Business email compromise: how to stop fake invoices

Sent a payment you now doubt? Call your bank now and ask it to recall the money, then report it at ic3.gov. The first hours matter most. What to do first

Most fraud aimed at a business doesn’t break anything. Business email compromise simply asks. An email that seems to come from a supplier, a boss or a title company asks for a payment, and someone who is trying to do their job sends it. To the bank, nothing looks wrong, because the business itself approved the transfer. That is why it is one of the costliest crimes the FBI tracks, and why the defenses that work are habits more than software.

What business email compromise is

In a BEC scam the goal is a payment or a piece of sensitive information, and the tool is trust in a familiar conversation. The FBI’s Internet Crime Complaint Center (IC3) now counts compromised phone numbers and video meeting apps in its definition too, not only email, because the same fraud has moved to those channels.

It differs from ordinary phishing in one important way: there is often nothing to click. No attachment, no strange link, just a plausible request from a name you know. It comes in three forms:

• A lookalike or spoofed address. A domain one letter off, a different ending, or a display name that hides the real address behind it.
• A taken-over account. The criminal has the real password, or a stolen sign-in token, and writes from inside the genuine mailbox.
• A hacked supplier. Often called vendor email compromise: the invoice comes from your supplier’s real address, in the real thread, with the real history, because the supplier’s mailbox is the one that was taken over.

How big the problem is

In 2025, IC3 received 24,768 complaints about business email compromise with $3,046,598,558 in reported losses. Only investment fraud, at $8.65 billion, cost victims more. Losses rose about 10 percent on 2024, according to the FBI’s 2025 Internet Crime Report.

Those are only the losses people reported to IC3 in one year. Taking the longer view, the FBI counted $55.5 billion in exposed losses across 305,033 BEC incidents worldwide between October 2013 and December 2023. “Exposed” means money taken plus money attempted, so that figure can’t be added to the yearly ones.

Almost all of it moves by bank transfer. Of the BEC complaints that named a payment method in 2025, 86 percent reported a wire or ACH transfer and 7 percent prepaid or gift cards. In the UK, banks reported £41.3 million lost to invoice and mandate scams in 2025, across 2,305 cases, and £5.6 million to CEO fraud, where the average loss per case was just over £28,000, the highest of any scam type in UK Finance’s Annual Fraud Report 2026.

How an attack unfolds

1. Research. Company websites, press releases and professional profiles show who approves payments, who the suppliers are and when the boss is travelling.
2. Access or imitation. A fake sign-in page captures a password, a phishing kit steals the sign-in token (the FBI warned in May 2026 of a kit that bypasses multi-factor authentication this way), or the criminal simply registers a lookalike domain.
3. Watching. Inside a mailbox, criminals add rules that quietly forward or hide any message containing words like “bank”, “payment”, “invoice”, “wire” or “check”. The FBI has warned that rules set in webmail may not show up in the desktop email app at all.
4. The ask. It arrives on time for a real event: an invoice that is really due, a closing date, a payroll run. It often carries a reason for the change (“our bank was audited”) and a reason for speed.
5. The money moves. Funds land in an account controlled by the criminals and are moved on quickly, often split across several accounts. Every hour makes them harder to stop.

Six patterns to know

A supplier’s “new bank details”

The classic. A real supplier, a real invoice, and a polite note that payments should now go to a different account. If the supplier’s own mailbox was hacked, the message is in the right thread and matches every earlier email.

The executive who needs a wire, or gift cards, now

A message from the chief executive, or a lawyer acting for them, about a confidential deal: send a transfer today and don’t discuss it. A smaller version asks an assistant to buy gift cards for “client gifts” and send the codes.

Payroll diversion

An “employee” asks HR to change where their pay is deposited. The FBI has also warned of criminals buying search ads that imitate employee self-service sites: staff log in to the fake page, and the criminal uses the stolen login to change the direct deposit.

