You’re working through a busy inbox when an email arrives from a familiar vendor. There’s an updated invoice attached and a note asking you to use new payment details. It looks routine, so you send the payment.
That one message may have been enough to put company funds, email accounts, customer information, and workdays at risk.
Business email compromise is a scam in which criminals impersonate or take over a trusted email account to trick people into sending money or sharing sensitive information. The FBI’s 2024 Internet Crime Report recorded 21,442 complaints and about $2.77 billion in reported losses attributed to business email compromise. Those numbers describe reported losses, not every cost a business might face.
This kind of phishing attack doesn’t require anyone to be careless or uninformed. A convincing message can reach a capable employee at just the wrong moment. Here are seven ways one bad email can become a much bigger problem, and practical steps that help reduce the risk.
1. A wire transfer goes to the wrong account
A message appears to come from a company executive: “I need this handled before the end of the day. Please keep it confidential.” It asks for an urgent wire transfer, sometimes with just enough detail to sound like a real business request.
Once sent, the money may be difficult to recover. A criminal may quickly move it through other accounts, so delay matters.
Business email compromise often works by exploiting normal workplace trust and time pressure. Don’t rely on an email alone to approve an unusual payment. Verify the request using a separate, trusted method, such as a phone number you already have on file. Don’t use the number in the message or simply reply to the email.
2. A familiar vendor’s invoice gets redirected
A scammer may send a fake invoice, or step into an existing email conversation and change the vendor’s payment instructions. This is one of the most common forms of business email compromise, and the request may look like routine paperwork, especially if your business receives regular invoices.
The immediate loss is only one part of the problem. Your team may also spend time investigating, contacting the real vendor, reconciling accounts, and sorting out who still needs to be paid.
Treat any change to bank details as something that needs independent confirmation, even if the message comes from a familiar address. Set a clear process so the person changing vendor information isn’t the only person approving the payment.
3. A password gets handed to a fake login page
Not every phishing email asks for money. A spoofed shipping notice, a document-sharing alert, or a message about an expired password may ask you to sign in through a link.
If the page is fake and you enter your password, a criminal can use those credentials to try to access your email or other work accounts. Reusing an easy password elsewhere can create more exposure. It’s a bit like using the same key for your office, storage room, and home: losing one key puts several doors at risk.
Turn on multifactor authentication (MFA) for business email and other important accounts. MFA asks for another proof of identity, such as an app prompt or security key, in addition to a password. It adds a hurdle for someone who has stolen your password, though it doesn’t replace other security measures.
4. Your mailbox is taken over and used against coworkers
If a criminal gains access to an employee’s mailbox, they may be able to read messages and impersonate that person. In a business email compromise attack, they might search for active payment conversations, set up rules to hide replies, or send convincing messages to colleagues and customers.
This can make the next scam harder to spot. A message may arrive from a real account, within a real email thread, with details lifted from the mailbox. That doesn’t make the request legitimate.
If you receive an unexpected request to pay, share a password, or open a file, pause and verify it out of band. A quick call to a known number can prevent a costly mistake.
5. Private business or customer information is exposed
A compromised mailbox may contain more than messages. It can include contracts, account details, customer information, employee records, or files sent as attachments. If a criminal can access or send that material, the business may need to determine what was exposed and who could be affected.
The right next steps depend on what information was involved and the rules that apply to your organization. Don’t guess or dismiss the issue. Get your IT or security contact involved promptly, preserve relevant messages, and follow your incident-response and notification procedures.
Email security helps reduce the chance that harmful messages reach people in the first place. It should be part of a broader plan, not a promise that every scam will be caught.
6. Everyday work stops while you investigate
A mailbox takeover or payment scam can turn into a workday of urgent tasks: changing passwords, reviewing sign-in activity, checking email settings, contacting vendors, and figuring out whether other accounts are affected.
While the team investigates, employees may lose access to email or pause normal work to avoid making the situation worse. That disruption has a cost even when no money was sent. Business email compromise can distract people from customers, orders, appointments, and other work that keeps the business running.
Keep your response steps simple and known in advance. Staff should know who to tell, and they should feel comfortable reporting a suspicious message, or an accidental click, without worrying that they’ll be blamed.
7. Trust and reputation take a hit
When a customer receives a fake message from a real business account, they may not know whether it’s safe to respond. A vendor may wonder if future payment requests are genuine. Even if the problem is contained quickly, the business may need to spend time explaining what happened and rebuilding confidence.
Clear communication helps. After an incident, coordinate with the people responsible for IT, leadership, and any required notifications. Avoid sending sensitive details through an account that may still be compromised.
Why business email compromise fools smart people
Many phishing messages tied to business email compromise are designed to fit into an ordinary workday. The sender name looks familiar. The request is plausible. The email arrives while you’re busy, or it claims there’s little time to act.
Some messages also rely on information criminals have gathered from public websites, earlier scams, or compromised accounts. A polished message isn’t proof that it’s real. CISA advises people to watch for urgency, unexpected requests, and suspicious links, and to verify through a separate contact method if a message seems questionable.
Practical layers that help prevent a costly business email compromise mistake
No single control catches every phishing email. These steps work best together:
- Use email filtering. Set up tools to screen spam, suspicious links, spoofed senders, and harmful attachments. Review and maintain the protections rather than assuming the default settings cover every risk.
- Turn on MFA. Require it for email and other high-value business accounts. Choose a stronger option, such as a security key, where practical.
- Verify payment changes by callback. Use a number already in your records, not one supplied in the new email. For significant payments, require a second person to approve the transaction.
- Train people with realistic examples. Teach staff to slow down around urgent payment requests, login links, gift-card requests, and unexpected attachments. Regular reminders are more useful than a one-time lecture.
- Monitor accounts and payment activity. Look for unusual sign-ins, unexpected mailbox rules, and changes to vendor details. Quick detection can help limit the damage.
For more on practical protection, explore Pinkston Technologies’ cybersecurity services and business email security and support. CISA’s phishing guidance and the FTC’s small-business phishing guidance offer additional steps you can share with your team.
If someone clicked or money was sent, act quickly
Tell your IT or security contact immediately. If a payment went out, contact your bank as soon as possible and ask whether it can be recalled or stopped. If an account may be compromised, secure it using a trusted device, change the password, review account activity, and revoke suspicious access or sessions with help from your IT team.
Keep the suspicious email and related payment records. If you believe your business has experienced fraud, report it to the FBI’s Internet Crime Complaint Center. The FBI’s 2024 Internet Crime Report explains the reported complaint and loss figures.
One email doesn’t have to become a major incident
A convincing phishing email can reach anyone, but it doesn’t have to lead to a costly outcome. Business email compromise is harder to pull off when payment requests are verified, accounts use MFA, email defenses are in place, and employees know how to report concerns quickly. The more prepared your team is, the less likely a business email compromise attempt is to turn into real financial loss or disruption.
If you’d like help improving your email security or cybersecurity for your small business in NYC, schedule a free consultation with Pinkston Technologies or call 212-328-1185. A practical review can help you find the gaps and decide what to address first.