Among the cyber frauds that hit businesses, payment fraud is one of the most damaging and least technical. No virus is needed: a believable email that persuades the accounts team to pay into the wrong account is enough. It's called BEC, Business Email Compromise, and it affects large groups, small firms, professional practices and associations alike.
The main variants
The supplier's bank detail change
This is the most frequent form. An email arrives that seems to come from a regular supplier: "Please note we have changed banks; from this invoice onwards please use our new account details". The message is well written, sometimes quotes real invoice numbers and arrives just as a payment is due.
CEO fraud
Someone in accounts receives a message from "the director": "I'm closing a confidential deal and need you to make an urgent transfer. Don't mention it to anyone, I'll explain later." The levers are authority, urgency and secrecy.
The fake lawyer or accountant
The fraudster poses as an outside adviser handling an acquisition or a dispute and asks for an immediate payment, often timed for a period when the owner is unreachable.
Why these emails look genuine
There are two scenarios, with different defences:
- Imitated domain: the email comes from an address similar to the real one, with one letter changed or a different extension. A careful eye can spot it.
- Compromised mailbox: the fraudster has genuinely got into the supplier's email, or yours, perhaps using a stolen password. In this case the email comes from the authentic address, joins a real conversation and knows amounts and due dates. Whoever breached the mailbox often also sets up hidden forwarding rules to read correspondence unnoticed.
In the second case, checking the sender isn't enough. You need a procedure.
The procedure that stops almost every fraud
1. Every bank detail change is verified by phone
When a supplier announces new bank details, the accounts team calls a number already on file, from the supplier record or the contract, never the one given in the email requesting the change. They ask a known person to confirm. Only then is the record updated.
2. Dual approval above a threshold
Transfers above a certain amount require approval from two people. Many banks let you configure this directly in business online banking.
3. No exceptions for urgency
If an urgent, confidential request arrives from the owner, it's verified with them by voice, even if they say they're unavailable. The owner should state in advance, in front of everyone, that they will never ask for out-of-procedure payments by email or chat.
4. Look at the account details
An account in a country different from the supplier's, or one held by an individual instead of the company, is a signal to investigate before paying.
Protecting your own mailbox
The fraud can start from your email too. To reduce the risk:
- turn on two-factor authentication for every business mailbox;
- regularly check forwarding rules and automatic filters: a rule that moves emails containing the word "payment" to the bin, or forwards everything to an outside address, is a red flag;
- review recent sign-ins and active sessions in your email service's panel;
- configure your email domain's authentication properly (SPF, DKIM and DMARC), making it harder for others to send messages that appear to come from you.
A concrete example
A company receives from its long-standing supplier, in the same thread as the month's invoice, a new message with the invoice PDF and different bank details. The employee notices the account is held at a foreign bank. She calls the sales contact on the number on file: the supplier hasn't changed anything, but discovers at that moment that its own mailbox has been breached. A two-minute call prevents the loss and lets the supplier take action too.
If the transfer has already gone
- Call your bank immediately and ask for the transfer to be recalled: the shorter the time elapsed, the better the chances of stopping it.
- Alert the recipient's bank through your own bank.
- Report it to the police with all the documentation: complete emails, headers, payment receipts.
- Inform the supplier if their name was used: they may have a compromised mailbox.
- Change passwords and check the mailboxes involved.
In short
- BEC fraud uses believable emails to get you to pay into the wrong account.
- The emails may come from imitated domains or from genuine, compromised mailboxes.
- Every bank detail change is verified by phone, on a number already on file.
- Dual approval, and no exceptions for urgent requests.
- If the transfer has gone, call your bank at once and report it.