By Cyber Defense Technologies November 5, 2026 4 min read
Ransomware gets the headlines, but business email compromise (BEC) quietly takes more money. The FBI's Internet Crime Complaint Center (IC3) has ranked BEC among the costliest categories of cybercrime year after year. It requires no malware and no exploit, only a convincing email at the right moment.
Government contractors are especially exposed. Contract awards, points of contact and program details are often public, payments are large, and work flows through long chains of primes, subcontractors and suppliers. Every link is an opportunity.
How the schemes work
Changed payment details
The most damaging scheme starts with a real relationship. An attacker compromises a vendor's email account, or registers a domain that looks almost identical, and waits for an invoice cycle. Then a message arrives: "We have changed banks. Please send this payment to our new account." The invoice is real, the amount is right, and the timing is perfect. Only the account number has changed.
Fake purchase orders and requests for quotes
Criminals pose as procurement officers from federal agencies or prime contractors and send requests for quotes or purchase orders for laptops, networking gear or other resellable goods, with a delivery address they control. The supplier ships on credit and is never paid. These messages often use real agency names, real staff names and convincing forms.
Executive impersonation
An email that appears to come from the CEO or CFO asks someone in finance for an urgent, confidential wire transfer, or asks HR for employee W-2 data. Pressure and secrecy are the tools: "I'm in a meeting, just get this done."
Payroll diversion
An attacker poses as an employee and asks HR to change their direct deposit account. The next paycheck goes to the attacker.
Why contractors are targeted
- Public information. Award announcements and procurement databases tell attackers who is paying whom, and roughly how much.
- Trusted relationships. Primes and subcontractors exchange invoices and bank details constantly, which makes a change request look normal.
- Compromised partners. A small supplier with weak email security can be the entry point for fraud against a much larger customer.
- AI-written lures. Generative AI has removed the spelling and grammar mistakes that used to give these messages away. We covered this in Phishing in the Age of AI.
Warning signs
- A request to change bank details, especially near a payment date.
- Urgency, secrecy or pressure to bypass normal approval.
- A sender address or reply-to address that differs slightly from the usual one.
- A purchase order from a new government contact with an unusual shipping address or rushed delivery.
- A request to move the conversation to a personal email or phone number.
Controls that stop the money
Technology helps, but BEC is best stopped by process.
- Verify out of band. Confirm every change in payment details by calling a phone number you already have on file, never one in the email. Make this rule mandatory, with no exceptions for seniority or urgency.
- Require two people. Changes to vendor banking details and payments over a threshold should need a second approver.
- Verify new government contacts. Confirm purchase orders through the agency's published contracting office, not the contact details in the order.
- Protect your own accounts. Use phishing-resistant MFA on email, so your mailbox cannot be used to defraud your customers.
- Authenticate your domain. Publish SPF, DKIM and a DMARC policy that rejects spoofed mail, and flag external senders in your email client.
- Watch for mailbox rules. Attackers who take over an account often add rules that hide replies from the real owner. Alert on new forwarding and deletion rules.
- Train the people who pay. Finance, contracts, HR and executive assistants need specific, practical training on these schemes.
Before you change where money goes
-
1
Pause
Treat any change in bank details, or any urgent payment request, as suspect.
-
2
Verify out of band
Call a number you already have on file, never one in the message.
-
3
Second approver
A second person approves the change and the payment.
-
4
Record it
Log who verified the change, how and when.
-
5
Watch the first payment
Confirm with the vendor that the first payment to the new account arrived.
If it happens
Speed matters. Contact your bank immediately and ask it to recall the transfer, then file a complaint with IC3. The sooner a fraudulent transfer is reported, the better the chance of freezing the funds. Then investigate how the attacker got in, because a compromised mailbox is also a data breach. If the account held covered defense information, the 72-hour DFARS reporting clock may apply.
How CDT can help
CDT's social engineering assessments test whether your team and your payment processes hold up against realistic BEC attempts, and our incident response team investigates compromised mailboxes and helps contain the damage.
