Business email compromise is fraud in which a criminal impersonates or takes over a trusted account, usually an executive's or a vendor's, to redirect a payment. The FBI's IC3 2025 Internet Crime Report recorded about $3.05 billion in business email compromise losses in 2025, second only to investment fraud.

The attack rarely involves malware or a dramatic hack. It involves a believable request, a payment process that trusts it, and a short window before anyone notices. This piece builds on email security beyond "don't click the link" and covers how the fraud works, the verification rule that stops it, and what to do in the first hour if money has already gone.

An antique brass balance scale with one pan tipped low under a single hot pink light against black, for an article on business email compromise — One changed detail tips a routine payment to the wrong side. Nothing else about the transaction has to look unusual.

What is business email compromise?

The FBI defines it as a scam targeting businesses and individuals "working with suppliers and/or businesses regularly performing wire transfer payments," carried out by "compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques." The name says email, but the definition already covers phones and video calls.

In practice it takes a few recognizable forms. A vendor emails to say its bank details have changed. An executive asks for an urgent, confidential wire. A familiar invoice arrives with new payment instructions. Sometimes the email comes from the real account, which has been taken over. Sometimes it comes from a lookalike domain: the FBI's March 2023 PSA gives examples such as @co-pany.com or @company-usa.com standing in for @company.com.

Voice and video now play a part too. FinCEN's November 2024 deepfake alert describes criminals "impersonating an executive or other trusted employee and then instructing victims to transfer large sums." That version is covered in what is vishing.

Why is business email compromise the costliest category for businesses?

Because each case tends to be large. In 2025 the IC3 received 24,768 business email compromise complaints, with reported losses of $3,046,598,558, second by dollar value. Across all crime types, the FBI logged 1,008,597 complaints and about $20.9 billion in losses.

The longer view is larger still. An FBI September 2024 PSA totaled $55.5 billion in exposed losses from more than 305,000 incidents worldwide between October 2013 and December 2023. "Exposed" includes attempted losses as well as completed ones, so it measures what criminals tried to take over a decade, not an annual US loss.

The target profile fits the $5 million to $50 million company closely. These businesses pay many vendors, move money by wire or ACH every week, and often run accounts payable with a small team where one person can both receive a change request and act on it.

A fountain pen resting on a blank invoice sheet on a black desk, lit from one side in hot pink, the vendor invoice targeted by business email compromise — The invoice is usually real. The bank details attached to it are what changed.

What does a payment-change fraud look like from the inside?

Here is a typical pattern, assembled for illustration. An accounts payable lead receives an email from a long-standing supplier. It sits in the existing thread, references a real open invoice, and explains that the supplier has moved banks. New wire details are attached on what looks like the supplier's letterhead.

Nothing about it feels urgent at first. The lead updates the vendor record, and the next scheduled payment goes to the new account. The supplier calls three weeks later asking where its money is. By then the funds have moved on.

I study behavioral psychology, and the strength of this scam is that it asks for nothing unusual. Paying a known vendor for a known invoice is routine work. The only change is a bank account number, and a busy person checking a familiar request is checking for the wrong things.

Two nearly identical brass keys side by side on black, one with a subtly different cut, under hot pink light, the lookalike domains used in business email compromise — A lookalike domain differs by a letter or a hyphen. A taken-over account does not differ at all.

How do you verify a bank detail change?

Call the vendor on a number you already have, before any change takes effect. The FBI's September 2024 PSA advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information." FinCEN's business email compromise advisory recommends "using multiple means of communication or by contacting others authorized to conduct the transactions."

The number must come from your records, such as the signed contract, the original onboarding file, or a past statement. CISA warns against using contact information connected to the request itself. If the email is fraudulent, the phone number in its signature is too.

Then make the check part of the system rather than a personal habit. A workable version for a mid-sized company:

No bank detail change takes effect without a recorded callback to a number on file.
A second person approves any change to vendor banking details, separate from whoever received the request.
The first payment to new details is held for review, and the vendor is told to expect it.
Executives agree in writing that they will never request a wire by email alone.

The case for friction explains why these pauses are worth what they cost, and what to ask your vendors about security covers agreeing the verification process with suppliers before anyone needs it.

What should you do in the first hour after a fraudulent wire?

Call your bank first. The FBI's guidance in the 2025 IC3 report is direct: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents." Have the amount, date, receiving account, and wire reference ready.

Then file with the FBI. The same report says: "Regardless of the amount lost, file a complaint at www.ic3.gov. Be sure to include the full transaction details in your report." The IC3 site also notes that it "will never directly contact you for information or money," which matters because recovery scams target people who have just been defrauded.

Fast reporting can work. The IC3's Recovery Asset Team handled 3,900 incidents in 2025 involving $1.16 billion in attempted theft, and froze $679 million, a 58% success rate. Frozen funds are not the same as money returned, and the outcome depends on reaching the bank while the funds can still be stopped.

A glass hourglass on a black surface with sand falling through a beam of hot pink light, the first hour after a business email compromise wire — The FBI's own words: time is of the essence. Call the bank first, then file at ic3.gov.

After the calls, preserve the evidence: the emails with full headers, the changed vendor record, and the payment confirmation. Notify your insurer under the terms of your policy, and work out how the request got in. What happens when you get hacked walks through the days that follow, and why cyber insurance claims get denied is worth reading before you need it.

Not sure? Check before you act

When an email asks for a payment, a bank detail change, or a login, run through these steps. The full method is in how to check if a message is a scam.

Stop. A request that cannot wait for a phone call is a warning in itself.
Read the real sender address and domain letter by letter, not just the display name.
Look the company up yourself and call back on a number you already have.
Screenshot the email and ask your company's approved AI assistant whether the company is real, whether the domain matches, and whether it fits a known scam. Crop out customer and personal data, never upload attachments, and treat the answer as a second opinion.
Report it the company way, so finance and IT can check for related requests.
If money or a login was involved, call your bank to request a recall of the funds and file a complaint at ic3.gov.

At Kief Studio we build the verification into the systems themselves, so a vendor bank change or a wire cannot go through on one person's say-so or one convincing email. We also run remote team sessions for finance and operations staff on exactly this: the payment requests they actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side.

Frequently Asked Questions

What is business email compromise in simple terms?

It is fraud in which a criminal poses as, or takes over the account of, someone a business trusts, such as a vendor or an executive, and uses that trust to redirect a payment. The FBI's definition also covers phone calls and virtual meetings.

How much does business email compromise cost?

The FBI's IC3 recorded $3,046,598,558 in reported business email compromise losses from 24,768 complaints in 2025, the second-highest loss of any crime type after investment fraud.

How do you stop a fake vendor bank detail change?

Verify every change by calling the vendor on a number from your own records, never one from the email, and require a second approver. The FBI recommends using "secondary channels" to verify requests for changes in account information.

Can a business email compromise payment be stopped?

Sometimes, if the bank is reached quickly. In 2025 the FBI's Recovery Asset Team froze $679 million across 3,900 incidents, a 58% success rate. Frozen funds are not guaranteed to be returned, so call your bank immediately and file at ic3.gov.

Is there a deadline for reporting a fraudulent wire to the FBI?

The FBI does not set a fixed deadline in its 2025 report. It says "time is of the essence" and to contact your financial institution immediately, then file a complaint at ic3.gov regardless of the amount.

Wire Fraud

What Is Business Email Compromise? How to Stop It