Business email compromise: how small firms get tricked

A small firm gets an email from a supplier: “Our bank details have changed. Please pay the new account.” The email looks right. The logo is right. The invoice is right. You pay. The supplier never gets the money.

This is business email compromise, or BEC. It is one of the costliest online crimes, and it hits small firms as often as big ones.

What is business email compromise?

Business email compromise is a scam that tricks a business into sending money to a criminal. The FBI’s 2025 Internet Crime Report defines it as a scam that targets businesses and people who regularly pay by wire transfer. Criminals get in by taking over email accounts and other ways to talk, such as phone numbers and virtual meeting apps.

There is often no virus and no bad link. There is only a believable message and a deadline.

How big is business email compromise?

In 2025, people reported 24,768 BEC complaints to the FBI, with about $3.05 billion in reported losses. Only investment fraud had higher losses that year. Those are the numbers people reported, so the real total is likely higher.

The same report says businesses reported over $30 million in losses from BEC scams involving AI in 2025. Criminals use AI tools to write more believable emails and to fake voices. See our post on deepfake CEO fraud and finance teams.

What are the common BEC scams?

Most BEC scams follow four stories.

1. The supplier bank change. A vendor “changes” their account details.
2. The boss in a hurry. The “CEO” asks finance for an urgent transfer or gift cards.
3. The payroll switch. An “employee” asks HR to send their salary to a new account.
4. The hijacked thread. A real email chain is taken over and a fake invoice is slipped in.

What are the warning signs of BEC?

Watch for six signs. Any one of them is a reason to stop and check.

• A change to bank details that nobody expected.
• A rush: “pay today” or “keep this quiet.”
• A sender address that is one letter off, or a reply-to that is different.
• A request to skip the usual approval.
• Pressure to act while the boss is “in a meeting” and cannot be called.
• A new account in a different bank or country.

What is the one rule that stops most BEC?

Any change to bank details, or any new payment over a set amount, gets a phone call to a number we already have, and a second person approves.

That is it. The FBI’s own advice says to verify requests to change account information through a secondary channel, check that sender addresses match the real organisation, and use a unique password for every service.

How do I set up a safe payment routine?

A safe routine is a short list that every person follows the same way every time.

1. Keep a list of vendors with phone numbers you collected in person.
2. Never take the phone number from the email.
3. Two people for every new payee or changed account.
4. A short pause, like 24 hours, for large new payments.
5. Turn on multi-factor authentication on email. See CISA’s guide.

A worked example

Your office manager, Dana, gets an email from “Ace Supplies”: “We moved banks. Pay invoice 4471 to the new account below.”

Dana does not reply to that email. She looks up Ace Supplies in the vendor list and calls the number saved from last year. The real accounts person says, “We did not change anything.” Dana forwards the email to IT and marks it as fraud.

Total cost: five minutes. That is the whole defense.

What if we already paid?

Time matters most. The FBI says that if you find a fraudulent transfer, contact your bank right away and ask for a recall of the funds.

1. Call your bank right now. Ask it to recall the funds and ask what forms it needs.
2. File a complaint at ic3.gov, whatever the amount. The FBI says IC3 may help banks and law enforcement freeze funds.
3. Change passwords on the affected email, and check for forwarding rules.
4. Tell your team what it looked like.

In 2025, the FBI’s recovery team handled 3,900 freeze requests covering about $1.16 billion in attempted theft, and reported about $679 million frozen. That is a 58 percent success rate, according to the same report. Fast calls help.

How do I train the people who touch money?

Finance, HR and the owner’s assistant are the main targets. Give them a short lesson and a practice test. Our Finance and Payments track covers invoice fraud, and the phishing simulation program includes a vendor bank-change scenario. Start with a free phishing risk test.

If someone does click a bad link, send them to what to do after you click a phishing link. Insurers also ask about payment controls, so see cyber insurance and staff training.