SCAM AWARENESSBusiness email compromise
Business email compromise is a scam where criminals pose as a company leader, coworker, vendor or real estate partner by email. They ask for a wire transfer, a change to payment details, or gift cards. The email may come from a hacked real account or a lookalike address, so it can be very hard to spot.
How this scam works
Scammers study a business first, using its website, social media and sometimes a hacked email account. They learn who approves payments, which vendors get paid, and when a boss is traveling. Then they send a message that fits right in, often using an address that differs from the real one by a single letter or hyphen.
The message asks for something urgent and private: pay this invoice today, send funds for a confidential deal, update a vendor's bank account, or buy gift cards for clients. The writer says they are in a meeting and can't talk. Once money is wired to the new account, it is often moved again quickly, which makes it hard to get back.
What it can look like
EXAMPLE · NOT A REAL MESSAGE"Hi, I'm stuck in meetings all afternoon and can't take calls. I need you to wire $18,500 to a new supplier today to close a confidential deal. Please keep this between us until it's announced. Banking details attached. Thanks."
Warning signs
- A request to change a vendor's or employee's bank account details
- Urgency plus secrecy: "handle this today" and "keep this between us"
- A sender address that's slightly different from the real one
- The sender can't be reached by phone right now
- A request to buy gift cards and send the codes
- Small changes in writing style, tone or signature
How to protect yourself
- Confirm every payment or bank change by calling a known number, not one in the email.
- Require two people to approve wires and changes to payment details.
- Turn on multi-factor authentication for all business email accounts.
- Check the full sender address carefully before acting on any money request.
- Train staff that it's always OK to slow down and verify a boss's request.
If you already responded
- Call your bank immediately and ask it to contact the receiving bank to try to stop or recall the wire.
- File a complaint with the FBI's IC3 as soon as possible and include the transfer details.
- Change email passwords and check for forwarding rules or settings that a scammer may have added.
- Warn your vendors, customers and staff that your email may have been used in a scam.
- Save all emails, invoices and payment records to share with your bank and law enforcement.
Get step-by-step recovery help →
Where to report it
Common questions
What is business email compromise?
It's a scam where criminals pose as someone a business trusts, like the owner, a coworker, or a vendor, by email. They use a hacked or lookalike email account to request a wire transfer, a change to payment details, or gift cards. The money ends up in an account the scammers control.
What should I do if we wired money to a scammer?
Act fast. Call your bank right away and ask it to contact the bank that received the money. The FBI also says to file a complaint at IC3 as soon as possible. Speed matters, but there's no guarantee the money can be recovered, so prevention is key.
How can a small business prevent email payment fraud?
Set a firm rule that any new payment request or bank change must be confirmed by phone using a number already on file. Require a second person to approve wires. Turn on multi-factor authentication for email, and teach staff to question urgent, secret requests, even from the boss.