The FBI calls it "business email compromise" (BEC). It's been the most costly type of cybercrime for years running, and small businesses get hit harder than anyone because they often don't have the verification procedures that larger companies do.

The scam is simple: someone sends an email that looks like it's from a trusted person — your boss, your accountant, a vendor you work with — asking you to send money somewhere. The email looks legitimate. The request sounds plausible. And if you don't catch it in time, the money is gone.

How It Usually Works

The setup: Attackers do their homework. They find out who runs the company, who handles payments, who the vendors are. Sometimes they've actually broken into someone's email and are reading the conversations. Sometimes they just piece it together from LinkedIn, the company website, and public records.

The ask: The email comes from what looks like a trusted address. Common scenarios:

  • "Hey, I'm in a meeting but I need you to wire $8,000 to this account for a vendor payment. Can you handle it? I'll explain later." — appearing to come from the owner
  • "Our bank account has changed. Please update your records and send future payments to this new account." — appearing to come from a vendor
  • "Attached is the invoice for the project we discussed. Payment is due by Friday." — appearing to come from a contractor

The trick: The email address is slightly off — maybe one letter different, or using a domain that looks similar. Or the attacker has actually compromised the real email account and is sending from inside it. Either way, the email looks real enough that busy people don't catch it.

Why It Works

This scam doesn't rely on malware or technical exploits. It relies on trust and urgency. The attacker is betting that:

  • You trust emails from familiar names
  • You're too busy to verify every request
  • You don't want to bother the boss with "did you really send this?"
  • The request seems routine enough that it doesn't trigger suspicion

And they're usually right. That's why BEC scams succeed far more often than they should.

How to Protect Your Business

Verify payment requests by phone. Any request to send money, change bank account information, or update payment details gets a phone call to confirm — using a number you already have on file, not a number from the email. This one rule stops most BEC scams cold.

Check the email address carefully. "[email protected]" and "[email protected]" look almost identical at a glance. Hover over the sender name to see the actual address. If it's even slightly off, stop.

Be suspicious of urgency. "I need this done before end of day" or "I'm in a meeting and can't talk" are designed to make you skip verification. Real emergencies can wait for a two-minute phone call.

Use two-factor authentication on email. If an attacker can't get into your email account, they can't send scam emails as you. We wrote about 2FA here — it's the single most important security upgrade you can make.

Train your team. Everyone who handles money or has access to financial systems needs to know this scam exists. The person most likely to get targeted is the bookkeeper, office manager, or accounts payable person — not the IT department.

What to Do If You Get Hit

If you realize you've sent money to a scammer:

  1. Call your bank immediately. If the wire hasn't fully processed, they may be able to recall it. Speed matters — you have hours, not days.
  2. Report it to the FBI's IC3 at ic3.gov. They track these crimes and occasionally recover funds.
  3. Document everything. Save the emails, note the timeline, record who you talked to. You'll need this for insurance claims and law enforcement.
  4. Check for compromise. If the scam email came from a real account (yours or a vendor's), that account has been hacked. Change passwords and enable 2FA immediately.
The One Rule That Matters Never change payment information or send money based solely on an email. Always verify by phone using a number you already have — not one provided in the email.

It's Not About Being Gullible

Smart, careful people fall for these scams every day. The emails are well-crafted, the timing is calculated, and the requests are designed to seem routine. The defense isn't "be smarter" — it's "have a verification process and follow it every time."