Business Email Compromise: How to Stop Invoice and Payment Fraud

Business email compromise is one of the most expensive forms of cybercrime. The FBI's Internet Crime Complaint Center has ranked it among the costliest scams it sees year after year. Unlike ransomware, BEC often involves no malicious software at all. Criminals simply convince someone in your company to send money or sensitive data to the wrong place.

The good news is that BEC is very preventable. A handful of clear payment rules, backed by sensible technical controls, stops most attempts before any money moves.

How BEC scams work

• Fake supplier invoices

  A criminal poses as a real vendor and sends an invoice, or a notice that the vendor's bank details have changed.

• CEO or executive fraud

  An email that appears to come from a senior leader asks finance to make an urgent, confidential payment.

• Compromised mailboxes

  Attackers break into a real employee's or supplier's email account, read ongoing conversations and insert themselves at the right moment.

• Payroll diversion

  A message posing as an employee asks HR to change the bank account their salary is paid into.

• Lookalike domains

  Emails come from addresses that differ from the real domain by a single character, such as rn in place of m.

Warning signs to train your team on

• A request to change bank details, especially close to a payment date.

• Pressure to act quickly, keep it secret or skip the normal approval process.

• A sender address, reply-to address or domain that looks slightly different from usual.

• An executive who is "in a meeting" or "travelling" and cannot be reached by phone.

• Changes in tone, spelling or signature compared with earlier messages from the same person.

Payment controls that stop the money leaving

Process controls do the heavy lifting against BEC, because they work even when a convincing email gets through.

• 1. Call-back verification

  Confirm every new payee and every bank-detail change by phone, using a number from your records, never one in the email.

• 2. Dual approval

  Require two people to approve new payees and payments above a set threshold.

• 3. Cooling-off period

  Hold the first payment to changed bank details for a short period so there is time to verify.

• 4. No exceptions for urgency

  Make it clear, in writing, that leaders will never ask anyone to bypass the process, and that following it is always the right call.

• 5. Vendor master data control

  Limit who can edit supplier bank details in your finance system and log every change.

Technical controls that make attacks harder

• Phishing-resistant MFA

  Passkeys or security keys stop most mailbox takeovers, even when a password is stolen.

• SPF, DKIM and DMARC

  Email authentication makes it much harder for criminals to send messages that appear to come from your domain. Aim for a DMARC policy of quarantine or reject.

• External sender banners

  Label messages from outside the company so a fake "internal" request stands out.

• Lookalike domain monitoring

  Watch for newly registered domains that imitate yours or your key suppliers'.

• Mailbox rule alerts

  Attackers often create hidden forwarding or deletion rules. Alert on new rules and on forwarding to outside addresses.

What to do if a fraudulent payment is made

Act within minutes, not days. Call your bank's fraud team straight away and ask them to recall the payment and contact the receiving bank. Report the incident to the authorities: in the US, file a complaint with the FBI's IC3; in India, use the National Cyber Crime Reporting Portal or call 1930. Then reset the affected accounts, review mailbox rules and sign-ins, and tell any suppliers or customers who may also be targeted.

Finally, review what happened without blame. The goal is to find the gap in the process, close it, and make it easier for the next person to say no.

Where NPLUS Global helps

We review your payment and approval processes, configure email authentication and phishing-resistant MFA, set up alerts for suspicious mailbox activity and run practical training for finance, HR and leadership teams. If an incident happens, our incident response readiness work means your team already knows the first steps.