Business Email Compromise: How Invoice Fraud Works and How to Stop It

Business email compromise, usually shortened to BEC, does not look like hacking. There is no ransom note, no flashing warning and often no malware at all. Instead, a criminal convinces someone in your business to send money or sensitive information to the wrong place, usually by pretending to be a vendor, a client or your own boss. The payment looks routine, the email looks normal, and by the time anyone realizes, the money has often been moved on.

BEC has consistently ranked among the costliest categories of cybercrime in the FBI Internet Crime Complaint Center’s annual reports, with reported losses in the billions of dollars each year. Small businesses are attractive targets because they tend to have fewer approval steps, a handful of people who can move money and a lot of trust in long-standing vendor relationships.

The encouraging part is that BEC is one of the most preventable threats you face. Most attacks fail against a simple, consistently followed payment verification process. This guide explains how the scams work, how AI voice cloning and deepfakes are changing them, and the exact controls that stop them.

What business email compromise is

BEC is a type of social engineering in which an attacker uses email, and increasingly phone calls, text messages and video, to impersonate someone the victim trusts. The goal is almost always money or data: an invoice paid to the wrong account, a payroll deposit redirected, gift cards purchased, or employee tax records sent to a stranger.

Attackers use one of three approaches to make their messages convincing:

• Account takeover: they steal the password for a real mailbox, often through a phishing page, and send messages from the genuine account.
• Lookalike domains: they register a domain that differs by a single character, such as swapping “rn” for “m” or adding a hyphen, and send from that.
• Display name spoofing: they use a free email account but set the display name to your CEO or vendor, counting on the recipient not checking the actual address.

Account takeover is the most dangerous, because the messages come from a real address and can continue an existing email thread. That is why technical controls and process controls both matter.

How a typical invoice fraud unfolds

Invoice fraud is the most common BEC pattern for small businesses. It usually follows a predictable sequence.

1. Reconnaissance. The attacker learns who handles payments, which vendors you use and when invoices are due. Much of this is available from websites, social media and job postings.
2. Access. They compromise a mailbox, either yours or your vendor’s, or register a lookalike domain.
3. Observation. With mailbox access, they quietly read email for days or weeks. They often create inbox rules that hide replies from the real owner by moving them to an obscure folder.
4. The ask. At the right moment, often when a large invoice is due, they reply in the existing thread: “Please note our bank details have changed. Updated remittance information is attached.” The tone, signature and timing all look right.
5. Pressure. They add urgency: the account will be on hold, a late fee applies, or the CEO is waiting.
6. Cash-out. Once paid, the money is moved quickly through other accounts, sometimes converted to cryptocurrency, making recovery harder with every hour.

Notice that at no point does the victim do anything obviously reckless. They pay what looks like a legitimate invoice from a known vendor. That is what makes BEC so effective, and why “be careful” is not a sufficient defense.

Common BEC variants to know

Variant	What it looks like	Who is usually targeted
Vendor bank change	A supplier “updates” their bank details before a payment is due.	Accounts payable, bookkeepers
Executive wire request	The “CEO” urgently needs a wire for a confidential deal or new supplier.	Finance staff, office managers
Gift card request	A manager asks someone to buy gift cards for clients and send the codes.	Any employee, often new hires
Payroll diversion	An “employee” asks HR to change their direct deposit account.	HR, payroll administrators
Real estate and closing fraud	A “title company” or “attorney” sends new wiring instructions before closing.	Property buyers, law and real estate firms
Data theft	An executive asks for employee W-2 forms or customer lists.	HR, payroll, operations

The modern twist: AI voice cloning and deepfake requests

For years, the standard advice was “if in doubt, pick up the phone.” That advice still works, but only if you control who you call. Generative AI now lets criminals clone a person’s voice from a short recording, such as a conference talk, podcast, social media video or voicemail greeting. They can also create convincing video of a person in real time.

In practice, this shows up as:

• A voicemail or phone call from what sounds exactly like the owner, asking the bookkeeper to push through an urgent payment.
• A follow-up call that “confirms” a fraudulent email, so the employee believes they have already verified it.
• A video meeting where the faces and voices of executives are generated, used to authorize a large transfer.

