Business email compromise: what to do before the fake invoice gets paid
Wire fraud that starts in email is ordinary now. Here is the habit that stops it, and what to do if a payment already left.
Business email compromise is a plain crime with a plain costume. Someone pretends to be a vendor, a client, or your own owner, and they ask for a payment to a new account. The email looks familiar because it is built from a thread they can see, or from a lookalike domain that is one letter off.
The technical pieces matter. Multi-factor authentication, a mail filter, and a rule that flags messages sent from outside the company all reduce the odds. They do not replace the habit that actually saves the money.
That habit is a second channel. If a vendor “updates” bank details, someone calls a number you already had, not the number in the email. Same for a client. Same for a message that claims the owner is in a meeting and needs a transfer right now. The urgency is the costume.
Write the rule down where the person who pays bills will see it on a busy Tuesday. One sentence is enough: we do not change payment details from an email alone.
If a payment already left, speed matters more than a perfect write-up. Call your bank and ask them to recall it. Then call the receiving bank if you have it. Change the passwords on any mailbox that was involved, and sign those accounts out of other sessions. Then tell your IT person, or call us, so the mailbox is checked for rules that quietly forward copies of future mail. Criminals love a hidden forward.
Afterward, tell the vendor or client what happened, in your real voice, from your real number. They may be getting the same trick from someone pretending to be you.
This is not a statistics page. One missed habit is enough to hurt a small company, which is why the habit is the point. If you want a second set of eyes on the mailbox and the payment process, start with a free IT assessment.