The email looks normal because, often, it is. It came from a real mailbox that someone else now controls.
Business email compromise (BEC) tricks staff into sending money by impersonating a supplier, colleague or executive by email. In accounts payable it usually arrives as a bank detail change or an urgent payment request. The defence is process rather than spotting typos: verify every change through a channel you already trust, and never let one person both approve and release a payment.
The FBI's Internet Crime Complaint Center (IC3) reported close to $2.8 billion in business email compromise losses in 2024, from 21,442 complaints, which put BEC second on its list by dollar losses. Over 2022 to 2024 the reported total was nearly $8.5 billion. Those are only the cases reported to the FBI.
An email that appears to come from a real supplier says their bank details have changed. It may come from a lookalike domain one character off from the real one, or from the supplier's genuine mailbox after it was compromised. The invoices are real; only the bank account is not.
A message that appears to come from a director asks for an urgent, confidential payment, often late on a Friday or while they are travelling. The tell is the combination: urgency, secrecy, and a request to skip the normal process.
An attacker gets into a colleague's mailbox and reads months of real invoice threads. They can reply in the middle of a genuine conversation, and some set up rules that quietly hide replies from the real owner.
Training people to look for spelling mistakes helps against crude attempts, but the expensive cases look right. The domain may be genuine, the tone matches previous emails, and the timing is chosen for busy periods. A control that depends on someone noticing will fail on the day they are busy.
Speed matters more than anything else. Call your bank immediately and ask them to contact the receiving bank to try to stop or recall the funds. Then report the fraud, keep the emails with their full headers, and check what else changed in your supplier master in the same period.
US: report business email compromise to the FBI's IC3 at ic3.gov as well as to your bank. IC3 publishes the annual figures quoted above.
UK: contact your bank straight away, then report to the national fraud reporting service. Confirmation of Payee adds a name check on UK payments, but it doesn't replace a call-back.
Check whether a supplier email comes from the real domain. Free to use online.
The Invoice & Payment Fraud Defence Kit puts every payment through a Release, Hold or Pulled-from-run decision, with a bank detail change verification log, supplier checks, an incident log, a staff training record and a Fraud Defence Playbook (PDF). Excel, no macros, one-time price.
Sometimes, if you act fast. Call your bank as soon as you suspect fraud and ask them to contact the receiving bank. The longer the delay, the more likely the money has already moved on.
No. Email is how the request arrives, but the loss happens in the payment process. Verification, separation of duties and payment holds stop the money even when the email gets through.
Less on spotting fakes and more on the rules: never act on contact details in a request, always verify bank changes by call-back, and treat urgency and secrecy as reasons to slow down.
Last updated 18 October 2026. General guidance for finance teams; check it against your own policies, systems and local rules.