Key takeaways

Never pay a new or changed bank account until someone has confirmed it by phone, using a number you already had, not one from the email or invoice.

  • The FBI’s 2025 report lists business email compromise at $3.05 billion in reported US losses.
  • If you paid, call your bank at once and ask for a recall, then report. Minutes matter.
  • Small firms and households are targets too, especially around property purchases and building work.

What these scams are

In business email compromise, a fraudster pretends to be someone you normally pay, or someone who can tell you to pay. The FBI defines it as a scam targeting businesses or individuals working with suppliers or regularly making wire transfers, in which fraudsters compromise email accounts and other communication channels, using social engineering or computer intrusion, to cause an unauthorized transfer of funds.

The scale is large. The FBI’s 2025 Internet Crime Report recorded 24,768 BEC complaints and $3,046,598,558 in reported losses. That placed BEC second by loss among all crime types in the report, behind investment fraud. These are reported figures, and actual losses are likely higher.

A related, simpler version is the plain fake invoice: a bill for a service, domain renewal, directory listing or supply that you never ordered. It relies on nobody checking.

How it usually works

  1. Access or imitation. The attacker breaks into a real mailbox (often with a phished password) or creates a lookalike address.
  2. Watching. If they have access, they read the thread, learn the amounts and timing, and wait for a real invoice.
  3. Interception. They send the same invoice with new bank details, or a polite request to “update our records”.
  4. Payment and movement. Once money lands, it is moved on quickly, sometimes through several accounts.

Warning signs

Use this list for every invoice that includes a payment instruction, especially a new payee.

  1. A change of bank details, sent by email or message. The most common version. A supplier, landlord, contractor or builder says their account has changed and asks you to pay the new one. Treat every change request as unverified until you have confirmed it by phone, using a number you already had on file.
  2. A sender address that is almost right. Look at the full address, not just the display name. Extra letters, a swapped character or a different ending (.co instead of .com) are common. Be aware that the email may also be genuine, from a real account the attacker has broken into, so the address alone does not clear it.
  3. Urgency and secrecy. Phrases such as “pay today to avoid a penalty” or “keep this between us” are built to stop you checking. A real supplier can wait for a phone call.
  4. An invoice for something nobody ordered. Some scams simply send a bill for a service or listing you never requested, hoping a busy accounts team pays it. Check every invoice against a purchase order, a contract or a person who confirms they ordered it.
  5. A boss or senior person asking for an unusual payment or gift cards. A message that appears to come from the owner or finance director, asking for a quick transfer, gift cards or a change in payroll. Verify on a separate channel, in person or by calling a known number.
  6. A reply-to address, phone number or link that differs from the one on file. The invoice may list a new phone number “for queries”. Calling it only reaches the attacker. Use contact details from your own records or the supplier’s website.
  7. Payment to a different name, bank or country than usual. If the account holder name does not match the supplier, or a UK, Australian or US supplier suddenly wants payment overseas, stop. Many banks now check the payee name before sending, and a mismatch warning should be taken seriously.
  8. A payment portal or PDF link you did not expect. Fake invoices often come as an attachment or a link to a page that asks you to sign in to “view” the invoice. That can steal your email password and give the attacker access to your real mailbox.

A payment process that works

You cannot reliably spot a well-made fake by eye, so the defence is a procedure, not a good eye.

  • Call back on a known number for any new or changed bank detail, before any payment.
  • Two people for payee changes and for payments above a set amount.
  • Check against an order. No purchase order or contract, no payment.
  • Use payee name checks if your bank offers them, and do not ignore a mismatch.
  • Lock down email. Use multi-factor authentication on every mailbox, especially for finance and the owner. See our guide to phishing messages.
  • Agree an out-of-band routine for requests from the boss: a call or an in-person check, never a reply to the same email.

The household and small-business versions

Individuals meet this scam when large sums move by transfer. The usual points are a house deposit, a solicitor or conveyancing firm’s fees, a builder’s stage payment, school fees, or a tradesperson’s final bill. The FBI’s 2025 report describes a case where a senior citizen closing on a property received an email from a supposed title company with wire instructions for more than $1.3 million to a fraudulent account, and the IC3 team was able to freeze funds.

Practical rule: before sending any large sum, phone the firm on a number from its own website or from your original paperwork, and read the account details aloud. If the account details change at any point, start the check again.

For a sole trader or a very small firm, one person often opens the post, orders, and pays. That is exactly why a second look matters. Even a simple rule of “nothing gets paid to a new account until my accountant or partner has also phoned” helps.

If you already paid

  1. Call your bank now. The FBI says time is of the essence: contact your financial institution immediately, request a recall of the funds and ask what indemnification documents they need.
  2. Report to the authorities (below), with the full transaction details. In the US, the FBI asks for a complaint at ic3.gov regardless of the amount, because IC3 may help banks and law enforcement freeze funds.
  3. Secure your email. Change passwords from a clean device, turn on multi-factor authentication and look for forwarding rules you did not create.
  4. Warn the real supplier and others who may receive messages from the compromised account.
  5. Keep the evidence: the original email with full headers, the invoice, the call log and the payment receipt.
  6. Tell your insurer and, where relevant, your data protection regulator. Check your policy and local rules.
  7. Ignore anyone offering to recover the money for a fee. See recovery scams.

The FBI says its IC3 Recovery Asset Team handled 3,900 Financial Fraud Kill Chain incidents in 2025, involving $1.16 billion in attempted theft, and froze $679 million, a 58% success rate. Recovery depends on speed and on whether the money has already moved, so it is not guaranteed.

Where to report, by country

More help from official sources

Scambaba is an independent educational project and this is not legal or financial advice. Reporting and recovery options depend on where you live. How these guides are researched is on the editorial policy.

Frequently asked questions

What is business email compromise?

The FBI describes business email compromise (BEC) as a scam that targets businesses or individuals who work with suppliers or regularly make wire transfers. Fraudsters compromise email accounts and other communication channels to cause an unauthorized transfer of funds.

How do I check a changed bank detail request?

Call the supplier on a phone number you already hold, not one on the new email or invoice, and ask them to confirm the change. Have a second person approve any change to payee details before the next payment is released.

We paid a fake invoice yesterday. Can the money be recovered?

Possibly, and speed matters. Call your bank straight away and ask for a recall, then report to the police or the FBI IC3 in the US. The IC3 Recovery Asset Team froze funds in 58% of the 3,900 incidents it handled in 2025, according to the FBI, but recovery is never guaranteed.

Can households be targeted too?

Yes. Common versions are a fake email from a solicitor or conveyancer with new account details during a house purchase, a builder or contractor changing their bank details, and a fake energy or council bill. Phone the firm using a number from its website before sending a deposit.

Are small businesses really at risk?

Yes. Scammers do not need a large company. A small firm with one person handling payments can be an easier target. The FBI’s 2025 report counted 24,768 BEC complaints from US victims of all sizes.

What should I do if my email account was compromised?

Change the password from a clean device, turn on multi-factor authentication, check for forwarding rules and sent items that you did not create, and tell the people you have emailed recently. Your IT provider or email provider can help with a full check.