The most expensive phishing email is the boring one. Business email compromise (BEC) looks like a routine invoice or a bank-detail change. The defence is boring too: verify every payment change through a second channel before money moves. I run AliasFleet, an email-alias service.
A small firm has no finance team. One person opens the inbox, sees a message matching work in progress, and pays. The criminal only needs that once, on an ordinary Tuesday, unchecked.
In 2024, the FBI Internet Crime Complaint Center received 21,442 BEC complaints with reported losses of about $2.77 billion, out of $16.6 billion in total reported cybercrime losses across 859,532 complaints, per the IC3 2024 Internet Crime Report. Infosecurity Magazine's summary of the same report puts BEC at $2.7 billion, down from $2.9 billion in 2023. Over the longer run, Infosecurity Magazine, reporting on an IC3 notice, put BEC losses at nearly $55.5 billion between October 2013 and December 2023, across 305,000-plus incidents. Reported losses only. Plenty of victims never report, and near misses go uncounted.
What business email compromise actually is
BEC is a scam where a criminal impersonates a trusted party and tricks a business into sending money or data. The FBI describes it as one of the most financially damaging online crimes. Orders, invoices, approvals, bank details: all travel by email, so a message fitting the pattern raises no alarm.
The four common shapes:
- Invoice fraud: a fake supplier message asks you to pay an invoice to new bank details.
- Executive impersonation: a fake message from the boss asks someone to make an urgent payment or buy gift cards.
- Solicitor or property fraud: a fake message from a solicitor or title company sends forged wiring instructions for a house deposit or completion payment.
- Payroll and data theft: a fake message from a senior manager asks for employee payroll details or tax forms.
The FBI lists three working methods behind these shapes: spoofed accounts or websites, spearphishing that gathers billing details, malware exposing real invoice threads so requests can be timed to look normal. No exotic hacking. The attack rides on trust and routine.
The invoice-fraud pattern
Invoice fraud hurts freelancers and small firms most: invoices are the daily rhythm of the business. A message arrives that fits an order you recognise. Amounts look right. Branding looks right. Only the destination changed.
First, treat every bank-detail change as a fresh request, however familiar the rest of the message. A genuine supplier changes bank details rarely, and expects you to check.
Second, read the sender address character by character. Attackers rely on lookalike domains: one letter swapped, one hyphen added, a familiar name on a strange domain. The FBI Las Vegas field office warns about this: check the real address behind the display name, and treat any request to bypass normal payment procedures or communicate only by email as a red flag.
Third, do not let a familiar thread reassure you. A BEC message sometimes turns up inside a real conversation. That feels like verification, but it is not.
Vendor impersonation and the bank-detail switch
Vendor impersonation is the most expensive BEC shape for a small business: the amounts are real order amounts. The criminal does not invent a payment. They redirect one you were already going to make. The order is real, the amount is real, the timing is right. Only the destination is wrong.
No email, on its own, changes bank details. If a supplier, contractor, or client asks you to pay a new account, stop and verify through a second channel. Ring the supplier on a number from your own records: a past invoice, their website typed by you, your contacts. Never use a phone number printed in the message you doubt. Europol's guidance says the same: use contact details from previous correspondence, not from the message requesting the change, and set up one point of contact per company you pay. Full leaflet: Europol on CEO and business email compromise fraud.
Keep a verified payee list per supplier: account name, sort code or bank identifier, last four digits. When a message asks you to change any of it, compare against the list, then call.
Where email aliases fit
Email aliases help with BEC in one specific, limited way. An alias does not verify a payment or check bank details. It shrinks the surface a criminal can work with and makes a compromised channel obvious.
An email alias is a forwarding address for one relationship, delivering to your real inbox. Give each regular supplier, client, or platform its own alias. When an invoice message arrives on that supplier's alias, it is at least in the right channel. When a message claiming to be from that supplier arrives on a different alias or your main address, something is already wrong. When an alias starts receiving messages it should not, pause or close it without touching your real inbox or other relationships. For the small-business version, with role addresses alongside vendor aliases, see email aliases for small business.
Aliases also limit what a breach exposes. If a supplier is breached and your alias for them leaks, it points at one relationship, and you can replace it. Your real inbox address stays out of the breach file.
What aliases do not do: they do not replace the verification call. A criminal who has taken over a supplier mailbox can still send from the real supplier address, on the right alias, with the right context. The call still comes first. The alias is what told you to make it.
Urgent payment requests and the pressure trick
BEC messages lean on urgency. Pay today or the order stalls. Keep this confidential. The boss is travelling and needs this now. The supplier has a cash flow problem. The pressure is the mechanism. It shortens the gap between reading and paying, where verification lives.
The FTC puts it plainly in its small-business scam guide: scammers create urgency and fear so you act before you check, and demand payment by wire transfer, cryptocurrency, or gift cards. A genuine supplier or boss can survive a ten-minute verification call. A criminal cannot, because the call goes to the real person, who will say they never sent it.