Real estate closings

Home buyers receive wiring instructions that appear to come from their title company or agent. The FBI’s 2025 report describes a Missouri senior who was sent fake instructions for more than $1.3 million from a compromised title company account, and a city government office in Oregon whose bank recalled a $6 million wire because the account receiving it had already been flagged by an earlier report to the FBI.

The hijacked mailbox that writes from inside

When a supplier or customer is breached, the fraud can run for weeks: the criminal reads real threads and steps in only when money is about to move. Nothing about the sender looks wrong, which is why checking the sender is not enough.

Deepfake voices and video calls

In early 2024, an employee of the engineering firm Arup in Hong Kong made 15 transfers totalling HK$200 million, about US$26 million, after a video call in which the company’s UK-based chief financial officer and other colleagues were all deepfakes, built from public video and pre-recorded. No system was hacked: the call was enough. AI is not yet common in reports: 135 BEC complaints to IC3 in 2025 mentioned it, with $30.3 million in losses. But it is the reason a familiar voice or face can no longer confirm a payment on its own.

Red flags in a payment request

• Bank details change by email, especially close to a payment date.
• Urgency or secrecy: “today”, “confidential”, “I’m in a meeting, can’t talk”.
• The reply-to address differs from the sender, or the domain is one character off.
• The new account is in a different name, at a different bank, or in a different country from before.
• Anyone asks for payment in gift cards. No real supplier or executive does.
• The request asks you to skip the usual approval “just this once”.
• A familiar voice or face on a call insists on speed and won’t let you call back.

One more, which is easy to miss: the thread looks real because it is real. When a mailbox is compromised, the history, the signature and the tone will all be right. Treat the request itself, not the sender, as the thing to verify.

The controls that stop it

None of these needs special software. They work because they move the decision out of the email thread and onto a channel the criminal doesn’t control.

a number you already had

• Call back on a number you already had.Use the phone number from your contract, your records or the supplier’s official website, never one in the email or the invoice. The FBI’s own warning fits on a sticker: check, call a known number, wait.
• Require two people for any change to payee details.Dual control means one person requests the change and another approves it after verifying it, a practice payment bodies such as Nacha recommend.
• Hold the first payment to new details.Make it policy that money never goes to a new account until the call-back is done, however urgent the request sounds.
• Never act on email, voice or video alone.After Arup, a call is not proof either. Confirm through a second channel you started yourself.
• Use phishing-resistant sign-in.CISA calls phishing-resistant multi-factor authentication, such as security keys and passkeys, “the gold standard”. Codes sent by text or app can be relayed by a fake sign-in page.
• Block automatic forwarding to outside addresses.The FBI recommends it, along with keeping sign-in and mailbox-change logs for at least 90 days so you can see what happened if something does.
• Publish DMARC, and enforce it.SPF, DKIM and DMARC let receiving mail servers reject messages that fake your exact domain. Since February 2024, Google has required them of anyone sending 5,000 or more messages a day to personal Gmail accounts, and Yahoo of its bulk senders, but a policy of p=none only monitors. Move to quarantine or reject.
• Watch for lookalike domains.Register the obvious misspellings of your own domain, and treat any new domain that resembles a supplier’s as a warning.
• Train the people who pay.Accounts payable, payroll and executive assistants are the targets. Make it explicit that slowing down to verify is always the right call, including when the request appears to come from the top.

DMARC has limits worth knowing. It stops criminals from sending as your exact domain. It does nothing against a lookalike domain, and nothing when a supplier’s real mailbox has been taken over. That is why the call-back matters more than any setting.

