Business email compromise: how small businesses stop fake invoice and payment scams

Business email compromise is the scam where someone gets your small business to send money to the wrong bank account by email: a vendor's "new" payment instructions, a customer's deposit sent to a look-alike address, or the owner "asking" the office manager to wire funds today. It rarely involves a virus. It works because the email looks normal and the person reading it is busy. The fix is mostly process, not software: verify every payment change by phone using a number you already have, put multi-factor sign-in on every mailbox, and know who calls the bank in the first hour if money goes out. This guide covers how the scam works, the warning signs, a payment-verification policy you can adopt this week, and exactly what to do if it happens.

How big the problem is

The FBI's Internet Crime Complaint Center (IC3) received 24,768 business email compromise complaints in 2025, with adjusted losses of about $3.05 billion, according to its 2025 annual report. Those are only the cases people reported. New Jersey filers reported 20,648 internet crime complaints of all kinds and about $660 million in losses in 2025, ranking 16th by number of complaints but 5th by dollars lost.

For a small business, one successful attempt can mean a supplier payment, a month of payroll or a customer's down payment gone. Banks generally treat a transfer you authorized as your transfer, even if you were tricked, so prevention matters more than insurance or cleanup.

How business email compromise works at a small business

The scam takes a few common forms. Most small offices will see at least one of them.

The last one is the hardest to catch, because the email really does come from the right address and refers to real jobs and invoices. That is why the warning signs below focus on what the email asks for, not who it appears to be from.

Warning signs to train everyone on

• Any change to bank details, for a vendor, customer, employee or your own business. Treat this as a red flag every time, even when the sender is real.
• Urgency and secrecy. "Needs to go out before noon," "I'm in a meeting, just handle it," "don't mention this to anyone yet."
• A slightly wrong address. One letter off, an extra word, or a free email account instead of the company domain. Check the actual address, not just the display name.
• A reply-to that differs from the sender, so your answer goes somewhere else.
• Requests for gift cards, crypto or a wire to an account in a new name or state.
• A new phone number in the email signature with an invitation to "call to confirm." Scammers answer those numbers.

A payment-verification policy for a small office

The FBI's guidance on business email compromise comes down to confirming money transfers through a second channel, using contact details from somewhere other than the request itself. Turn that into a short written rule everyone follows, including the owner.

1. No bank-detail change is made from an email alone. Not for vendors, customers, employees or anyone else.
2. Call back on a number you already had, from your accounting system, a past invoice or the vendor's website. Never use the number in the email asking for the change.
3. Speak to someone you know at the vendor, and ask them to confirm the old and new account details out loud.
4. Two people approve any new payee, any changed account and any wire above a set amount. Pick a number that fits your business.
5. Put a short hold on first payments to changed accounts, such as one business day, so a second look can happen.
6. Tell your own customers in writing, at the start of every job, that your bank details will never change by email and that they should call your office number before sending a deposit.
7. When replying about money, forward and type the address instead of hitting reply, so a hidden reply-to address does not catch it.
8. Log every verification in the vendor or customer record: who you called, when, and what they confirmed.

That last step is where a CRM helps. When the call-back is noted on the vendor or customer record, the next person can see it was checked, and nobody has to rely on memory. Our guide to choosing a CRM for a small service business covers what a good record should hold.

Email security settings that block most attempts

Process stops the payment. These settings make it much harder for a scammer to get into your mailboxes in the first place. Work through them with whoever manages your email and IT.

• Multi-factor sign-in on every mailbox, including the owner's, the bookkeeper's and any shared inbox. Use an authenticator app or security key where you can rather than text codes.
• One login per person. No shared "office@" password passed around, and remove accounts the day someone leaves.
• Turn on external-sender tags so emails from outside your company show a warning banner.
• Check for hidden forwarding and inbox rules. A common sign of a taken-over mailbox is a rule that forwards mail elsewhere or moves messages with "invoice" or "payment" to an odd folder.
• Block or flag look-alike domains that are one character off from yours or your main vendors'.
• Keep email authentication records set up for your own domain so others cannot easily send mail that looks like it came from you.
• Keep devices and software updated, and train staff on phishing a few times a year, not once.

If you have not checked your backups lately, do that too. Many mailbox takeovers start with a phishing link, and the same link can lead to ransomware. Our data backup plan for New Jersey offices covers what a backup has to include.

What to do in the first hour if money went out

Speed matters more than anything else here. The IC3's Recovery Asset Team works with banks to freeze fraudulent transfers, and in 2025 it reported freezing about $679 million across 3,900 incidents, a 58% success rate. The IC3 report is clear that time is of the essence once a fraudulent transfer is discovered.

1. Call your bank's fraud line immediately and ask them to recall the transfer and contact the receiving bank. Have the date, amount and account details ready.
2. File a complaint at ic3.gov with the full transaction details, whatever the amount.
3. Change the password and sign out all sessions on any mailbox involved, turn on multi-factor sign-in, and remove any forwarding or inbox rules you did not create.
4. Call the real vendor or customer on a known number so they can check their own mailbox. The scam often started on their side.
5. Save the emails, including full headers, and do not delete anything.
6. Call your insurance agent to see whether your policy covers social engineering or funds transfer fraud, and talk to your attorney if customer information may have been exposed.

Write these steps on one page and keep it next to whoever handles payments. In a real incident nobody wants to be searching for the bank's fraud number.

Why this hits New Jersey service businesses

Contractors, HVAC and plumbing companies across Ocean and Monmouth counties take deposits, pay suppliers on net terms and email invoices all day from a phone in a truck. That is exactly the traffic these scams hide in. Real estate offices and anyone involved in closings see redirected deposits and closing funds. Dental and medical offices pay labs and suppliers on a schedule a scammer can learn from one compromised thread. A small team with one person handling payments, and an owner who is often out on jobs, is the setup the "fake boss" email is built for.

If you want an outside look, our one-time audits, delivered with our partner Watchman IT, include an authorized penetration test with a written report and a prioritized fix list.

Frequently asked questions

What is business email compromise? It is a scam in which a criminal uses a fake, spoofed or taken-over email account to trick a business into sending money or sensitive information. The most common versions at small businesses are fake vendor bank-detail changes, fake requests from the owner and redirected customer deposits.

How do I verify a vendor's new bank account? Call the vendor on a phone number you already had before the request, such as one from a past invoice or your accounting system, and confirm the change with someone you know. Never use the number or link in the email that asked for the change, and have a second person approve the update.

Will my bank refund money lost to a business email compromise scam? Often not, because you authorized the transfer. Your best chance is to call your bank's fraud line right away to request a recall and to file at ic3.gov, since frozen funds can sometimes be returned. Check whether your business insurance covers social engineering fraud.

Does multi-factor authentication stop business email compromise? It makes it much harder for a scammer to take over your mailboxes, which blocks the most convincing version of the scam. It does not stop a look-alike address from emailing you, so a call-back rule for payment changes is still needed.

Next step

Want to hear how your phone line can be answered while your team is on jobs? Call the demo line; it is the same AI agent that answers Connect Helm's own number, and it tells callers it is an AI. To talk through email security, IT and the systems behind your office, book a call, and see how the pieces fit together on the packages page. We quote after one conversation.