Business Email & Invoice Scams: How to Spot and Stop Them

Business email compromise (BEC) does not need malware or clever hacking. It needs one convincing email and one person with authority to move money. A supplier “changes bank details,” a director asks for an urgent transfer, or an accountant receives an invoice that looks like every other invoice — except the account number belongs to someone else.

How These Scams Work

Most variants fall into a few patterns. All of them aim to change where money goes, not to steal a password.

Invoice redirection (changed supplier bank details)

An email, apparently from a regular vendor, says their bank account has changed and asks you to pay the next invoice to the new details. The message may come from a lookalike domain, or from the vendor’s genuine mailbox after it was compromised — in which case the email will arrive inside an existing thread, using the right tone and the right invoice number.

Executive or owner impersonation

“Are you at your desk? I need a quick transfer for a confidential acquisition.” The sender uses a spoofed display name or a lookalike address, stresses secrecy and speed, and often avoids calls by claiming to be in a meeting or travelling.

Fake invoices to a real client list

Fraudsters send bills for services never ordered — domain renewals, directory listings, software licences — hoping accounts payable will pay anything that looks routine.

Payroll diversion

A message from an “employee” asks HR to update direct-deposit details before payday.

Customer-side redirection

The same trick works in reverse: a compromised mailbox sends your customers “updated” payment details for your invoices. Your invoice emails should tell customers how you will, and will not, ever communicate bank-detail changes.

Warning Signs

• A request to change bank details, or to pay a different beneficiary name than usual
• New account in a different country, bank or account type (for example a personal account for a company supplier)
• Urgency, secrecy or pressure to bypass the usual approval steps
• A sender address that differs by a character or uses a different domain (for example rn instead of m), or a reply-to address that does not match the sender
• A reluctance to speak by phone, or an offer to “confirm” only by replying to the same email
• An invoice that arrives outside the normal cycle or from an unexpected department
• Payment instructions in a PDF whose layout slightly differs from earlier invoices
• Requests for gift cards, cryptocurrency or unusual payment methods

A Payment-Change Verification Procedure

Write this down, put it in the accounts manual, and apply it to everyone, including senior staff.

1. Treat the email as unverified. Do not click the links or open attachments for instructions. Do not reply to ask whether it is genuine.
2. Call a number you already hold. Use a number from your supplier master file, a previous contract, or the vendor’s official website that you reached by typing the address — not one in the email.
3. Speak to a known contact and ask something the email cannot answer. For example the last order, the usual delivery contact, or the name of the account manager.
4. Get the change in writing through a trusted route. Many firms require a signed change form submitted through a portal or by post, plus a second approver.
5. Do a call-back from a different person. A second employee verifies the change independently. Separation of duties stops one deceived person from moving money.
6. Make the first payment a test where practical. Send a small amount and confirm receipt by phone before the full payment. This does not replace identity verification.
7. Log the verification. Record who verified, with whom, when and how. It helps audits and any later claim.

For unusual instructions from a senior person, apply the same rule: call them on a known number or walk to their desk. Real executives understand verification; fraudsters resist it.

Technical Controls Worth Having

• Multi-factor authentication on every mailbox, especially finance and executive accounts
• Email authentication records (SPF, DKIM and DMARC) on your domain so others can spot spoofing, and warnings for external senders
• Mailbox rules monitoring: attackers often add hidden forwarding rules to watch invoice traffic
• Payment-system controls: dual approval, limits, and a delay or hold period for new beneficiaries
• Staff training with realistic examples, including finance, HR and executive assistants

If a mailbox was breached, follow the steps in Account Hacked? What to Do, Step by Step and check for forwarding rules before assuming it is clean.

If You Already Paid

1. Call your bank immediately. Ask for an urgent recall or hold on the payment and give the transaction reference. Hours matter; the more time passes, the less chance funds remain.
2. Report the fraud. In the United States, file a complaint at ic3.gov quickly and tell your bank you have done so. In India, call the 1930 helpline and report at cybercrime.gov.in. Elsewhere, use your national police cybercrime or fraud reporting service.
3. Secure the affected mailboxes. Change passwords, sign out all sessions, enable MFA and remove unknown forwarding rules.
4. Preserve evidence. Keep the original emails with headers, the invoices, payment records and call notes. See how to preserve evidence after an online scam.
5. Notify partners. Tell the real supplier or customer so they can check their systems and warn others. Consider speaking to your insurer and legal adviser about notice requirements.

Recovery is never guaranteed, and be wary of anyone who contacts you afterwards offering to recover the funds for a fee; see The Scam After the Scam. For onboarding a vendor that is genuinely new, see how to verify a new supplier’s bank details. General email red flags are in How to Spot Phishing Emails.

Key Takeaways

• BEC redirects payments you already intend to make; the fix is a verification process, not intuition.
• Always confirm bank-detail changes and unusual requests by calling a number you already hold.
• Use two-person approval for new or changed beneficiaries.
• Secure mailboxes with MFA and watch for hidden forwarding rules.
• If you paid, call the bank and report immediately; hours matter.

Frequently Asked Questions

Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.