How fake invoice emails trick smart people, and how to stop them

The email looks normal. It comes from a vendor you pay every month, in the same thread you have used for a year. The only change: "We have a new bank account. Please use these details for this invoice." That one line costs businesses billions.

What business email compromise means

Business email compromise, or BEC, is a fancy name for a simple con. A criminal gets into an email conversation about money and quietly steers the payment to their own account.

There is often no virus and no suspicious attachment. Just a believable email at the right moment. That is why ordinary spam filters miss so many of them.

How the trick works

1. They get in. The attacker steals the password to your mailbox or your vendor's, often with a fake sign-in page. Or they register a look-alike web address that is one letter off.
2. They watch. They read email quietly for days or weeks, learning who approves payments and when invoices go out.
3. They hide. They set up an inbox rule that moves replies to a folder nobody checks, so the real person never sees the conversation.
4. They strike at the right time. When a real invoice is due, they send "updated bank details" and add a little urgency.
5. The money moves. By the time the real vendor asks about their payment, the money has been moved on.

Why smart people fall for it

This is not about being careless. These emails work because they fit perfectly into a normal busy day.

• It is a real thread with a real vendor.
• The amount is right, because they read the last invoice.
• The timing is right, because they watched your payment cycle.
• The tone is right: polite, a bit rushed, and easy to say yes to.

Red flags to teach your team

• Any change to bank details, no matter who it comes from.
• Urgency or secrecy, such as "Please process today" or "I am in a meeting, just handle it."
• A look-alike address, such as northwind-traders.com instead of northwindtraders.com.
• A reply-to address that is different from the sender.
• A sudden request from a boss to buy gift cards or wire money.

The one rule that stops it

Make this a written policy and stick to it, even when it feels awkward.

Then add a second person to approve any new payee or bank change. Two people and one phone call beat almost every version of this scam.

The technical guards in Microsoft 365

People are the last line of defense. Your Microsoft 365 settings should be the first.

• Multifactor sign-in on every account, so a stolen password is not enough to get in.
• External sender tags that clearly label email from outside your company.
• Impersonation protection in Microsoft Defender for Office 365, which flags look-alike addresses and names.
• Alerts on new forwarding rules, the trick attackers use to hide.
• SPF, DKIM and DMARC. Three settings on your domain that tell the world which servers may send email as you. They make it much harder to fake your address.

If you already paid

1. Call your bank right away and ask them to recall the payment.
2. File a report with the FBI at ic3.gov.
3. Change the password on the affected mailbox and check it for forwarding rules.
4. Call us. We will help you find how they got in and close the door.

What to do next

Share this post with whoever pays your bills. Then put the call-back rule in writing this week.

Our free Microsoft 365 security check looks at the settings above, including multifactor sign-in, forwarding rules and email protection. It takes 30 minutes, and you keep the report.