Fake Invoices and Payment-Change Emails: How to Spot Business Email Compromise

An email arrives from a supplier you've worked with for years. It says their bank has changed and asks you to send this month's payment to the new account. The logo is right, the signature is right, and the invoice number matches one you were expecting. If you pay it, the money may be gone for good.

This is called business email compromise, or BEC. It doesn't require hacking your computers or installing anything. It relies on a convincing email and a busy person who wants to get the bills paid. This article explains how these scams work, the warning signs your staff should know, and the simple process that stops most of them.

How big is the problem?

BEC is one of the most expensive types of cybercrime reported to the FBI. In its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise complaints with adjusted losses of more than $3 billion (FBI IC3 2025 Internet Crime Report). Those are only the cases that were reported.

Small businesses are attractive targets because payments are often handled by one or two people, approvals are informal, and there is rarely a written process for checking a change in bank details.

How the scam works

Most BEC attempts follow one of a few patterns:

• The fake vendor. Someone poses as a supplier and says their bank account has changed. Future payments go to the criminal's account.
• The fake boss. An email that appears to come from the owner or a manager asks an employee to pay an urgent invoice, wire money or buy gift cards, often "while I'm in a meeting, so don't call."
• The fake client or title company. A message changes the closing or payment instructions at the last minute. Real estate and law firms see this often.
• The fake payroll change. An employee appears to ask HR to send their paycheck to a new account.

The email can come from two places. Sometimes it's a lookalike address: one letter changed, an extra word, or a free email account with the right display name. Other times it comes from the real account, because the criminal stole the vendor's or employee's password and has been quietly reading their email. The FBI notes that criminals can monitor billing conversations so their request arrives exactly when a real payment is expected (FBI: Business Email Compromise).

That second case is why the usual advice to "check the sender's address" isn't enough on its own.

Warning signs to teach your staff

Any one of these should make someone stop and verify before paying:

• A change in bank details, payment method or where to send money. This is the biggest red flag of all.
• Urgency or pressure. "This must go out today," "We'll lose the deal," "The account will be closed."
• A request to skip the normal process, keep it confidential or avoid calling.
• A slightly different email address, or replies that go to a different address than the one the message came from.
• A change in tone or wording from someone you write to often, or an unusual time of day.
• Gift cards as a payment method for anything business-related.
• New attachments or links asking you to "view the updated invoice" or sign in to see a document.

The rule that stops most BEC: call to confirm

The most effective protection isn't technical. It's a written rule that everyone who handles money follows every time:

1. Any change in payment details is verified by phone before a payment is made.
2. Use a phone number you already had: from your vendor records, a previous contract or the company's website. Never use a number from the email asking for the change.
3. Payments above a set amount need a second person to approve, and the approver checks that the verification call happened.
4. No exceptions for urgency or seniority. If the owner really does need something paid today, a quick phone call won't stop that.
5. Write it down and tell your vendors about it, so they expect the call and know you'll never change their details by email alone.

The FBI's own advice says the same thing: verify payment and account changes in person or by phone, and be especially wary when someone is pressing you to act quickly.

The technical layers that help

A good process is the last line of defense. These protections make it far less likely that a fake email ever reaches someone's inbox, or that a criminal gets into your mailbox in the first place:

• Multi-factor authentication (MFA) on every email account, so a stolen password alone isn't enough to break in.
• Email security and anti-phishing filtering that flags lookalike domains, impersonation of your own staff and suspicious links.
• SPF, DKIM and DMARC on your domain, so criminals can't send email that appears to come from your exact address. We explain these in SPF, DKIM and DMARC explained.
• An "external sender" banner on messages from outside your company, so a fake "boss" email stands out.
• Alerts for new mailbox forwarding rules, a common trick criminals use to hide replies or keep a copy of your email after they've broken in.
• Security awareness training with short, realistic examples, so the warning signs above become second nature.

For a broader list of protections, see our small business cybersecurity checklist.

If you think you've already paid a fake invoice

Speed matters. The FBI says that when a fraudulent transfer is discovered, "time is of the essence."

1. Call your bank right away and ask them to recall the payment. Ask the bank what it needs from you.
2. File a complaint at ic3.gov with the full transaction details, whatever the amount.
3. Secure the mailbox. Change the password, sign out all sessions, confirm MFA is on, and check for forwarding rules or rules that delete or hide messages.
4. Warn the real vendor or client using a phone number you trust, in case their account was the one compromised.
5. Talk to your insurer if you have cyber or crime coverage, and keep the emails as evidence.

How CyberArm can help

Email security and anti-phishing, MFA and endpoint protection are part of every one of our cybersecurity packages, and our Advanced package adds security awareness training for your staff. We also set up SPF, DKIM and DMARC, turn on alerts for suspicious mailbox activity, and can help you write a simple payment verification policy your team will actually follow.

The bottom line

Business email compromise works because it looks like normal business. A phone call to a number you already trust, before any payment details change, stops most of it. If you'd like to know how well your email is protected against impersonation and account takeover, our free IT and security assessment checks your email and sign-in security and gives you a written Executive Summary with the fixes that matter most.