Business email compromise: how fake invoice emails work

Your accountant gets an email that looks like it is from a supplier you pay every month. The invoice is normal, the tone is normal, and there is one small note: “Please use our new bank account from now on.” The money goes out. A week later the real supplier asks why they have not been paid.

This is called business email compromise, or BEC. It is one of the costliest scams aimed at companies of every size, and it does not need clever hacking to work. This guide explains how fake invoice emails work, the warning signs, and the habits that stop them, in plain English.

What business email compromise is

The FBI’s Internet Crime Complaint Center (IC3) describes BEC as a sophisticated scam that targets both businesses and individuals who make legitimate transfers of funds. It is frequently carried out when someone takes over a real business or personal email account, through social engineering (tricking a person) or by breaking into the account, and then uses it to get money moved.

The numbers are large. IC3 reports 305,033 incidents worldwide between October 2013 and December 2023, with exposed losses of more than $55 billion (US dollars). It also says the scam hits small local businesses as well as large corporations, and that it has been reported in 186 countries. “Exposed loss” means the amount people tried to send or lost, so it is not all money that was gone for good, but it shows the size of the problem.

How a fake invoice email works

Most fake invoice scams follow the same pattern. The details change, the steps do not.

1. The criminal gets a way in. Either they break into a real email account (yours, your supplier’s or your customer’s) or they create a look-alike address that is close enough to fool a busy person.
2. They watch and wait. With a real mailbox they can read old messages, learn who pays whom and when, and copy the style of real invoices.
3. They slip in a change. A genuine looking invoice arrives with new bank details, or a “reply to this email” instruction. Sometimes it is a message that seems to come from the boss asking for an urgent payment.
4. They add pressure. “Please pay today”, “the auditors are waiting”, “I am in a meeting, do not call”. Urgency is there to stop you checking.
5. The money moves. Once it has left, it is often passed through other accounts quickly.

Two main ways they get the email to you

A real account that has been taken over. If a supplier’s email is hacked, the fake invoice comes from their real address. No spelling mistake, no strange sender. This is the hardest kind to spot by eye, which is why the safest check is not about the email at all (see below).

A look-alike or forged sender. IC3 advises being alert to links and addresses with small misspellings of the real domain name, and checking that the sender’s address matches who the message says it is from, particularly on a phone where the full address may be hidden. A domain like acme-supplies.co.ke becoming acme-suppl1es.co.ke is easy to miss.

Some of the forged cases also happen because the real company never locked down who may send email in its name. That part is on the sender’s side, and we come back to it below.

Warning signs

• A request to change bank details, especially by email only.
• An invoice that arrives from a supplier you rarely hear from, or for work you do not remember.
• Urgency, secrecy or “do not call me” wording.
• A sender name you know, but an address that is slightly different when you look closely.
• A reply-to address that differs from the sender address.
• A message from a senior person asking for an unusual payment or for gift cards or vouchers.
• An invoice template that looks almost, but not quite, like the last one.

One sign on its own proves nothing. Two or three together, especially with a bank change, means stop and check.

How to stop it: five habits that work

IC3’s first prevention tip is the one that matters most: use a second channel, or two-factor authentication, to verify requests for changes in account information. In plain terms:

1. Call to confirm any bank detail change. Use a phone number you already had on file, not one from the email. Do this every time, even when the email looks perfect.
2. Never pay a changed account on one person’s say-so. Make a second person approve it. It takes two minutes and defeats most of these scams.
3. Use a unique password for every email account, and turn on two-step verification. IC3 lists unique passwords as a prevention step. Two-step verification means a login also needs a code from an app or phone, so a stolen password alone is not enough. Our guide to strong password ideas covers how to make them, and a password manager keeps track of them.
4. Do not enter logins or personal details because an email asked. IC3 advises not supplying login credentials or personal information by email. If a link says your mailbox is full or an invoice needs “signing in to view”, go to the real site by typing its address yourself.
5. Check your accounts regularly. IC3 recommends watching financial accounts for anything unusual, such as missing deposits. Catching a wrong payment on day one gives you the best chance of getting it back.

Protect your own domain too

Criminals also pretend to be you. If someone can send email that looks like it comes from your company, your customers can be tricked into paying the wrong account. Whether your domain stops that depends on email settings that are set up once and often never checked again. You can see where you stand with our free email spoofing test guide and domain security checker. We do not publish the exact settings to copy, because getting them wrong can stop your own email. What to do is to ask your email provider or developer whether your domain is set to reject mail that is not really from you.

If you have already paid a fake invoice

IC3 says time is of the essence. Contact your bank immediately and ask for a recall of the funds, along with any indemnification paperwork they need. Then file a complaint with IC3 if you are in the US, or with your local police and cybercrime unit elsewhere. IC3 says that quick reports may help banks and law enforcement freeze the money. Also change the password on the email account involved and check it for forwarding rules you did not create. A hacker can read your mail long after the payment.

If you only received a suspicious email and did not act, report it. In the UK, the National Cyber Security Centre (NCSC) can investigate and take down scam email addresses and websites, and reporting is free. Forward it to your IT provider as well so others on your team are warned.

A simple checklist for this week

1. Write a rule: no bank detail change is accepted by email alone.
2. Give your finance person the list of supplier phone numbers to call back.
3. Turn on two-step verification on every email account in the business.
4. Run your domain through the free checker and ask what the result means.
5. Tell your team about this scam in a five-minute chat. Staff who have heard of it are far harder to fool.

Want your domain locked down against fake emails?

If you want someone to check that criminals cannot send email that looks like it comes from your company, and fix it without breaking your real email, see our domain and email security service. To see where you stand first, run the free domain security checker.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Business Email Compromise: The $55 Billion Scam, FBI Internet Crime Complaint Center, 11 September 2024. Source for the definition of BEC, the 305,033 incidents and exposed losses of more than $55 billion between October 2013 and December 2023, 186 countries, the prevention tips and the advice on contacting your bank quickly.
• Phishing scams: how to spot and report them, National Cyber Security Centre (UK). Source for the NCSC being able to investigate and take down scam email addresses and websites, and for reporting being free.