Business email compromise costs US companies billions each year. Learn how invoice and wire fraud scams work and the controls that stop them at small businesses.
Business email compromise (BEC) is the most expensive form of cybercrime most small businesses will ever face. The FBI Internet Crime Complaint Center consistently reports billions of dollars in annual BEC losses, far more than ransomware. There is no malware to detect and no encrypted files to restore. A criminal simply convinces someone in your business to send money to the wrong bank account, and once a wire or ACH transfer clears, the money is usually gone within hours. Albuquerque and Santa Fe businesses in real estate, construction, legal, healthcare, and any company that pays vendor invoices are frequent targets.
How BEC Attacks Actually Work
The most common pattern is vendor invoice fraud. Attackers compromise the email account of one of your suppliers, often through a phishing email that steals their Microsoft 365 password. They quietly read the mailbox for weeks, learn who pays invoices and when, and then reply inside a real email thread with a message that the vendor has changed banks. Because the email comes from the vendor's actual account, in an existing conversation, with a correct invoice number, nothing looks suspicious. Your bookkeeper updates the payment details and the next payment goes to the criminal.
Other common variants include executive impersonation, where an email that appears to come from the owner asks someone to urgently wire funds or buy gift cards; payroll diversion, where a fake employee email asks HR to change direct deposit details; and real estate closing fraud, where buyers receive fake wiring instructions just before closing. Attackers also register lookalike domains that differ by one character, such as helpteck.us instead of helptek.us, to impersonate your business to your own clients.
The Single Most Effective Control: Verify by Phone
Every request to change bank details or send an unusual payment must be verified by phone, using a number you already had on file, never a number in the email or invoice. This one process defeats nearly every BEC attack, because the criminal controls the email account but not the vendor's phone. Write the policy down, make it mandatory with no exceptions for urgency or seniority, and document each verification call with the date, the person reached, and the number used. Attackers deliberately create time pressure; a written rule gives staff permission to slow down.
Add dual approval for payments. Require a second person to approve any new payee, any change to payee bank details, and any wire above a set threshold. Ask your bank about ACH positive pay and payee verification services, which flag payments to accounts that do not match your approved list. These are inexpensive controls that catch mistakes even when someone is fooled.
Harden Your Own Email So You Are Not the Weak Link
If your mailbox is compromised, attackers will use it to defraud your clients. Enforce multi-factor authentication for every user and block legacy authentication protocols that bypass it, as described in our Microsoft 365 security guide. Move toward phishing-resistant methods like passkeys, because modern phishing kits can steal session tokens and get past simple push or code-based MFA.
Watch for the signs of a compromised mailbox. Attackers almost always create inbox rules that move or delete replies from a vendor or client so the real person never sees the conversation. Configure alerts for new inbox forwarding rules and for sign-ins from unusual countries, and review them weekly. Disable automatic forwarding to external addresses at the tenant level. These settings take minutes to configure in Microsoft 365 or Google Workspace and catch account takeovers early.
Publish SPF, DKIM, and DMARC records for your domain and move DMARC to a quarantine or reject policy once you have confirmed legitimate mail passes. This prevents criminals from sending email that spoofs your exact domain. Turn on external sender tagging so staff see a warning banner on messages from outside the organization, which makes executive impersonation emails much easier to spot. Our article on email security and phishing prevention covers these settings in depth.
Train Finance and Admin Staff Specifically
General security awareness training helps, but the people who pay invoices and manage payroll need targeted training on BEC scenarios. Walk them through real examples: a vendor bank change request, an urgent CEO wire request, a direct deposit change email. Practice the verification call. Make it clear that no one will ever be penalized for delaying a payment to verify it. Our guide to security awareness training for staff explains how to run short, effective sessions.
What to Do If You Sent Money to a Fraudster
Speed is everything. Call your bank's fraud department immediately and ask them to initiate a recall of the wire or ACH transfer. Then file a complaint at ic3.gov; the FBI can sometimes freeze funds through its Recovery Asset Team when transfers are reported quickly, ideally within 72 hours. Preserve the emails without deleting anything, reset passwords and revoke sessions on any affected accounts, and check for malicious inbox rules. Notify your cyber insurance carrier promptly, since many policies require prompt notice and some include specific social engineering fraud coverage, as discussed in our cyber insurance requirements guide.
Frequently Asked Questions
What is business email compromise?
Business email compromise is a scam in which criminals use a hacked or spoofed email account to trick a company into sending money or sensitive data. Common forms include fake vendor bank change requests, executive impersonation, and payroll direct deposit diversion.
How do I verify a vendor bank account change?
Call the vendor using a phone number you already had on file before the request, such as from a signed contract or past invoices, and confirm the change with a known contact. Never use contact details from the email requesting the change, and require a second approver before updating payment details.
Does MFA prevent business email compromise?
MFA blocks most password-based account takeovers and is essential, but it does not stop scams sent from a vendor's compromised account or from lookalike domains. Payment verification by phone and dual approval are needed in addition to MFA.
Can money lost to wire fraud be recovered?
Sometimes, if you act within hours. Contact your bank immediately to request a recall, then file a report at ic3.gov. Recovery chances drop sharply after the first 24 to 72 hours.
If you want help locking down Microsoft 365 against account takeover, configuring DMARC, or writing a payment verification policy your team will actually follow, HelpTek provides cybersecurity services for Albuquerque and Santa Fe businesses. Contact us for a free email security review.
