The invoice was real. The bank details weren't.

In 2025, businesses reported just over $3 billion lost to business email compromise to the FBI: almost 25,000 complaints, at roughly $123,000 each. It is not a big-company problem. It works best on small businesses, because small businesses pay suppliers personally and quickly, and the person approving the payment is usually doing four other things.

How it actually works

1. Someone gets into an email account: yours, your bookkeeper's or a supplier's. Often through a password reused from another site, or a fake login page.
2. They don't take anything. They read. For weeks they learn your suppliers, your tone and your payment schedule.
3. Then a real invoice arrives, at exactly the moment you expected it, from an address you recognize. One thing has changed: the bank details. "We've moved banks, please use the new account."

An unexpected email gets scrutiny. An expected one gets paid. That is the whole trick.

Two rules that stop almost all of it

Rule 1: Never change payment details because of an email. If a supplier says their bank details have changed, call them on a number you already have (from an old invoice, their website, or your phone contacts), never the number in the email. Ask them to confirm the change.

Rule 2: Two people for any new or changed bank details. Before money goes to a new account, a second person checks it. If you are a one-person business, make the second check a wait: no payment to new details on the same day they arrive.

Both rules are free. Neither needs any technology.

Three more things worth doing

• Turn on two-step verification for your business email.
• Check your email for forwarding rules you didn't set up. Attackers often add a rule that quietly copies or hides messages.
• Tell your bank right away if money has gone to the wrong account. The first hours matter most. Then report it to the FBI at ic3.gov.

If it has already happened

Call your bank's fraud department first, using the number on your card or statement, and ask them to try to recall the payment. Then file a report at ic3.gov, change the email password, and check for forwarding rules.