Business Email Compromise: How Payment-Redirect Scams Work and How to Stop Them
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A guide based on the FBI's 2025 Internet Crime Report, CISA's small-business phishing guidance and a NIST small-business fact sheet (linked below). We have not tested any email security product. If you think you've lost money, contact your bank immediately.
A supplier emails to say its bank details have changed. The message looks right, the thread is real, and the invoice amount is what you expected. You pay, and the money goes to a criminal. That's business email compromise (BEC), and it's one of the costliest online crimes reported to the FBI.
How big the problem is
The FBI's 2025 Internet Crime Report recorded 24,768 business email compromise complaints with reported losses of $3,046,598,558, second only to investment fraud. The report defines BEC as a scam targeting businesses or individuals who work with suppliers or regularly make wire transfers. Fraudsters compromise email accounts and other channels, such as phone numbers and virtual meeting apps, through social engineering or computer intrusion, to redirect funds.
Common versions
- Changed bank details. A "vendor" asks you to update its payment account before the next invoice.
- Urgent request from the boss. A message that appears to come from an owner or manager asks for a quick wire, gift cards or a confidential payment.
- Hijacked real thread. The criminal has access to a real mailbox (yours or a supplier's) and replies inside a genuine conversation.
- Payroll diversion. An "employee" asks HR to switch their direct deposit to a new account.
Warning signs
CISA's Recognize and Report Phishing and NIST's small-business phishing fact sheet list the signs to watch for:
- Urgency or pressure to act now, or claims of dire consequences.
- Requests for money, account details or sensitive information.
- Sender addresses or links that are slightly off, or untrusted shortened links.
- Unexpected attachments or links.
CISA notes that poor grammar used to be a giveaway, but with AI tools some phishing emails now have perfect spelling. Don't rely on typos.
The habit that stops most of it: verify out of band
CISA's guidance for teaching employees to avoid phishing says that if a message feels off or unexpected, staff should verify it, but not by replying or using any phone number or link in the message. Use a number you already have on file, or look up the business's number yourself.
Turn that into a written rule:
- Any change to payment details (vendor, payroll or customer refund) is confirmed by a phone call to a number already on file, before any money moves.
- Any urgent or unusual payment request is confirmed with the requester through a second channel, even if it seems to come from the owner.
- Two people approve payments above a set amount.
- No exceptions for urgency. Real partners will wait for a five-minute check.
Lock down the mailbox
- Turn on multifactor authentication for every email account, using the strongest method available. See our passwords and MFA guide.
- Use email filters and authentication. NIST's fact sheet suggests using spam filters and email authentication technologies that check where messages come from. Ask your email provider what's available.
- Review mailbox settings now and then, such as forwarding and filtering rules, for changes nobody on the team made.
- Train regularly. CISA says once-a-year training isn't enough, and that employees should know exactly who to report suspicious messages to.
If you've been hit
- Call your bank immediately and ask it to try to recall or freeze the transfer. Speed matters.
- Report it to the FBI's Internet Crime Complaint Center at ic3.gov.
- Change passwords for the affected email account and anywhere that password was reused, as the NIST fact sheet advises. Then review the mailbox's forwarding and filtering rules for changes you didn't make.
- Tell affected people, such as the real vendor or customers whose data may have been exposed. Check your state's breach-notification rules.
Keep good backups too. If an attack involves ransomware, our 3-2-1 backup guide helps you recover.