Business Email Compromise: How to Stop Invoice Fraud

Business email compromise does not need malware or hacking skills. It needs one convincing email and one person who pays without checking. This guide explains how fake invoice and bank-change scams work, the payment controls that stop them, and what to do in the first hours if money has already gone.

Laptop on a desk showing a web page, with a phone and papers beside it — Invoice fraud usually arrives as an ordinary-looking email in the middle of an ordinary working day.

Key takeaways

Business email compromise (BEC) is when criminals impersonate a supplier, boss or customer to get you to pay them or change bank details.
The strongest defense is a process, not a tool: verify every bank-detail change by calling a number from your own records.
A two-person rule for payments and a cooling-off period for new payees catch most of what slips through.
MFA on email and alerts for new forwarding rules make it much harder for criminals to hide inside your mailbox.
If money was sent, call your bank immediately. Speed matters more than anything else.

Most small business owners picture cyber crime as something technical. Business email compromise is different. The criminal's main tool is a believable message, sent at the right moment, to the person who can move money. Sometimes the email comes from a look-alike address that differs from the real one by a single character. Sometimes it comes from the genuine account of a supplier or colleague whose mailbox has been taken over, which makes it far harder to spot.

Because the money is sent by your own staff, through your own bank, using your normal processes, it can be very hard to recover. That is why the defenses below focus on how your business approves and verifies payments. Our separate guides cover spotting phishing in general and setting up email authentication (SPF, DKIM and DMARC). This one goes deep on invoice and payment fraud.

How business email compromise works

BEC takes a few common forms. Knowing them helps you and your team recognize the pattern even when the details change.

Fake supplier and bank-change requests

This is often called payment redirection or mandate fraud. A message appears to come from a regular supplier saying their bank details have changed. The invoice looks right, the amount is familiar, and the only difference is the account number. The next payment goes to the criminal.

Boss or CEO impersonation

An email that appears to come from the owner or a director asks a staff member to make an urgent payment, buy gift cards or send a confidential transfer, often while the "boss" is supposedly traveling or in a meeting and cannot be called.

Compromised customer or partner accounts

Criminals who gain access to a customer's or partner's mailbox can read real conversations, wait for an invoice to be due and then reply in the same thread with "updated" payment details. Because the thread is genuine, the request feels natural.

Your own mailbox as the weak point

If your email is compromised, criminals can send fake invoices to your customers in your name. They may set up hidden forwarding rules so copies of your messages go to them, or rules that move replies out of your inbox so you never see a customer asking "is this really your new account?"

Common mistake

Replying to the email to check whether a bank change is genuine. If the mailbox or thread is controlled by the criminal, they will simply confirm it. Verification must happen through a different channel, using contact details you already hold.

The warning signs to teach everyone

BEC messages are designed to look normal, so look for pressure and changes rather than spelling mistakes.

Red flag	What it often means	What to do
New or changed bank details	The most common BEC request	Call the supplier on a number from your records before paying
Urgency or a deadline	Pressure to skip checks	Slow down; urgency is a reason to check more, not less
Request for secrecy	An attempt to stop you asking colleagues	Tell a second person anyway
Sender address slightly different	A look-alike domain	Compare it character by character with past emails
Boss "cannot take calls"	Impersonation of a senior person	Confirm in person or by calling their known number
Payment to a new country or bank	Funds being routed away	Treat as a bank-detail change and verify

Build payment controls that stop invoice fraud

The core of BEC protection is a short set of payment rules that everyone follows every time, with no exceptions for urgency or seniority. Write them down and make them part of how invoices are paid.

Call back on a known number. Any request to change bank details, or to pay a new account, is verified by phoning the supplier on a number from your own records: a previous invoice, contract or your supplier file. Never use a number in the email asking for the change.
Use a two-person rule. One person sets up or changes a payee, and a different person approves the payment. Many banking platforms support dual authorization, so turn it on.
Add a cooling-off period. For new payees or changed details, wait a set time before the first payment, and consider sending a small test payment confirmed by phone.
Check the payee name. In the UK, banks offer Confirmation of Payee, which checks the account name against the details you enter. Take a "no match" or "close match" warning seriously and stop to verify.
Record the check. Note who called whom, on which number, and when. A simple log makes the rule stick and helps if something goes wrong.

Pro tip

Tell your suppliers and customers about your process. Add a line to your invoices such as "We will never change our bank details by email. Always call us to confirm." It protects your customers from criminals using your name and sets expectations for your own team.

A pen resting on a paper check near the line where the dollar amount is written — Every payment should pass the same simple checks, however urgent or senior the request looks.

