How do I stop invoice scams and wire fraud by email?

The short version

• The rule: any new or changed bank detail is confirmed by phone, on a number you already had. Never use the number in the email.
• The second check: a second person approves any payment change.
• The warning signs: urgency, secrecy, a new account, a slightly odd address, a request that skips your normal process.
• If money went: call your bank’s fraud line now, ask them to contact the receiving bank, then report at ic3.gov.
• Then: check whether your own email was hacked.

How does business email compromise work?

The FBI’s business email compromise page describes the pattern. A criminal sends an email that looks like it’s from someone you deal with. It asks you to pay an invoice to a new account, change a supplier’s bank details, redirect an employee’s direct deposit, or buy gift cards for the boss.

There are three common versions:

• The look-alike. The address is one letter off, or uses a different domain ending.
• The hacked mailbox. The criminal has broken into a real supplier’s or colleague’s email and replies inside a genuine thread. Nothing looks wrong, because the address is real.
• The display-name trick. The name shows as your boss, but the address behind it is a free webmail account.

The FBI’s 2025 Internet Crime Report recorded $3,046,598,558 in business email compromise losses in 2025. Only investment fraud cost more.

What’s the rule that stops it?

Every new or changed payment detail is confirmed by voice, on a number you already have.

Diagram: the payment-change check that stops most invoice and wire fraud. Based on FBI and FTC guidance (October 2026). Example details are marked.

1. Stop. Don’t reply to the email, and don’t use any link, attachment or phone number in it.
2. Call the person on a number from your records, an old invoice or their website, typed in yourself.
3. Ask them to confirm the change in their own words. Don’t read the new details out to them.
4. Get a second person in your business to approve the change before it’s saved.
5. Write it down: who you called, when, and what they said.

The FBI tells businesses to verify any change in account numbers or payment procedures with the person making the request. The FTC’s small business page recommends the same phone-call check, plus training and email authentication.

Tell your customers you’ll never change your own bank details by email. Then they’ll check with you too.

What are the warning signs?

• Urgency: “today,” “before the deadline,” “the auditors need it.”
• Secrecy: “keep this between us,” “I’m in a meeting, just do it.”
• A new account, especially overseas or at a different bank.
• A process change: “we’ve stopped taking checks,” “pay this one by wire.”
• Gift cards. No real supplier or manager wants payment in gift cards.
• Perfect writing. AI tools mean good grammar proves nothing. See how to spot a phishing email.

What do I do if money has already gone?

Minutes matter.

1. Call your bank’s fraud line now. Ask them to recall the payment and contact the receiving bank.
2. File a complaint at ic3.gov, whatever the amount. The FBI’s Recovery Asset Team works with banks to freeze money moved by wire. Its 2022 report says the team acted on 2,838 business email compromise complaints that year and held about $433 million.
3. Report it to the police if your bank or insurer asks for a report number.
4. Tell your insurer if you have cyber insurance. Many policies need prompt notice.
5. Warn the real supplier or customer by phone.

Was our own email hacked?

Check, because criminals often get inside a mailbox first to learn who pays whom. Look for forwarding rules you didn’t set, sent messages you didn’t write and sign-ins from unknown places. Our guide to the first hour after an account takeover has the steps for Microsoft 365 and Google.

If someone is only faking your address from outside, see someone sending fake emails as me. A DMARC record makes that harder; see SPF, DKIM and DMARC.

What are the common edge cases?

• The supplier really did change banks. It happens. The phone check costs two minutes either way.
• The request comes by text or phone. Same rule. Voice cloning exists, so call back on your known number.
• Payroll direct deposit changes. Confirm in person or by phone, not by email.
• Real estate and law closings. Large wires are a favorite target. Confirm wiring instructions by phone, every time.

How much does it cost, and how long does it take?

The phone check takes a few minutes per change. Setting the rule, telling staff and writing it into your security plan takes under an hour.

How does E-3 handle this?

E-3 provides business email to some clients. If you think a mailbox we provide has been used for fraud, call us at 814-399-4655 after you’ve called your bank. Nobody legitimate, including E-3, needs you to email a password or a sign-in code.

Related questions

• What do I do in the first hour after an account takeover?
• How do I write a one-page security plan?
• How do I train staff on security?
• What are passkeys, and should we use them?
• Back to cybersecurity basics

Sources

1. Internet Crime Report 2025 (FBI Internet Crime Complaint Center)
2. Business Email Compromise (FBI)
3. Cybersecurity for Small Business: business email imposters (Federal Trade Commission)
4. Internet Crime Complaint Center (FBI)
5. Internet Crime Report 2022 (FBI Internet Crime Complaint Center)
6. How to recognize and avoid phishing scams (FTC Consumer Advice)