Business Email Compromise: How Payment Fraud Works

Business email compromise (BEC) is a form of fraud in which criminals use email to trick an organization into sending money or sensitive information to them. It often involves no malware and no technical exploit. A well-timed, convincing message to the right person can be enough to redirect a large payment.

The FBI's Internet Crime Complaint Center consistently identifies BEC as one of the most financially damaging types of cybercrime it receives reports about. Government contractors, state and local governments, and organizations of every size are targeted.

How the schemes work

• Vendor impersonation. The attacker poses as a known supplier and sends an invoice or a notice that the supplier's bank details have changed. Future payments go to the attacker's account.
• Executive impersonation. A message that appears to come from a senior leader asks finance staff to send an urgent, confidential wire or buy gift cards.
• Payroll diversion. The attacker, posing as an employee, asks HR or payroll to change the employee's direct deposit account.
• Real estate and closing fraud. For organizations buying property or facilities, attackers send altered wire instructions shortly before closing.
• Data theft. Some schemes request employee tax forms or personal information instead of money, for later use in identity fraud.

Why it works

Attackers do their research. They study organization charts, press releases and social media to learn who approves payments and which suppliers you use. Often they compromise a real mailbox, either at your organization or at a supplier, and read correspondence for weeks so they can insert themselves into a genuine conversation about a real invoice. The request arrives in an existing email thread, at the expected time, for the expected amount.

Where they cannot access a real mailbox, they register look-alike domains that differ from the real one by a character or two. They create urgency and secrecy, such as a deal that must close today or an executive who is unreachable, to discourage the recipient from checking.

Out-of-band verification

The most effective control is simple: verify any request to change payment details or send an unusual payment through a separate channel, using contact information you already have on file.

• Call the supplier using the phone number in your vendor master file or contract, never the number in the email requesting the change.
• Confirm payroll changes in person or through a verified channel, and notify the employee at their known contact details when a change is made.
• Verify executive requests directly with the executive, regardless of the stated urgency or confidentiality.

Make clear that following the verification procedure is always the right decision, even if it delays a payment requested by a senior leader.

Controls in finance

• Dual approval for new payees, bank detail changes and payments above a set threshold.
• A waiting period after bank details change before the first payment goes out.
• Separation of duties, so the person who changes vendor records is not the person who approves payments.
• Bank services such as positive pay and payee verification where your bank offers them.
• Training for finance, HR and executive assistants on the specific schemes they face.

Technical controls that help

Technology cannot stop every BEC attempt, but it reduces exposure. Use phishing-resistant MFA to protect mailboxes, alert on new mailbox forwarding and inbox rules, which attackers create to hide their activity, and enforce DMARC on your domains so they cannot be spoofed directly. Flag messages from external senders and from newly registered or look-alike domains.

If money has been sent

Speed matters. The sooner the bank is notified, the better the chance of recovering funds.

• Contact your bank immediately and ask it to recall the transfer and contact the receiving bank.
• File a complaint with the FBI's Internet Crime Complaint Center (IC3) as quickly as possible, with the transaction details.
• Secure affected mailboxes: reset passwords, revoke sessions, remove malicious rules and review sign-in activity.
• Determine how it happened, including whether your mailbox or a supplier's was compromised, and warn the supplier if so.
• Check reporting obligations, including contractual cyber incident reporting if information systems were compromised.

Our incident response team can investigate mailbox compromise and help determine what the attacker accessed. If you are dealing with an active incident now, see our under attack page.