Invoice & Business Email Fraud
In business email compromise (BEC), criminals pose as a supplier, customer, title company or the owner, and ask you to pay a real-looking invoice to a new bank account. Contractors, subcontractors and small offices are frequent targets because payments are large and often rushed.
- Office & payroll
- Contractors
- Small business
Common versions
- “We changed banks, please send future payments to this account”
- An email from the owner, on the road, asking for an urgent wire to close a deal
- A real invoice thread hijacked from a hacked supplier email, with new payment details
- Fake invoices for services you never ordered, like directory listings or domain renewals
- Closing or escrow emails with changed wiring instructions
Controls that stop it
- Verify every bank-detail change by phone, using a number already on file, not one in the email
- Require two people to approve new payees and large payments
- Match invoices to purchase orders or job records before paying
- Look closely at sender addresses for look-alike domains (rn vs. m, extra letters)
- Turn on two-factor authentication on business email. See Two-Factor Authentication
- Flag external emails and train staff to report suspicious requests
If you sent money to a scammer, act within hours. Call your bank and ask them to recall the wire, then file a complaint at IC3.gov. The faster you report, the better the chance the money can be frozen. See Reporting Cybercrime.
After an incident
- Contact your bank and the receiving bank’s fraud department.
- Report to IC3 and local police.
- Change email passwords and check for forwarding rules attackers often add.
- Warn the real supplier or customer that their email may be compromised.
- Talk to your insurer; some policies cover social engineering fraud.
Standards & references
Last updated: