The email looks routine. A vendor you pay every month writes to say they've changed banks and asks you to send the next invoice to a new account. The logo is right, the invoice number is right, and the message may even come from the vendor's real email address.

This is business email compromise, and it works because nothing about it looks wrong. Sometimes the scammer has broken into the vendor's mailbox and is replying in a real thread. Sometimes the address is off by a single letter. Either way, the money goes to the scammer, and once it's gone it is very hard to get back.

The rule: confirm by phone, using a number you already have

Any request to change where money goes gets a phone call before anything changes. That covers new bank details, a new payment method, or an "urgent" wire from your own boss.

  • Call a number you already had on file, from an old invoice, your accounting system, or the vendor's website. Never use the phone number in the email asking for the change.
  • Talk to someone you know, if you can, and ask them to confirm the new details back to you.
  • Write down who you spoke to and when, next to the change in your records.

If the request comes from inside your company, the same rule applies. A text or email from the owner asking for a wire or gift cards gets a call to the owner's known number.

Make it a written policy

A rule that lives in one person's head breaks the day they're on vacation. Write a short policy and share it with everyone who can pay bills or change payment details:

  1. Bank detail changes are only accepted after a call-back to a known number.
  2. Urgent or secret payment requests get the same check. Urgency is not a reason to skip it.
  3. Large payments or new payees need a second person to approve them.

Tell your regular vendors you work this way. Good vendors welcome it, and it means a real change won't be delayed by surprise.

Warning signs

  • A change of bank details, especially to a bank in a different state or country.
  • Pressure to pay today, or a request to keep the payment quiet.
  • A reply address that differs from the sender address, or a domain that is slightly off.
  • A sender who suddenly can't take a phone call.

If money has already gone

Move fast. Call your bank right away and ask them to recall or freeze the transfer; the first hours matter most. Then report it to the FBI at ic3.gov, tell the real vendor that their email may be compromised, and have your IT provider check your own mailbox for signs that someone got in.