ScamCatchers Check a vendor

Fake invoice and CEO email scams: how businesses get tricked into wiring money

Not all scams target your heart. Some target your accounts-payable inbox, and they are the most expensive scams there are.

Business email compromise does not look like a scam. It looks like Tuesday. An invoice from a vendor you actually use. A note from your CEO, who really is travelling this week. A supplier letting you know they changed banks. The email is plausible because the scammer did their homework: they know who you pay, who signs off, and when the boss is out of reach. The only thing wrong is the bank account at the bottom.

The three versions you will see

The fake invoice

An invoice arrives for services or goods that sound like something you would buy: office supplies, a domain renewal, a directory listing, a software subscription. The amount is modest, below the threshold that would make anyone look twice. Busy AP departments pay it. Sometimes the "vendor" then sends a second one.

The vendor with new bank details

A real supplier, or an email that looks exactly like one, writes to say they have changed banks and asks you to update their payment details. The next real invoice gets paid to the scammer's account. This version is the costliest, because the amounts are whatever you normally pay that vendor. The email often comes from a lookalike domain, or from the vendor's actual mailbox after it was compromised.

The urgent request from the CEO

"I'm in a meeting and can't talk. I need you to wire $48,000 to this account for a deal we're closing today. Keep it confidential until I announce it." It is sent to someone who can move money, at a time the executive is known to be unavailable, with just enough detail to sound like an insider. The secrecy is the point: it prevents the one phone call that would end it.

The tells

• The domain is almost right. acme-corp.com instead of acmecorp.com; an rn where an m should be; .co instead of .com. Read the sender's address character by character, not the display name.
• Reply-to goes somewhere else. The From address looks right; the Reply-To is a free webmail account. Most mail clients hide this unless you look.
• Urgency plus secrecy. "Today." "Before end of day." "Don't loop anyone else in." Legitimate finance does not run on secrecy.
• A request to bypass the process. Skip the PO, skip the second signature, pay before the paperwork. The process exists precisely for this moment.
• New bank details by email alone. No legitimate vendor objects to a phone call confirming a change to where their money goes.
• Timing. The request arrives while the person it claims to be from is on a plane, in a conference or on vacation, and everyone knows it. That is not a coincidence; it is reconnaissance.

How to verify a vendor or company

Before you set up a new payee, or when something about an existing one feels off, run a Business Search on the company name and domain. It checks:

• whether the business is registered where it says it operates,
• its Better Business Bureau and Trustpilot history, and what the wider web says when it names the company specifically,
• enforcement actions and scam reports against it,
• how old the website domain is and whether it appears on threat lists.

A vendor that has existed for years leaves a trail. A "vendor" created for a single invoice has a domain registered last month and nothing else. If the email came from a person, a Name Search and a Phone Number Search on the contact details tell you whether that person and number exist in connection with that company.

If money already went out

Call your bank immediately and ask for a recall of the wire. Banks can sometimes freeze funds if contacted within hours. Report to the FBI's Internet Crime Complaint Center at ic3.gov, which has a recovery process specifically for business wire fraud. Preserve the emails, headers included. Then check whether a mailbox in your company was compromised, because if the scammer read your real vendor correspondence, they are still reading it.

Frequently asked questions