Business email compromise and fake bank detail changes: how to spot them and protect your company

Business email compromise is email fraud in which a fake supplier, or a supplier's genuinely compromised mailbox, sends new bank details so that invoices are paid into an account controlled by criminals. The main defence is a simple rule: every change of bank details is confirmed by phone, on a number you already hold. Technical email protections reduce the risk, but they do not replace that habit.

The email looks like any other: the same supplier, the same tone, the same signature at the bottom. Only one detail has changed, the payment details. A few weeks later the supplier rings to chase payment, and by then the money is long gone. Here is how this kind of fraud works and how to protect your company.

How does business email compromise work?

Business email compromise works by exploiting trust and routine: a convincing message arrives from a known contact, or what looks like one, asking you to update bank details or make a payment. It needs no malware and no technical skill on the victim's side. There are four common patterns.

• The fake bank detail change. A message, apparently from a supplier, announces new bank details “following a review of our banking arrangements”, sometimes with an altered invoice attached.
• The fake executive. Someone posing as the owner or a director asks for an urgent, confidential payment, perhaps for a deal that must not be discussed with anyone else.
• The genuinely compromised mailbox. The most insidious version: the attacker has gained access to the supplier's real mailbox, or yours, reads ongoing conversations and steps in at the right moment, replying within an existing thread in a perfectly convincing tone.
• The lookalike domain. The sender's address is almost identical to the real one: a swapped letter, an extra hyphen, a different extension. At a glance, on a phone, the difference is invisible.

Because these messages carry no harmful attachments or suspicious links, they often pass spam filters untouched. Stopping them falls to someone who notices that something does not add up.

How do you spot a fraudulent email?

A fraudulent email is recognised mainly by what it asks for, rather than how it looks. No single sign is proof, but some should always make whoever handles payments stop and think:

• any request to change bank details, even from a regular contact;
• urgency and secrecy together: “it has to be done today”, “don't mention this to anyone”;
• small differences in the sender's address, or a reply-to address that differs from the sending one;
• an account held in a name other than the supplier's, or in a country you have no dealings with;
• a slightly unusual tone, odd phrasing, or mistakes from someone who does not normally make them;
• a request not to phone because the sender is “in a meeting” or “abroad”.

Recognising these signs does not come naturally to people who have never seen fraud up close. Targeted cybersecurity training for finance and purchasing staff, using realistic examples, turns your people into the company's first filter.

Which internal rules protect against fraudulent payments?

A few written rules, known and followed by everyone, the owner included, protect against fraudulent payments. The most effective defence against this kind of fraud is organisational before it is technical.

1. Every bank detail change is confirmed by phone, calling the supplier on a number already held on file or in the contract, never the one given in the email requesting the change.
2. Dual approval for any change to bank details and for payments above a set threshold.
3. No exceptions for urgency: a request that cannot wait for a check is a warning sign in itself.
4. A change log: who requested the change, who verified it, when and how.
5. Extra care with first payments to a new account, especially large ones.

These rules only work if they apply to everyone. When an urgent request appears to come from the owner, finance staff need to know they are allowed, indeed expected, to check it.

Is the bank's verification of payee enough?

Verification of payee helps, but it is not enough on its own. Since October 2025, banks and other payment providers in the euro area have had to offer a check on euro transfers that flags when the name entered does not match the holder of the IBAN. It is a real step forward against this kind of fraud.

It has limits, though. The warning has to be read and taken seriously rather than clicked through out of habit, and a fraudster can use an account in a plausible name that triggers no alert at all. A phone check with the supplier therefore remains the main safeguard, with the bank's check as an additional safety net.

Which technical measures protect company email?

Company email is protected by measures that reduce both the chance of a mailbox being compromised and the chance of someone impersonating your company.

• Multi-factor authentication on every mailbox, so stolen passwords are useless on their own.
• SPF, DKIM and DMARC configured for your domain, with a policy telling receiving servers to reject or quarantine spoofed messages.
• Anti-phishing filters and link and attachment scanning, with a visible tag on external messages.
• Automatic forwarding to external addresses blocked, and alerts on newly created mailbox rules, a typical sign of a compromised account.
• Monitoring for unusual sign-ins, for example from unexpected countries or from several places within an impossible timeframe.

These measures belong to a broader approach to business cybersecurity: email is the most common way in, but protection works when it is consistent across accounts, devices and network.

What should you do if you have paid into a fake account?

If you have paid into a fake account, contact your bank immediately: time is the factor that matters most in trying to recover the money. Then, in this order:

1. Ask the bank to recall the transfer and find out which procedure to follow.
2. Report it to the police, keeping the emails, attachments and payment receipts.
3. Secure your email: change the passwords of the mailboxes involved, check for unknown forwarding rules or sign-ins, and make sure multi-factor authentication is on.
4. Let the supplier know, as they may have been compromised themselves and have other customers at risk.
5. Consider data protection obligations: if personal data has been exposed, work out with whoever handles data protection whether the breach must be reported to the supervisory authority, which has to happen within 72 hours of becoming aware of it.

Email fraud works because it slips into everyday routine. For the same reason, the most effective countermeasures are habits: one extra phone call, a second signature, the right setting on your email. Building them once, around the way your company actually works, costs far less than a single lost payment.

Training, email protection and incident response are the work of Cybernix, VAY's cybersecurity division.

If you would like to know how exposed your business is to this kind of fraud, get in touch: we can review your payment procedures and email configuration together.

Frequently asked questions

What is business email compromise?

Business email compromise (BEC) is fraud in which someone poses by email as a supplier, customer or executive to obtain a payment or confidential information. It often contains no malware or harmful links, which is why it slips past traditional filters.

How should a bank detail change request be verified?

By phoning the supplier on a number already held on file or in the contract, never the one given in the email requesting the change. The change should only be recorded after confirmation and, ideally, approved by a second person.

What should I do if I have paid into a fraudulent account?

Contact your bank immediately to request a recall of the transfer: acting quickly improves the chances of recovery. Then report it to the police, secure the mailboxes involved and let the supplier know.

Does the bank's verification of payee protect against this fraud?

It helps, because it flags when the name entered does not match the account holder, but it is not enough on its own. Warnings need reading carefully, and a phone check with the supplier remains the main safeguard.

What are SPF, DKIM and DMARC for?

They are records configured on your email domain that let receiving servers check whether a message really comes from your company. With a strict DMARC policy, spoofed emails sent in your domain's name are rejected or quarantined.