Business Email Compromise: How Small Businesses Lose Money to Fake Invoices and Wire Fraud

The email looks completely normal. It comes from a vendor you’ve paid for years, in the same thread as last month’s invoice, with a short note: “We’ve changed banks, please use the account below going forward.” Your bookkeeper updates the payment details, the invoice gets paid, and nobody notices anything until the real vendor calls asking where their money is.

That’s business email compromise (BEC). It has no virus, no suspicious attachment, and often no link at all. It’s simply a believable request to send money somewhere it shouldn’t go. This guide covers how the scam works, the one business rule that stops most of it, and what to do in the first hour if your business already paid.

Key Takeaways

• In 2025, the FBI received 24,768 BEC complaints, with reported losses of more than $3 billion.
• The control that saves the money is a process, not a product: verify any payment change by phone, using a number you already have.
• If you’ve already sent the money, call your bank’s fraud line right away. Speed decides whether you get it back.

What Is Business Email Compromise?

Business email compromise is a scam where criminals pose as someone you trust, by email or text, to get your business to send money or sensitive information. In its 2025 Internet Crime Report, the FBI counted 24,768 BEC complaints and $3.05 billion in reported losses, up from $2.77 billion in 2024. That makes it the second most costly crime type the FBI tracks. Closer to home, Coloradans filed 18,847 internet crime complaints with the FBI in 2025, reporting $355 million in losses across all scam types.

Most BEC attempts fall into a few patterns:

• Fake invoices or “new bank details” from a vendor. Often sent from the vendor’s real, hacked mailbox, so it lands inside a real conversation.
• Owner or executive impersonation. “I’m in a meeting, I need this wire sent before 3:00, don’t call.”
• Payroll diversion. An “employee” asks HR to switch their direct deposit to a new account.
• Gift card requests. A message that appears to come from the boss asks someone to buy gift cards for a client and send the codes.

If you’ve read our overview of phishing and small business email security, BEC is the variant that does the most financial damage. It’s also the one email filters catch least often, because there’s nothing technically malicious to catch.

Why Does BEC Fool Smart, Careful People?

In 2025, the FBI found businesses lost more than $30 million to BEC scams that used AI, including AI-written emails and cloned voices. But most BEC doesn’t need AI at all. It works because it borrows trust that already exists. An attacker inside a real mailbox reads old emails, learns who pays whom, and waits for the right moment.

Three things make it convincing:

• Real threads and lookalike domains. The message is either from the real account or from a domain that’s one letter off (acmesupp1y.com instead of acmesupply.com), which is nearly impossible to spot on a phone.
• Urgency and authority. The request comes from the owner or a key vendor, and it’s due today.
• Hidden inbox rules. Once inside a mailbox, attackers often create rules that quietly move or delete replies, so the real vendor’s “we never sent that” message never gets seen. Microsoft’s guidance on compromised accounts lists suspicious inbox and forwarding rules as one of the main signs a mailbox has been taken over.

And with cloned voices in the mix, “it sounded just like him” no longer proves anything. This isn’t a careless-employee problem. The people who fall for BEC are usually the ones doing their job quickly and well.

How Do You Prevent Business Email Compromise?

The most effective defense against BEC wire fraud is a simple business rule: never change payment details or send an unusual payment based on an email alone. The FBI’s own guidance for BEC victims says the same thing: never make payment changes without verifying with the intended recipient.

Here’s what that looks like as an office policy you could adopt today:

1. Call back on a known number. Confirm any change to bank details, routing numbers, or payment method by phone. Use the number on file or from a past invoice. Never use the one in the email.
2. Two people for big payments. Set a dollar threshold, say $5,000, above which a second person approves the payment.
3. Same rule for payroll. Confirm direct deposit changes with the employee, in person or by phone.
4. Urgency is a reason to slow down. Tell your team, in writing, that no one will ever get in trouble for pausing a payment to verify it. Including you.
5. No gift cards by email request. Ever. Real bosses and real clients don’t pay in gift card codes.

Why does this work when technology alone doesn’t? Because a phone call to a number the attacker doesn’t control breaks the scam completely. Even if the email came from a real, compromised mailbox, the real vendor on the other end of the call will say “we didn’t change anything.”

What Technology Makes BEC Harder to Pull Off?