The last example is not hypothetical. In a widely reported 2024 case in Hong Kong, police said an employee of a multinational firm transferred roughly US$25 million after a video call in which the company’s chief financial officer and other colleagues were deepfakes. The FBI has also published a public service announcement warning that criminals use generative AI, including cloned voices and video, to make fraud more believable.

How to defend against voice and video impersonation

• Never verify using contact details provided in the request. Hang up and call back on a number you already have, from your phone system, vendor file or company directory.
• Agree on a verbal passphrase between the owner and anyone who can move money, used only for out-of-the-ordinary requests. Do not store it in email.
• Make exceptions impossible. If the process says two people approve wires over a set amount, that rule applies even when the “CEO” is on video saying it is urgent.
• Treat secrecy as a red flag. Legitimate executives rarely ask staff to bypass normal approvals and keep it confidential.
• Limit public voice samples where practical, for example by using a generic voicemail greeting for executives who approve payments.

Warning signs your team should recognize

Train everyone who touches payments, payroll or sensitive data to pause when they see any of the following:

• Any request to change bank details, especially by email or attached PDF.
• Urgency combined with secrecy: “I need this done today and please keep it between us.”
• A request that bypasses the normal approval process or comes outside normal hours.
• Slight differences in the sender’s address, reply-to address or domain.
• A known contact writing in an unusual tone or asking for something new.
• A new bank account in a different name, city or country from the vendor’s usual one.
• Requests for gift cards, cryptocurrency or payment methods you never normally use.

Our guide to how to spot phishing emails covers the broader set of email red flags that often accompany BEC.

Build a payment verification procedure

This is the control that matters most. Write it down, train everyone involved in payments and follow it every time, without exceptions for seniority or urgency.

Share the procedure with your key vendors too. Tell them you will never change your own bank details by email, and that you verify every change they request. This also protects them from criminals impersonating your business.

Technical controls that make BEC harder

Process stops the payment. Technical controls make it harder for criminals to get in a position to ask for it.

1. Multi-factor authentication on every mailbox. This is the most effective way to prevent account takeover from a stolen password.
2. Alerts for new inbox rules and forwarding. Microsoft 365 and Google Workspace can flag or block automatic forwarding to external addresses, a common sign of compromise.
3. External sender tags. A banner on messages from outside your organization helps staff notice when a “colleague” is actually external.
4. SPF, DKIM and DMARC. These email authentication records make it harder for criminals to send mail that appears to come from your exact domain. Start DMARC in monitoring mode and work toward enforcement.
5. Lookalike domain awareness. Some email security tools flag messages from newly registered or similar-looking domains.
6. Bank fraud services. Ask your bank about payee verification, positive pay and dual authorization features for business accounts.

Our guide to hardening Microsoft 365 and Google Workspace walks through where to find these settings.

What to do if you have sent money

Act within minutes, not days. The faster the bank is notified, the better the chance funds can be frozen before they are moved.

1. Call your bank’s fraud department immediately. Ask them to recall the transfer and contact the receiving bank. Have the date, amount and destination account ready.
2. File a complaint with the FBI’s Internet Crime Complaint Center. Include transaction details. Rapid reporting can help law enforcement work with banks to freeze funds.
3. Secure the mailbox. Reset passwords, sign out all sessions, check MFA methods and remove suspicious inbox rules, forwarding and connected apps.
4. Preserve evidence. Keep the fraudulent emails with full headers, invoices and call logs. Do not delete anything.
5. Notify the real vendor or partner by phone, since their systems may also be compromised.
6. Contact your cyber insurer if you have coverage, and check whether your policy covers social engineering fraud.

If you do not yet have a written plan for situations like this, our guide to building an incident response plan in one afternoon will help.

How SecuritySage can help

BEC prevention combines good habits, clear procedures and a few well-configured settings. We can help with all three. Our phishing simulation and testing service includes realistic BEC-style scenarios so your finance and admin staff can practice spotting and verifying suspicious requests in a safe setting. We can also review your email security configuration and help you write a payment verification procedure that fits the way your team actually works.

Want to close the gaps before a criminal finds them? Get started with SecuritySage and we will help you put these controls in place. Secure your digital future today with SecuritySage, where cybersecurity meets simplicity, allowing you to focus on growth while we handle the rest.