Payment fraud and BEC
Business email compromise (BEC) is one of the most expensive scams there is. There is no malware to catch; the attacker simply convinces someone to move money or change where money is sent. The defence is process, not software.
How the scam unfolds
- The fake executive. An email that looks like it is from your CEO asks you to pay an urgent invoice or buy gift cards quietly. It stresses speed and secrecy.
- The changed bank details. A supplier you really work with emails new payment details. Except the email is from an attacker who has watched the real conversation, and the new account is theirs.
- The lookalike address. The sender domain is off by one letter, easy to miss at a glance.
Why it works
These messages arrive during a busy day, reference real projects, and use authority and urgency to stop you checking. Often the attacker has read months of genuine email first, so the tone and timing feel right.
The one rule that stops it
Verify any payment or any change to payment details through a second, known channel before acting. Call the supplier on a number you already had, not one from the email. Confirm with the executive in person or on a known number. Never let "urgent and secret" talk you out of this step.
Build it into the process
- Changes to bank details always trigger a call-back to a pre-existing contact.
- Payments above a set amount need a second approver.
- "Urgent and confidential" money requests are treated as suspicious by default.
- Report attempts, even failed ones, so others are warned.
Money that leaves this way is very hard to get back. The call that feels awkward is the cheapest insurance you have.