The email looks routine. A vendor you've worked with for years says their bank changed, attaches an invoice with the new account details, and asks you to pay today to avoid a late fee.
That's one of the most common ways small businesses lose money. The FBI calls it business email compromise. In its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints and more than $3 billion in reported losses.
The good news is that these scams have tells, and one simple habit stops most of them.
How the scam usually works
There are two common versions.
A lookalike email address. The scammer registers a domain that's almost identical to your vendor's. "yoursupplier.com" becomes "yoursupplier-co.net," or "yoursuppIier.com" written with a capital I where the lowercase L should be. At a glance, it looks right.
A real account that's been taken over. The scammer breaks into your vendor's actual email account. Now the message really does come from the vendor's address, often as a reply in an existing email thread. This version is much harder to spot by looking at the sender.
Either way, the goal is the same: get you to send a payment to an account the scammer controls.
Warning signs to look for
- Changed payment details. Any email asking you to update bank information deserves a second look, every time.
- Urgency. "Today," "before 3pm," "to avoid a penalty." Pressure is meant to keep you from checking.
- A request for secrecy or to skip the usual process. "Please handle this directly," or "don't loop in accounting."
- An address that's slightly off. Look at the full email address, not just the display name. Check the reply-to address too.
- A new contact. Someone you've never dealt with suddenly handling billing.
- Small differences in the invoice. A different logo, layout, phone number or tone than the vendor usually uses.
- An attachment or link that asks you to sign in. A real invoice shouldn't require your email password to open.
The habit that stops most of it
Before you change any payment details, call the vendor at a phone number you already have. Not the number in the email. Not the number in the new invoice. Use the one from your records, your contract, or the vendor's website that you look up yourself.
That one call stops most of these scams, whichever version you're facing. A lookalike domain can fake an email address, and a hacked account can send a convincing message, but neither can answer your vendor's real phone line. Just make sure the number you call came from your own records, and that it wasn't changed by an earlier email.
To make it stick, turn it into a written policy:
- Any change to vendor bank details must be confirmed by phone using a known number.
- The person who confirms writes down who they spoke with and when.
- A second person approves the change before the first payment goes out.
- No exceptions for urgency. A real vendor will understand.
If you've already paid
Move fast. The first hours matter most.
- Call your bank right away and ask them to recall or freeze the transfer.
- File a complaint at ic3.gov, the FBI's Internet Crime Complaint Center.
- Call your IT provider. If the scam started from one of your mailboxes, an attacker may still have access, or may have set up rules to hide replies. That needs to be checked and locked down.
- Tell your cyber insurance carrier as your policy requires.
- Let the real vendor know, so they can check whether their own email was compromised.
Technology helps, but it isn't enough
Good email filtering catches many lookalike domains and known scam messages before they reach anyone. Multi-factor authentication makes it much harder for attackers to take over your own accounts. Training helps your team recognize the signs.
But when the scam comes from a vendor's real, hacked account, filtering may not catch it. That's why the phone call is your best safety net.
How we help
Every plan we offer includes email protection and spam filtering, 24/7 security monitoring and device protection. Inventive Prime also includes staff security training, so your team learns to catch these before money moves. If you want to test yourself, try the scam-or-legit quiz on our homepage.