Business email compromise and invoice-redirection scams

The payment can be real while the bank details are fake

Business email compromise (BEC) is dangerous because the underlying transaction may be genuine. A real supplier is owed money, a property purchase is closing, payroll is due or an executive actually has authority to request a transfer.

The fraud happens when a criminal compromises or imitates one of the people in that process and changes the destination of the payment.

Common versions

• a supplier “updates” its bank details before an invoice is paid;
• a senior executive requests a confidential urgent transfer;
• payroll details are changed through a compromised employee account;
• a lawyer, landlord, contractor or real-estate party sends replacement payment instructions;
• an attacker replies inside an existing email thread after compromising an account.

A near-perfect email address is suspicious, but a genuinely compromised mailbox can send from the correct address. That is why payment verification cannot depend on email alone.

Build a second channel into the process

For new or changed bank details, use a known phone number or established internal workflow to confirm the request. Do not call a number supplied only in the change request.

For organizations, strong controls include dual approval for unusual transfers, documented vendor-change procedures and staff training that makes verification normal rather than embarrassing.

If money was sent

Contact the sending bank or payment provider immediately and ask about recall, hold or fraud procedures. Preserve the email headers, invoice, payment instructions, transaction reference and the known-good contact details for the real organization.