Business email compromise: how invoice fraud works and how to stop it

Business email compromise (BEC) is the attack that costs small businesses real money without ever touching a laptop. Nobody's files get encrypted. Nothing looks broken. A supplier's invoice simply arrives with new bank details, someone in accounts pays it, and the money is gone before anyone notices the supplier is still waiting.

This guide explains how the scam works, what the warning signs are, and the specific controls that stop it. Most of them cost nothing and can be in place by the end of the week.

What business email compromise actually is

Business email compromise is when a criminal gets into, or convincingly imitates, a work email account and uses it to trick someone into sending money or sensitive data. In practice there are three common versions:

UK Finance's figures show how these play out. In 2025 invoice and mandate scams caused £41.3 million of losses across 2,305 cases, and 68% of those losses (£28 million) were on business accounts. UK Finance notes that businesses "make genuine higher-value payments more regularly, making it harder to spot and stop a fraudulent one". Only 48% of invoice and mandate losses were returned to victims. CEO fraud was smaller, at £5.6 million across 197 cases.¹ Those totals have been falling for several years, which is good news, but a single case can still be the price of a year's profit for a small firm.

How an invoice fraud attack unfolds

Most attacks follow a similar pattern, and knowing it makes the warning signs easier to spot.

1. Getting in, or looking like they're in

The attacker either takes over a real mailbox (yours or your supplier's) or sends from a lookalike. UK Finance says this type of fraud "often involves the criminal either intercepting emails or compromising an email account".¹ Phishing is the usual route in: the NCSC says 85% of cyber attacks against businesses start with a scam email,² and DSIT found phishing was the most common attack type, experienced by 38% of UK businesses in the last year.³ A fake Microsoft 365 sign-in page captures a password, and without multi-factor authentication (MFA) that is all they need.

2. Watching and waiting

Once inside a mailbox, a patient attacker reads. They learn who your suppliers are, how invoices are worded, who approves payments and when the big ones are due. They often set up inbox rules that forward copies of messages elsewhere or quietly move replies into an obscure folder, so the real account owner never sees the conversation.

3. The switch

When a genuine payment is due, the attacker steps into the thread. Because it may come from a real account, or quote the real email chain, it reads exactly like normal correspondence. Because the messages are few, written for one person and may come from a genuine account that has already been taken over, email filters often have nothing to flag.

The message usually says the supplier has changed banks, is being audited, or needs payment urgently to avoid a late fee. A PDF with new account details on the supplier's letterhead is common.

4. Discovery

Often the first sign is the real supplier chasing an unpaid invoice weeks later. By then the money has usually been moved on from the receiving account, which is why the controls below focus on stopping the payment in the first place.

Warning signs to train your team on

No checklist catches everything, but these should make anyone pause:

• A change of bank details, especially by email alone, however routine it looks
• Urgency or secrecy: "needs to go today", "don't mention this to anyone yet", "I'm in a meeting, just get it done"
• A request from a director that bypasses the normal approval route
• A sender address that is slightly off (an extra letter, a different domain ending, a personal webmail address)
• A new payee for a large amount, or a payment split oddly to stay under a limit
• Replies that arrive suspiciously fast, or a contact who suddenly won't take a phone call

Training alone will not save you, because some of these messages are indistinguishable from the real thing. The NCSC's phishing guidance warns that attackers exploit "ways of working" to trick people into making unauthorised payments, and recommends making staff familiar with how key tasks such as payments are normally done, so unusual requests stand out.⁴ The better investment is a payment process that works even when someone is fooled.

The payment controls that actually stop it

This is the section that saves money. Every control here is about process, not technology.

Verify every change of bank details by phone

Make it a written rule: any new payee or any change to a supplier's bank details is confirmed by phoning a number you already hold, from a previous invoice, your accounts system or the supplier's official website. Never use a phone number in the email asking for the change. The NCSC recommends that important email requests are verified "using a second type of communication (such as SMS message, a phone call, logging into an account, or confirmation by post or in-person)".⁴ It also suggests telling your own customers what to expect, for example that "our bank details will not change at any point".⁴

Use two people for big or new payments

For new suppliers and payments above a threshold you set, require one person to set up the payment and a second to approve it. Ask your bank whether your business account can require a second approver.