One rule: urgency never overrides verification. A message that says it is urgent is a reason to slow down. One that says keep it confidential is a reason to tell someone. Confidentiality is how BEC survives. A second pair of eyes kills it.
How attackers pick targets
BEC is targeted, but the targeting is not mysterious. Criminals look for businesses that pay suppliers by email, publish staff names and roles on their website, and post about orders, clients, and travel. A small firm often publishes all of it as marketing. To a criminal, it is a map: who approves payments, who handles invoices, when the boss is away, which suppliers you use.
Trim the details that help a criminal sound like an insider: payment procedures, staff email addresses, posts about who is away or which big order landed.
Breaches feed this too. Run business addresses through Have I Been Pwned and change passwords on any account that shows up, especially reused ones. If a supplier tells you they were breached, tighten verification for them at once.
One more pattern matters for sellers too. In a 2023 advisory, IC3 warned that BEC actors spoof company domains to place bulk orders, then delay discovery with Net-30 and Net-60 credit terms backed by forged credit references and W-9 forms. Targeted goods included construction materials, agricultural supplies, computer hardware, solar energy products. The advice for vendors matches the advice for buyers: verify the buyer through the business main phone line, never a number from the email. If you sell on credit to new business customers, a two-minute call before shipping is cheap insurance.
The one verification step that stops most BEC
Every BEC protection boils down to one habit: verify payment changes through a second channel, every time, no exceptions. Boring is the point.
If a message asks you to pay a new account, stop. Ring the payee on a number from your own records and confirm before a penny moves. One call, every time.
Make it a written rule. A one-page payment rule:
- No bank-detail change is accepted from email alone.
- Every change is confirmed by phone on a number from our own records, or in person.
- Payments above a set threshold need a second approver, even if that is the owner reviewing a screenshot.
- Any message demanding secrecy or urgency gets escalated, not actioned.
- Any message asking to move a payment to a new account stays suspicious until verified, even from a known thread.
In its 2018 advisory, IC3 recommended two-party sign-off on transfers, contacting requesters by phone before complying, and monitoring mail servers for unusual forwarding rules. Read the full list here: IC3 on BEC losses and mitigations. If you are a solo freelancer, your second approver is a pause: a fixed ten-minute delay between receiving a bank-detail change and paying it, used to make the call.
Lock down your own domain so nobody can impersonate you
BEC cuts both ways. Criminals impersonate your suppliers to you, and you to your customers. Without email authentication on your domain, anyone can send mail claiming to come from your business. What email spoofing actually involves is a separate problem from BEC, but the fix overlaps: the same records that stop spoofing make your domain harder to impersonate.
Three DNS records fix most of this. SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature proving a message was not altered in transit. DMARC tells receivers what to do when SPF or DKIM fail, and ties both checks to the visible From address. Set them up in that order, from monitoring up to quarantine and then reject once reports show no legitimate mail failing. Walkthrough: SPF, DKIM, and DMARC explained.
The FTC makes the same recommendation in its impersonation guidance: use email authentication so receivers can confirm mail really came from your company, and block or flag mail that did not. If customers ever get messages impersonating your business, warn them fast through a channel that does not look like phishing, and tell them you will never ask for passwords or bank details by email.
Turn on multi-factor authentication on every email account, starting with the ones that approve payments. CISA lists MFA, strong unique passwords, phishing training, and software updates as the four essentials for businesses, and its small-business guidance stresses MFA on email above all. A password manager makes unique 16-character passwords practical.
If money already went out
If you think you paid a BEC invoice, act in this order. Do not wait to be sure.
First, call your bank. Ask for a wire recall and what else they can do to stop or reverse it. Ask them to contact the receiving bank. Do this first; speed matters.
Second, file a detailed complaint with IC3. The IC3 BEC page sets out the steps: contact your bank first, then file with full banking details, then stay informed about new BEC advisories. Include messages, headers, amounts, dates, and both sets of account details.
Third, preserve everything: messages, headers, invoices, transaction records. Do not delete the thread. If an email account may be compromised, change its password from a clean device, turn on MFA, and check for forwarding rules you did not set.
Fourth, tell your own team. If a BEC message reached one person, it may have reached others. A short internal note, what arrived, what it asked for, what to do if anyone else sees it, stops the second payment.
A short BEC checklist for small teams
Print this where payments happen:
- Bank details never change on email alone. Phone verification on a trusted number, every time.
- Urgency and secrecy are signals to slow down, not to pay.
- Read the sender address character by character. Lookalike domains are the giveaway.
- Payments above your threshold need a second approver or a fixed delay plus a call.
- Give each regular supplier its own alias; treat a message on the wrong alias as suspicious.
- Publish SPF, DKIM, and DMARC for your domain so nobody can impersonate you.
- MFA on every email account, unique passwords, and a password manager.
- If money went out, call the bank first, file with IC3 second, preserve everything third.
BEC is a process problem with a process fix. The attack does not depend on technology. It depends on one person skipping one check on one ordinary day. Make the check non-negotiable, and the boring email loses its power.
Top comments (0)