How to Prevent Business Email Compromise and Invoice Fraud

Recognize the request, not just the spelling mistakes

Business email compromise is a scam in which a message appears to come from a trusted business contact to persuade someone to send money or disclose information. An attacker may impersonate an executive, use a lookalike domain, or exploit a real compromised mailbox.

The FBI describes scenarios involving changed vendor bank details, urgent executive requests, and fraudulent invoices. Good grammar and a familiar conversation do not establish that a payment request is genuine. Treat a change in payment instructions as a verification event.

Make independent verification the default

Before accepting new bank details or an unusual payment request, call the contact using a number already held in your trusted records. Do not use a number supplied in the suspicious email, its attachment, or a linked page. A reply to the same thread is not an independent check.

• Pause payments when the recipient, account, or instructions change.
• Confirm the change through an established contact and record who verified it.
• Use a second authorized reviewer for high-risk or unusual payments.
• Do not allow urgency, secrecy, or an executive's name to bypass the normal approval process.

Give staff a short escalation script

Make it easy to pause without feeling that a customer or manager is being accused. A finance employee can say: 'Our payment policy requires a call to the number we already have on file before we update bank details.'

Keep a named backup approver for absences and agree how suspicious requests reach IT. Train staff on lookalike email addresses and unexpected links. Require MFA on business email, but remember that an impersonation scam does not always require access to your mailbox.

If a payment has already been sent

Contact your financial institution immediately, explain the suspected fraud, and ask about recall or recovery options. Preserve the message, transaction details, and a timeline through your approved incident process. Recovery is not guaranteed, so do not wait for certainty before contacting the bank.

For US incidents, the FBI advises reporting to IC3. Elsewhere, use the appropriate local reporting authority. If a business mailbox may be compromised, ask your IT provider to investigate sessions, forwarding rules, and recovery settings while finance works with the bank. Coordinate customer or supplier communications through a verified channel.

Turn the incident into a process improvement

Review whether verification was skipped, a contact record was outdated, or one person could change and approve payment details. Update the workflow, rehearse it with finance, and retain a record of the changes.

Credential exposure monitoring can help identify account risks, but it cannot verify a bank account or approve an invoice. Independent payment verification remains essential.