In short: Business email compromise scams do not look like spam. They arrive as a normal invoice or a “new bank details” note from a real supplier or your own boss. The fix is cheap: verify every payment change by phone, on a number you already have.
Most small shop owners picture fraud as a badly spelled email from a stranger. That picture is the problem. The scam that actually drains small businesses looks boring, polite and familiar, and it usually lands in the inbox of the person who pays the bills.
Read also: The slow stock on your shelf is a loan you made to yourself at a terrible rate · A 10% discount can need 33% more sales just to stand still · The software you stopped using is still billing you, and it costs more than your card fees
What the scam actually looks like
The FBI’s Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with reported losses of just over $3 billion. That is one category. Ransomware gets the headlines, but this quieter trick moves more money.
The pattern rarely changes. A supplier you pay every month “updates” its bank account. Or the owner, supposedly stuck in a meeting, asks the bookkeeper to wire a deposit today. The message often comes from the real mailbox, because the attacker broke into it weeks earlier and read the threads. Sometimes it comes from a lookalike domain with one letter swapped.
Big companies fall for it too. Ubiquiti Networks lost $46.7 million in 2015. Austrian aerospace firm FACC lost about €42 million in 2016, then fired both its CEO and CFO.
Why small shops are the softer target
A large company has a finance department with approval chains. A shop with six employees has one person who reads the email and also logs into the bank. Nobody double-checks.
There is also less room to absorb the hit. If you are already working through the cash-flow trap that closes small shops, a single $18,000 supplier payment sent to the wrong account can mean missing payroll. Banks can sometimes freeze a transfer, but only if you call within hours, not days.
Red flags worth training everyone on
None of these alone proves fraud. Two together should stop the payment.
- A request to change bank details, especially to an account in a different country or a new bank.
- Urgency plus secrecy: “pay today, don’t bother the owner, I’m in meetings.”
- A sender address that is almost right, like an extra letter or .co instead of .com.
- A Reply-To address that differs from the From address.
- An invoice amount or timing that does not match the usual cycle.
- A request to buy gift cards for “a client.”
Controls that cost almost nothing
The call-back rule does the heavy lifting. The number you call must come from your own records or an old contract, never from the email asking for the change. Attackers happily put their own phone number in the signature.
While you are auditing access, check who still has logins. The software you stopped using often keeps an old admin account alive, and dormant accounts with reused passwords are a common way into a mailbox.
If the money already left
Speed matters more than anything else. Call your bank’s fraud line first and ask for a recall of the transfer. Then report it to the FBI’s IC3 or your national equivalent, change the compromised mailbox password and check its forwarding rules, since attackers often add a silent rule that copies your mail out.
Spoofing works because the original email protocols never checked who the sender really was, a gap explained well in the Wikipedia entry on email spoofing. Authentication standards narrow that gap but cannot fix a hacked account.
Payment fees get attention because they show up on every statement, and card processing fees are worth cutting. But one fake invoice can cost more than ten years of them. Write the call-back rule on a sticky note, put it next to whoever pays the bills, and make it policy by Friday.
More articles you may like
- The slow stock on your shelf is a loan you made to yourself at a terrible rate
- A 10% discount can need 33% more sales just to stand still
- The software you stopped using is still billing you, and it costs more than your card fees
- A perfect 5.0 rating is costing you sales
- Chasing new customers is quietly draining your shop. The math favors the ones you already have
- Profitable on paper, broke in the bank: the cash-flow trap that closes small shops