Email keeps your business moving. You use it to talk with employees, work with vendors, approve purchases and manage payments. Scammers know it too, and they build their scams around that trust.
Business email compromise or BEC, is a scam where criminals send messages that appear to come from a trusted source, then use that trust to get you to send money or share sensitive information.
According to the FBI, these scams take on many forms. You might receive what looks like an updated invoice from a longtime vendor. An employee might get an urgent request that seems to come from a company executive. A scammer might even insert themselves into an existing conversation about a payment or invoice.
The message may seem legitimate initially. Knowing the warning signs can help safeguard your business.
Understand How Business Email Compromise Works
Business email compromise succeeds because scammers make their messages look familiar. They may create an email address or website that closely resembles a legitimate one, sometimes changing only a letter or two. They may also use phishing emails to gain access to company accounts, calendars, or other information that makes a future scam more convincing.
The FBI also warns that criminals can use malicious software to access legitimate email conversations about billing and invoices. That access lets them time fraudulent payment requests to fit naturally into an existing conversation.
A suspicious email will not always come from someone you have never heard of. It may appear to come from someone or a company you work with regularly.
Look Closely Before You Click or Pay
Small details can reveal a fraudulent message. Before responding to an unexpected email, look closely at the sender’s full email address, any URLs in the message, and the spelling throughout. Scammers often utilize small changes that are easy to miss when you are moving quickly.
Be especially cautious with messages asking you to:
- Change an account number or payment method
- Send a wire transfer or other payment
- Purchase gift cards
- Update or verify account information
- Open an unexpected attachment
- Act immediately or keep the request confidential
Urgency should slow you down, not speed you up. The FBI advises extra caution whenever someone pressures you to act quickly.
Verify Payment Changes Another Way
One of the most important steps your business can take is verifying changes involving money independently.
If a vendor emails new payment instructions, or someone requests an unusual purchase or transfer, do not rely on the email alone. Contact the person or business using a phone number you already have on file, not one included in the message.
Make that extra verification step part of your normal process. It helps employees feel comfortable slowing down, even when a request appears to come from a manager, executive, or longtime business partner.
Protect Your Business Accounts
Good account security adds another layer of protection. Enable multi-factor authentication (MFA) on all accounts that support it. This adds an extra verification step during login, rather than relying only on a password.
Be careful about the information you and your employees share publicly too. Personal details posted online or on social media can give scammers what they need to guess passwords, answer security questions, or make a fraudulent message look more convincing.
When an unsolicited email or text asks you to update or verify your account information, do not click the link. Go directly to the company’s website or contact the company using information you already trust.
Be Careful with Attachments
Treat an unexpected attachment with the same scrutiny as an unexpected payment request. Avoid opening attachments from people you don’t know, and stay cautious even when a familiar contact forwards one. If something feels off, confirm with the sender before opening it.
A quick check takes a few minutes. Recovering from a fraudulent payment or a compromised business account can take much longer.
If You Think Your Business Has Been Targeted, Act Quickly
If you believe your business sent money because of a business email compromise scam, contact your financial institution right away.
Report business email compromise scams to the FBI’s Internet Crime Complaint Center at IC3.gov as well.
Even if a suspicious email does not lead to a payment, use it as a chance to review what happened and make sure everyone involved knows what to watch for next time.
If you believe your First Financial business account has been targeted in a BEC scam, contact us directly at 732-312-1500.
A Few Extra Minutes Can Protect Your Business
Email is an essential business tool, but convenience should not replace verification. Take a closer look whenever a request involves money, account information, or an unexpected change in procedure. Verify unusual requests through a separate communication method, protect your accounts with multi-factor authentication, and stay cautious when someone pressures you to act immediately.
When something doesn’t look or feel right, slowing down and confirming the request is one of the simplest ways to protect your business. For more on the tactics scammers are using right now, visit the Important Alerts & Scams page of our First Scoop Blog.
