to pay today, or instructions to keep the change quiet
- A slightly different email address or a reply-to address that doesn’t match
- Unusual grammar or tone from someone you know well
The one rule that stops it: verify every payment change by calling the vendor at a phone number you already have on file, never one included in the email.
Controls worth putting in place
- A written callback policy for any change to payment details
- Two-person approval for new payees and bank changes
- Multi-factor authentication on every mailbox, so your own accounts can’t be used against your customers
- External-sender warnings on emails from outside your company
- Monitoring for suspicious mailbox rules, which attackers use to hide replies
If money has already been sent
Call your bank immediately and ask them to recall the transfer: speed matters. Report the incident to the FBI’s Internet Crime Complaint Center (IC3), and contact your IT provider to find out how the attackers got in.