Limit who can pay

Not everyone needs to be able to make high-value payments. Review who has payment rights in your banking and accounting software, and remove access when people change roles or leave.

Pay attention to Confirmation of Payee

Confirmation of Payee is the UK name-checking service that lets you check the account name before you pay, and it covers business accounts as well as personal ones.⁵ If your banking app says the name does not match, or only partly matches, stop and phone the supplier on a known number. Do not let an email persuade you the warning is a glitch.

Make it safe to say "I'm not sure"

People who fear blame report mistakes late or not at all, and with invoice fraud the first hour matters. A director who thanks someone for delaying a payment to check it is worth more than any filter.

A simple payment policy you can adopt today

1. Bank detail changes are never accepted by email alone.
2. Every change is confirmed by phone on a number already held, and the call is logged.
3. New payees and payments over £[your threshold] need two approvers.
4. Urgent requests from directors follow the same rules. Directors agree to this in writing.
5. Anyone can pause a payment to check it, with no blame.

The email and account controls

Process stops the payment. These technical controls make it much harder for the attacker to get in or to impersonate you.

Turn on strong MFA for every mailbox

The NCSC recommends multi-factor authentication (which some services call 2-step verification) to add security to your logins.⁴ Its small business guidance goes further and says that where your email provider supports passkeys, "you should enable them for staff accounts as a priority", because passkeys cannot be intercepted, reused or stolen like passwords.⁶ The NCSC links to instructions for Microsoft Outlook and Gmail.⁶ If you can't move to passkeys yet, an authenticator app is far better than nothing. Our guide on what cyber insurers ask about MFA covers how to evidence this.

Set up SPF, DKIM and DMARC on your domain

These three DNS records make it hard for criminals to send email that claims to come from your domain. SPF lists who may send for you, DKIM signs your mail, and DMARC tells receiving servers what to do with mail that fails those checks, and sends you reports.⁷ The NCSC's free email security check will test whether your domain is set up correctly.⁷ This protects your customers and suppliers from fake invoices "from you" as much as it protects you.

Use the email security you already pay for

If you have Microsoft 365 Business Premium, you already have Defender for Office 365 Plan 1, which Microsoft says protects email "from zero-day malware, phishing, and business email compromise (BEC)". It adds user and domain impersonation protection, Safe Links and Safe Attachments.⁸ Many businesses own this licence and have never switched the impersonation settings on. Add your directors and finance team as protected users and your key suppliers as protected domains.

Check mailboxes for forwarding and inbox rules

Ask whoever looks after your Microsoft 365 or Google Workspace to block automatic forwarding to outside addresses and to review existing inbox rules. Rules that forward mail externally or move messages containing words like "invoice" or "payment" are a classic sign of a compromised account.

Where endpoint protection fits

To be straight about it: endpoint protection (including the CrowdStrike Falcon service we sell) does not stop a criminal who logs into your cloud mailbox with a stolen password from somewhere else. What it does is stop the malware and infostealers that harvest passwords and session cookies from your own devices, which is one of the routes into a mailbox. It is one layer, not the answer to BEC. MFA, email security and your payment process do the heavy lifting here. If you want to understand the endpoint side properly, see What is EDR?

If you think you have been caught

Speed matters. Stay calm, but act in the first hour: the sooner your bank knows, the better the chance of stopping the money moving on.

1. Phone your bank now, using the number on its official website or your card, not one from an email. Ask it to contact the receiving bank.
2. Report it to Action Fraud on 0300 123 2040 or online. In Scotland, call Police Scotland on 101.⁹
3. Secure the mailbox: reset the password, sign out all sessions, check MFA methods for anything you didn't add, and remove unknown inbox rules and forwarding.
4. Warn your suppliers and customers if your account was used to send messages, so they don't pay a fake invoice from you.
5. Consider the ICO. If the attacker could read mailboxes containing personal data, this may be a personal data breach. Reportable breaches must be reported within 72 hours of becoming aware.¹⁰
6. Tell your insurer if you have cyber or crime cover, and check your policy's notification conditions.
7. Report it to the NCSC if it was a wider cyber incident.¹¹

If you're working through an incident now, our had a breach page lists who to contact. Then go back and put the payment rules above in place. It's the step that stops it happening twice.

Common questions