Lock down your email accounts

Payment controls catch fraud at the last moment. Securing email makes it harder for criminals to get inside your conversations in the first place.

Turn on MFA for every mailbox, starting with the owner, finance and anyone who sends invoices. App-based MFA, passkeys or security keys are stronger than text codes.
Set up alerts for forwarding rules. Most business email platforms can alert an admin when a new forwarding or inbox rule is created. An unexpected rule that forwards mail outside the company or deletes certain messages is a classic sign of compromise.
Block automatic forwarding to outside addresses unless there is a clear business need.
Review sign-in activity for unusual locations or devices, especially on finance mailboxes.
Protect your domain. SPF, DKIM and DMARC make it harder for criminals to send email that pretends to come from your exact domain. They do not stop look-alike domains, so payment checks remain essential.
Remove access promptly when staff leave, and do not share mailbox passwords.

Example

Imagine a fictional bakery supplier, Northfield Flour Co., that receives a reply in a genuine email thread with a regular customer. The message says the customer's accounts team has "moved to a new bank" and attaches a corrected invoice from the bakery's own template. The office manager notices it is a bank change, so the callback rule applies. She rings the customer on the number in the customer file. The customer has made no change and discovers their own mailbox has been compromised. Both businesses change passwords, add MFA and check for forwarding rules the same afternoon.

Train the people who pay invoices

Anyone who handles payments, invoices or payroll needs specific, practical training on BEC, not just general phishing awareness. Keep it short and regular.

Walk through real-looking examples of bank-change and urgent-payment emails.
Make it clear that nobody, including the owner, can override the callback rule by email or message.
Give people explicit permission to delay a payment while they check. Criminals rely on staff feeling they will be blamed for slowing things down.
Offer a simple way to report suspicious messages, and thank people who use it, even when the message turns out to be genuine.

Voice and video can now be faked too, so a phone call that seems to come from the boss is not proof on its own. Use agreed verification questions or call back on a known number for any unusual payment request.

What to do if money has already been sent

If you realize a payment went to a fraudster, act within minutes, not days. The chance of recovering funds drops quickly once the money is moved on.

Call your bank immediately using the number on your card or banking app. Explain that it is fraud and ask them to try to stop or recall the payment. In the US, ask specifically about recalling the wire transfer.
Report the crime. In England, Wales and Northern Ireland, report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101. In the US, file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov.
Secure email. From a clean device, change passwords on affected mailboxes, sign out all sessions, turn on MFA and remove any unknown forwarding or inbox rules.
Warn the other side. Contact the genuine supplier or customer by phone so they can check their own systems.
Keep evidence. Save the emails, headers, invoices and payment records. Do not delete the messages.
Check data duties and insurance. If a mailbox containing personal data was compromised, you may need to report a personal data breach. In the UK, reportable breaches go to the ICO within 72 hours of becoming aware. Also call your insurer, since some policies cover payment fraud only as an add-on.

This is general information, not legal advice. Reporting routes and data protection duties can change, so check the latest guidance from the NCSC, the ICO, the FBI or a qualified adviser for your situation.

Your invoice fraud checklist

Written callback rule for every bank-detail change
Supplier phone numbers stored in your own records
Two-person approval turned on in your banking platform
Cooling-off period for new payees
Confirmation of Payee warnings treated as a stop sign (UK)
MFA on every mailbox, finance first
Alerts for new forwarding and inbox rules
"We never change bank details by email" line on invoices
Short BEC training for everyone who pays invoices
Bank fraud line and reporting contacts written down

Frequently asked questions

Will my bank refund money lost to invoice fraud?

It depends on the bank, the country, the payment type and the circumstances. Recovery is never guaranteed, which is why prevention matters. Contacting your bank immediately gives the best chance of stopping or recalling the payment.

Is a look-alike domain the same as a hacked account?

No. A look-alike domain is a separate address made to resemble a real one. A hacked account is the genuine mailbox under a criminal's control. The second is harder to spot, which is why callback verification on a known number is essential.

Does DMARC stop business email compromise?

It helps stop criminals sending email that pretends to come from your exact domain. It does not stop look-alike domains or messages sent from a genuinely compromised account, so payment controls are still needed.

How small does a payment have to be to skip the checks?

For bank-detail changes, there should be no lower limit. Criminals sometimes start with a small invoice to establish the new account, then redirect larger payments later.

The bottom line

Business email compromise succeeds when a single email can move money. Take that power away with a callback rule on known numbers, two-person approval and a pause for new payees, then make your mailboxes harder to break into with MFA and forwarding alerts. If the worst happens, call your bank first and report it fast.