If you have already paid

Speed is everything. Work through these in order, today:

1. Call your bank immediately. Ask it to recall the funds, and ask for the hold harmless letter or letter of indemnity that the FBI’s guidance mentions, so the receiving bank can return money. Ask your bank to contact the receiving bank directly.
2. Report it to IC3 at complaint.ic3.gov, whatever the amount, with the full transaction details: amounts, dates, both banks, account numbers and the reference. IC3 doesn’t take attachments, so keep the original emails and paste in their full headers.
3. Call your local FBI field office for a large or international transfer. Treasury’s FinCEN says it is most likely to interdict or recover funds when a fraudulent wire is reported to law enforcement within 72 hours.
4. Keep the evidence. Don’t delete the emails or the forwarding rules you find. Save the messages with headers, the invoice and the payment confirmation.
5. Lock the mailbox down properly. Changing the password is not enough: the FBI warned in September 2026 that access granted to a malicious app survives a password change. Sign out all sessions, remove unknown apps and forwarding rules, and check which devices are registered for sign-in. Microsoft publishes step-by-step guidance for Microsoft 365.
6. Warn the real supplier or customer by phone, on a known number. If their mailbox was the one compromised, others are being targeted too.
7. Ignore anyone offering to recover the money for a fee. IC3 says it will never contact you directly for information or money.

Can you get the money back?

Sometimes, and fast reporting is the biggest factor. In 2025 the FBI’s Recovery Asset Team ran its Financial Fraud Kill Chain on 3,900 incidents and froze $679 million of $1.16 billion in attempted theft, a 58 percent success rate, down from 66 percent in 2024. Frozen money isn’t yet returned money, but it is money that hasn’t disappeared.

Refund rights depend on who you are and where. In the United States, the consumer protections of Regulation E don’t cover business accounts, and they exclude wire transfers made through Fedwire and similar systems, so a business generally has no automatic right to a refund on a wire. In the UK, banks must reimburse authorised push payment fraud for individuals, microenterprises and charities on UK Faster Payments and CHAPS transfers made since 7 October 2024, up to £85,000 per claim, and report it within 13 months; in the first year, 88 percent of losses in scope were reimbursed. UK victims report to Report Fraud, which replaced Action Fraud in December 2025.

Sources

1. FBI Internet Crime Complaint Center, 2025 IC3 Annual Report, April 2026. BEC and investment fraud losses, payment methods, the Financial Fraud Kill Chain, real estate and AI cases.
2. FBI Internet Crime Complaint Center, 2024 IC3 Annual Report, April 2025, including the FBI’s “Check, Call, Wait” warning.
3. FBI, Business Email Compromise: The $55 Billion Scam, public service announcement, September 11, 2024.
4. FBI Internet Crime Complaint Center, Business Email Compromise, and IC3 frequently asked questions.
5. FBI, Private Industry Notification on email forwarding rules, November 2020.
6. FBI, Cyber criminals conduct business email compromise through exploitation of cloud-based email services, April 6, 2020.
7. FBI, Cyber criminals impersonate employee self-service websites using search engine ads, April 24, 2025.
8. FBI, Kali365 phishing-as-a-service targets Microsoft 365 users, May 21, 2026.
9. FBI, OAuth consent phishing, September 1, 2026.
10. FinCEN, Rapid Response Program fact sheet, April 15, 2026.
11. Hong Kong Free Press (AFP), Multinational loses HK$200 million to deepfake video conference scam, February 5, 2024.
12. The Guardian, UK engineering firm Arup falls victim to £20m deepfake scam, May 17, 2024.
13. CISA, Implementing phishing-resistant MFA, October 2022.
14. Google, Email sender guidelines, and Yahoo, Sender best practices.
15. Nacha, Business Email Compromise, Vendor Impersonation Fraud, and Payments, April 2019.
16. Microsoft Learn, Respond to a compromised email account.
17. Electronic Code of Federal Regulations, 12 CFR 1005.3 (Regulation E, coverage).
18. UK Finance, Annual Fraud Report 2026, June 2026.
19. Payment Systems Regulator, APP fraud reimbursement protections.
20. GOV.UK, Report Fraud: new service from City of London Police, December 2025.