In 2025, phishing and spoofing was the most-reported crime type in the FBI’s Internet Crime Report, with 191,561 complaints. That’s usually how attackers get into a mailbox in the first place. The right settings lower those odds, and most are already included in Microsoft 365 or Google Workspace. They just have to be turned on and checked.

• MFA on every mailbox. Mailbox takeovers usually start with a stolen password. Multi-factor authentication means a stolen password alone isn’t enough to get in. It has to cover every account, including old ones nobody uses anymore.
• Email authentication on your domain. SPF, DKIM, and DMARC make it much harder for someone to send email that appears to come from your exact domain. Our guide to email authentication for small businesses walks through it.
• External sender warnings. A banner that says “this message came from outside your organization” makes a fake “owner” email stand out.

Two more settings close the gaps attackers count on. Alerts on new forwarding and inbox rules tell you the same day if someone starts hiding or copying a mailbox’s mail. Prompt offboarding shuts down former employees’ mailboxes, which often keep receiving invoices behind an old password. None of these replace the callback rule. They make it less likely you’ll ever need it.

What Should You Do If You Already Sent the Money?

Act within the hour. In 2025, the FBI’s Recovery Asset Team froze $679 million in stolen funds through its Financial Fraud Kill Chain. In this process, the FBI works directly with banks to freeze the receiving account before the money moves again. For transfers to U.S. accounts, it froze 61% of reported losses. That only works if the report comes in fast.

1. Call your bank’s fraud line now. Don’t email. Tell them it’s a fraudulent wire or ACH and ask for a recall or reversal.
2. File a complaint at ic3.gov. Include full banking details for both accounts. The FBI uses them to contact the receiving bank.
3. Lock down the mailbox. Reset the password, sign the account out of all sessions, confirm MFA is on, and remove any inbox or forwarding rules you didn’t create.
4. Warn the other party through a known channel. Call the vendor or customer. If your mailbox was compromised, your customers may be getting fake invoices from you right now.
5. Call your cyber insurer. Many policies cover funds transfer or social engineering fraud under a separate, smaller limit. Most also require prompt notice.

If the attacker was inside your systems, the response goes beyond the payment. Our guide on what to do after a cyberattack covers the broader steps. Our post on cyber insurance requirements for Colorado businesses explains the state’s 30-day notification clock if customer data was exposed.

Is Your Business Set Up to Catch This?

Most businesses we talk to have never written down a payment verification rule, and very few have looked at the inbox rules in their own mailboxes. Does MFA cover every account? Would anyone notice a new forwarding rule? Would your team pause on a “new bank details” email? If you’re not sure, a short conversation is an easy way to find out where you stand. Reach out to Engel Tech and we’ll take a look.

Frequently Asked Questions

What is business email compromise in simple terms?

It’s a scam where a criminal pretends to be someone you trust, like a vendor, your boss, or an employee, to get you to send money or change payment details. It usually arrives as an ordinary-looking email with no virus or link, which is why spam filters often miss it.

How do I know if a vendor’s email has been hacked?

You often can’t tell from the email itself, because it may come from the vendor’s real account. Treat any request to change bank details as suspicious by default, and confirm it by calling the vendor at a number you already have on file.

Can I get my money back after a wire fraud scam?

Sometimes, if you move fast. Call your bank’s fraud department immediately to request a recall, and file a report at ic3.gov with the full banking details. In 2025, the FBI’s Recovery Asset Team froze about 58% of the funds it tried to stop, and speed is the biggest factor.

Does Microsoft 365 or Google Workspace protect against BEC?

Both include tools that help, like MFA, email authentication, external sender warnings, and alerts on suspicious inbox rules. But many of these have to be configured, and none of them can stop an employee from paying a convincing fake invoice. A payment verification policy covers that gap.

Does cyber insurance cover business email compromise?

Many policies do, but often under a separate “social engineering” or “funds transfer fraud” limit that may be much lower than the main coverage. Some policies also require proof that you had verification procedures in place. Check your policy before you need it.

Who is responsible if we pay a fake invoice?

It depends on the contracts and whose mailbox was compromised, and it often ends up as a dispute between the two businesses. That’s another reason to verify payment changes by phone: it protects you whether the breach happened on your side or the vendor’s.