The email comes from a supplier you have paid for years. It is polite, correctly formatted, and part of an ongoing thread about this month’s invoice. There is just one change: “Our bank has changed. Please use the new account details attached for this and future payments.” Your bookkeeper updates the vendor record and pays. Three weeks later the real supplier calls asking where their money is.
This is business email compromise, or BEC, and it is one of the most expensive crimes small businesses face. It needs no malware and no hacking skill on your end. It works by borrowing trust.
How big a problem is it?
The FBI’s Internet Crime Complaint Center (IC3) describes BEC as a scam targeting businesses and individuals who transfer funds, usually by getting into, or convincingly faking, a legitimate email account. According to the FBI’s Anchorage office, Alaskans reported about $7 million in BEC losses in 2025 alone, making it one of the three costliest crimes reported in the state. Nationally, the FBI’s 2025 Internet Crime Report, released in April 2026, lists compromised corporate email among the costliest tactics scammers use.
How the scam works
There are a few variations, but most follow the same pattern.
1. Getting in, or looking like it
Sometimes criminals steal the password to a real mailbox, often a vendor’s, sometimes yours, through a fake login page. Sophos’s 2026 Active Adversary Report found identity weaknesses, such as stolen credentials, behind 67% of the incidents it investigated. Other times they register a look-alike domain (finitetech.net becomes flnitetech.net) and simply pretend.
2. Watching and waiting
With access to a real mailbox, criminals read quietly. They learn who pays whom, when invoices go out, how people sign their emails and which deals are pending. They may set up a hidden rule that moves replies into a folder the real owner never checks.
3. The request
At the right moment, they send the change: new bank details, an urgent wire for a “confidential” deal, or a request from “the owner” to buy gift cards for a client. The timing is often a Friday afternoon, a holiday, or when the person who would normally question it is traveling.
4. The money moves
The payment lands in an account controlled by the criminals and is moved on quickly. The sooner the fraud is spotted, the better the chance of getting any of it back.
Warning signs
- A change to bank or payment details, especially by email only.
- Urgency or secrecy: “needs to go today,” “please keep this between us.”
- A sender address that is almost right, or a reply-to address that differs from the sender.
- A request that skips your normal approval process.
- A familiar person who is suddenly hard to reach by phone.
Criminals now use AI to write fluent, error-free messages, and even to clone voices, so good spelling and a friendly tone are no longer signs that a message is genuine.
Simple checks that reduce the risk
The IC3’s own advice starts with verifying payment changes through a second channel. In practice:
- Call back on a known number. Any change to payment details gets a phone call to a number you already had on file, never one from the email. This one habit defeats the most common version of the scam.
- Two people for money changes. One person requests a vendor bank change; another verifies and approves it.
- No exceptions for urgency. Make it policy that “the owner said to rush it” is not a reason to skip the call. Owners should say so out loud, so staff feel safe following it.
- Check the address, not the name. On a phone, tap the sender’s name to see the real address.
- Turn on strong multi-factor authentication for every mailbox, so a stolen password alone is not enough.
- Watch your accounts. Regularly review payments going out and deposits that should have come in.
If you think it has happened
Act fast. The IC3 advises contacting your bank immediately to request a recall or reversal, then filing a complaint at ic3.gov with the transaction details. Then call us so we can check whether one of your mailboxes was compromised, remove any hidden forwarding rules, and reset access.
Where technology helps: Sophos Email
Checks and habits are the core defense, but good email filtering reduces how many of these messages reach your staff in the first place. For our clients we use Sophos Email. As described by Sophos, as of September 2026, it includes:
- Impersonation and BEC detection. Sophos says its natural language processing models analyze the text, tone, context and structure of messages to catch payment-fraud and executive-impersonation attempts that contain no link or attachment.
- Sender verification. Checks of the standard email authentication records (SPF, DKIM and DMARC) that help spot spoofed senders.
- Link checks at the moment of the click, not just when the email arrives, and sandbox testing of suspicious attachments.
- Clawback after delivery. Messages later identified as malicious can be pulled back out of inboxes automatically.
- Microsoft 365 integration, so suspicious messages can be quarantined before or after delivery from the same Sophos console we use for the rest of your security.
No filter catches everything. A message sent from a vendor’s real, compromised mailbox can look entirely legitimate to software. That is why the phone call matters.
How FTI helps
We set up and manage Sophos Email and Microsoft 365 security for our clients, including strong sign-ins and alerts for suspicious mailbox rules. Our AI-assisted operations watch sign-in and email security events alongside everything else, so our engineers can spot a compromised mailbox early and act. We can also help you write a short payment-verification policy that fits how your office works. More on our security services, and on the related threat of voice and keystroke theft in social media and keyloggers.
