Business email compromise: how wire fraud happens and how to stop it
Business email compromise cost US victims about $2.8 billion in 2024, according to the FBI. Most cases start with a convincing email asking for a payment detail change.
- Published
- Reading time
- 1 min read
The FBI's 2024 Internet Crime Report lists business email compromise as one of the costliest crimes reported, at about $2.77 billion in losses. It rarely involves hacking a bank. It involves an email.
How it happens
- A criminal watches or spoofs an email thread with a supplier.
- An email arrives: "We have changed banks; please use these new details."
- The payment goes to the new account and moves on within hours.
Variants include fake CEO requests and lookalike domains with one letter changed.
Controls that work
| Control | What it stops |
|---|---|
| Call back on a known number before changing any payee details | Changed bank detail fraud |
| Second approver for new payees and large payments | One person being fooled |
| Payee name checks where available | Mismatched account names |
| Hold period on changed details | Rushed fraud |
| Staff training with real examples | Lookalike domains |
In the first hours
- Call your provider and ask for a recall.
- File a complaint at ic3.gov.
- Preserve every email and header.
See what to do if you wired money to a scammer.
Paying into the United States: the local rail
| What | Detail |
|---|---|
| Local rail | ACH for batch payments; RTP and FedNow for instant transfers |
| Run by | Nacha for ACH; The Clearing House for RTP; the Federal Reserve for FedNow |
| Settlement | Same-day ACH within the business day, standard ACH the next; RTP and FedNow in seconds, 24/7, where both banks take part |
Source: Nacha: Same Day ACH. Checked when this guide was last updated; the scheme's own page has the current figures.
Where Rivet fits
Rivet's approvals on Growth let one person prepare a payout and another release it, and new payees are saved with their details so changes are visible. Rivet is not a bank; regulated partner institutions hold the funds. See invoice fraud and payment detail scams.
Questions people ask
What is business email compromise?
Fraud where criminals impersonate a supplier, executive or partner by email to redirect a payment.
How much is lost to BEC?
The FBI's 2024 Internet Crime Report put BEC losses at about $2.77 billion.
What is the best defence?
Call back on a known number to verify any change of payment details, and require a second approver for new payees.
What do I do if I paid a fraudster?
Call your bank at once to recall the payment, file at ic3.gov, and keep all emails. Speed matters.
Sources
Alexia compares the accounts, cards and payment tools companies weigh before they switch, and writes Rivet's market guides for founders in a specific country. Prices in Alexia's comparisons come from each provider's own pricing page on the date given in the article, rules come from the regulator or tax authority that sets them, and every source is listed at the end.
More from Alexia M. →This article is general information, not legal, tax or financial advice. Rules and fees change; check the sources above and the provider’s current terms before you act on them.
- business email compromise
- wire fraud
- bec
- invoice fraud
- payment fraud
- ic3
