Business email compromise drew 24,768 FBI complaints and about $3.05 billion in reported losses in 2025. How vendor payment-change fraud works, the callback rule that stops it, and the first hour after a fraudulent wire.
Business email compromise is fraud in which a criminal impersonates or takes over a trusted account, usually an executive's or a vendor's, to redirect a payment. The FBI's IC3 2025 Internet Crime Report recorded about $3.05 billion in business email compromise losses in 2025, second only to investment fraud.
The attack rarely involves malware or a dramatic hack. It involves a believable request, a payment process that trusts it, and a short window before anyone notices. This piece builds on email security beyond "don't click the link" and covers how the fraud works, the verification rule that stops it, and what to do in the first hour if money has already gone.
The FBI defines it as a scam targeting businesses and individuals "working with suppliers and/or businesses regularly performing wire transfer payments," carried out by "compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques." The name says email, but the definition already covers phones and video calls.
In practice it takes a few recognizable forms. A vendor emails to say its bank details have changed. An executive asks for an urgent, confidential wire. A familiar invoice arrives with new payment instructions. Sometimes the email comes from the real account, which has been taken over. Sometimes it comes from a lookalike domain: the FBI's March 2023 PSA gives examples such as @co-pany.com or @company-usa.com standing in for @company.com.
Voice and video now play a part too. FinCEN's November 2024 deepfake alert describes criminals "impersonating an executive or other trusted employee and then instructing victims to transfer large sums." That version is covered in what is vishing.
Because each case tends to be large. In 2025 the IC3 received 24,768 business email compromise complaints, with reported losses of $3,046,598,558, second by dollar value. Across all crime types, the FBI logged 1,008,597 complaints and about $20.9 billion in losses.
The longer view is larger still. An FBI September 2024 PSA totaled $55.5 billion in exposed losses from more than 305,000 incidents worldwide between October 2013 and December 2023. "Exposed" includes attempted losses as well as completed ones, so it measures what criminals tried to take over a decade, not an annual US loss.
The target profile fits the $5 million to $50 million company closely. These businesses pay many vendors, move money by wire or ACH every week, and often run accounts payable with a small team where one person can both receive a change request and act on it.
Here is a typical pattern, assembled for illustration. An accounts payable lead receives an email from a long-standing supplier. It sits in the existing thread, references a real open invoice, and explains that the supplier has moved banks. New wire details are attached on what looks like the supplier's letterhead.
Nothing about it feels urgent at first. The lead updates the vendor record, and the next scheduled payment goes to the new account. The supplier calls three weeks later asking where its money is. By then the funds have moved on.
I study behavioral psychology, and the strength of this scam is that it asks for nothing unusual. Paying a known vendor for a known invoice is routine work. The only change is a bank account number, and a busy person checking a familiar request is checking for the wrong things.
Call the vendor on a number you already have, before any change takes effect. The FBI's September 2024 PSA advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information." FinCEN's business email compromise advisory recommends "using multiple means of communication or by contacting others authorized to conduct the transactions."
The number must come from your records, such as the signed contract, the original onboarding file, or a past statement. CISA warns against using contact information connected to the request itself. If the email is fraudulent, the phone number in its signature is too.
Then make the check part of the system rather than a personal habit. A workable version for a mid-sized company:
The case for friction explains why these pauses are worth what they cost, and what to ask your vendors about security covers agreeing the verification process with suppliers before anyone needs it.
Call your bank first. The FBI's guidance in the 2025 IC3 report is direct: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents." Have the amount, date, receiving account, and wire reference ready.
Then file with the FBI. The same report says: "Regardless of the amount lost, file a complaint at www.ic3.gov. Be sure to include the full transaction details in your report." The IC3 site also notes that it "will never directly contact you for information or money," which matters because recovery scams target people who have just been defrauded.
Fast reporting can work. The IC3's Recovery Asset Team handled 3,900 incidents in 2025 involving $1.16 billion in attempted theft, and froze $679 million, a 58% success rate. Frozen funds are not the same as money returned, and the outcome depends on reaching the bank while the funds can still be stopped.
After the calls, preserve the evidence: the emails with full headers, the changed vendor record, and the payment confirmation. Notify your insurer under the terms of your policy, and work out how the request got in. What happens when you get hacked walks through the days that follow, and why cyber insurance claims get denied is worth reading before you need it.
When an email asks for a payment, a bank detail change, or a login, run through these steps. The full method is in how to check if a message is a scam.
At Kief Studio we build the verification into the systems themselves, so a vendor bank change or a wire cannot go through on one person's say-so or one convincing email. We also run remote team sessions for finance and operations staff on exactly this: the payment requests they actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side.
It is fraud in which a criminal poses as, or takes over the account of, someone a business trusts, such as a vendor or an executive, and uses that trust to redirect a payment. The FBI's definition also covers phone calls and virtual meetings.
The FBI's IC3 recorded $3,046,598,558 in reported business email compromise losses from 24,768 complaints in 2025, the second-highest loss of any crime type after investment fraud.
Verify every change by calling the vendor on a number from your own records, never one from the email, and require a second approver. The FBI recommends using "secondary channels" to verify requests for changes in account information.
Sometimes, if the bank is reached quickly. In 2025 the FBI's Recovery Asset Team froze $679 million across 3,900 incidents, a 58% success rate. Frozen funds are not guaranteed to be returned, so call your bank immediately and file at ic3.gov.
The FBI does not set a fixed deadline in its 2025 report. It says "time is of the essence" and to contact your financial institution immediately, then file a complaint at ic3.gov regardless of the amount.
What is vishing? Voice phishing by phone, now with cloned voices. CrowdStrike found vishing intrusions doubled in the first half of 2026 versus late 2025. Here is how it targets businesses and the callback rule that stops it.
What is quishing? Phishing hidden in a QR code, so nobody can read the link before scanning. The FBI warned in January 2026 that quishing pushes victims from work computers to phones, past email security controls.
MFA fatigue is push-bombing: login prompts sent again and again until one is approved. That is how an attacker got into Uber in September 2022, per Uber's own update. CISA calls phishing-resistant MFA the gold standard; here is what to switch on first.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
