Business Email Compromise Wire Fraud: Stop a Fake Invoice Payment

Recognize the payment instruction that changed

Business email compromise, or BEC, often appears inside a legitimate-looking discussion about an invoice, closing statement or supplier contract. Criminals can spoof a sender address, compromise an employee's mailbox or insert themselves into an existing email thread. The requested change may be subtle: a new beneficiary name, updated bank account, alternative payment date or urgent request to bypass the normal approval process. The FBI describes these as social-engineering and account-compromise schemes, not merely generic spam. The fact that an email mentions correct invoice numbers or previous correspondence does not confirm that its banking instructions are genuine.

Imagine a supplier normally receives $26,000 by wire at one bank. An email arriving two days before payment says its “audit team” moved accounts and demands a different beneficiary. A bookkeeper who calls a number inside that same email has not independently verified anything—the phone number could belong to the criminal. The control that matters is confirmation through a trusted channel established before the request. A named authorized contact, a known telephone number and a second approval for changed payment details can prevent an otherwise plausible invoice from becoming a permanent transfer of operating cash.

Act in the first hours after sending funds

When fraud is suspected after a transfer, call your bank's wire-fraud or business treasury team immediately using a known official number. Provide the payment date, amount, destination bank, beneficiary account details and transfer confirmation so the institution can attempt a recall and alert the receiving institution. Ask for a documented escalation number and whether the payment is pending, settled, under review or already disbursed onward. The FBI advises victims to contact their financial institution promptly and request contact with the destination institution. Do not wait for the vendor's next business day or an insurance company to decide whether the claim is covered.

File a BEC report with the FBI Internet Crime Complaint Center at IC3.gov and provide complete details. Depending on the amount, circumstances and available services, contact local FBI authorities or law enforcement as instructed. These reports do not guarantee recovered money, but prompt contact can help institutions identify accounts before further withdrawals. Avoid a second alleged “recovery firm” charging upfront fees or asking for crypto; secondary scams target victims who are desperate after a wire loss. Meanwhile, freeze any remaining unapproved payment instruction and use a previously authenticated contact method to tell the real supplier what occurred.

Separate bank recovery from the fraud investigation

A bank's wire recovery request, a formal fraud investigation, a contractual dispute over invoices and any cyber insurance claim are different processes. A recall request asks another institution to cooperate in returning funds; it is not equivalent to a debit-card chargeback or a statutory guarantee. Whether the transfer was authorized by your staff under deception, originated without authorization, or altered by a bank processing error matters to the legal and practical analysis. Do not describe every BEC transfer as a Regulation E consumer unauthorized transfer, particularly when a business account and an employee-approved wire are involved.

Ask the bank what it knows about the payment's path, what evidence it requires and which decisions can still be made quickly. Contact your insurer or counsel for coverage and contractual questions, but avoid delaying time-sensitive bank action to complete a formal legal letter. A $26,000 wire sent to a fraudulent new beneficiary creates at least two bookkeeping issues: the cash may be gone, and the legitimate supplier may still consider its invoice unpaid. Record the cash event, potential claim and vendor status separately until documents establish otherwise. Never mark the genuine supplier “paid” purely because the bank issued a wire confirmation.

Preserve the electronic trail for investigators

Save original message files with headers when possible, not only screenshots of text. Record sender and reply-to addresses, domain spellings, changed attachments, payment instructions, telephone numbers, timestamps and the employee who authorized the payment. Keep the signed original contract and previous invoice instructions so investigators can identify exactly where the divergence occurred. An attacker may still have access to a mailbox and can delete evidence or intercept recovery emails. Work with the organization's security administrator to reset credentials, revoke sessions, preserve logs and inspect mail-forwarding rules while maintaining relevant records.

Keep one incident timeline: real invoice received, fraudulent update arrived, callback attempted, payment authorized, funds sent, suspected compromise identified, bank notified and IC3 report filed. This chronology supports both the bank's recovery team and subsequent insurance or accounting work. Do not circulate full account numbers unnecessarily throughout the company. Use restricted evidence storage and verify that only authorized staff can contact the bank on the company's behalf. If the incident involves customer personal data, ask counsel or security specialists whether additional notification duties apply; the answer depends on facts and jurisdiction, not simply the size of the lost wire.

Rebuild vendor payment controls without stopping business

A useful prevention rule is to treat every new or changed payee bank instruction as an exception requiring confirmation outside email. Confirm changes using a known telephone number from the original vendor record, not a number in the change request. Use dual approval for high-value wires, separate vendor-master-data editing from payment release, and document who independently validated beneficiary details. Where your bank offers positive-pay or payee controls, understand their specific coverage; check positive pay does not necessarily protect outgoing wires. Review access permissions and logging for the payment platform and treasury portal.

Controls also need practical failure modes. Train staff that a request framed as secret, urgent or endorsed by a senior executive is a reason to use verification, not bypass it. Keep an emergency channel for vendors with legitimately changed accounts so payments can proceed with evidence. Run small periodic checks on recently changed beneficiary instructions and compare them with supplier records. Business email compromise succeeds when a trusted conversation is treated as a verified payment instruction. The corrective design is therefore independent identity and bank-detail confirmation, plus a response process fast enough to act before stolen funds move again.

Frequently asked questions

Can a bank guarantee a fraudulent business wire will be reversed? No. An urgent recall can be attempted, but recovery is uncertain.

Should I report a loss to IC3 if it seems small? The FBI advises reporting BEC incidents, regardless of dollar loss.

Is a reply in an old supplier email thread proof of legitimacy? No. A mailbox or thread may be compromised.

MyBankAnswers Editorial Verdict

Business email compromise is a payment-control failure often wrapped in convincing operational detail. If a wire has already gone, act first through your bank's fraud and wire team, then report to IC3 and preserve messages with their headers. Do not promise recovery or mix business wire disputes with consumer debit-card protections. Preventing the next loss requires verified beneficiary change procedures, dual approval, restricted portal rights and employee training built around real invoice workflows. A legitimate vendor may still be owed money after the fraudulent payment, so keep accounting and contractual claims distinct. Independent callback verification before releasing funds is far cheaper than a recovery effort after they leave.

Sources and verification

• FBI IC3: Business Email Compromise
• FBI: Common Frauds and Scams — Business Email Compromise
• FinCEN: Advisory on Email Compromise Fraud