A business email compromise scam rarely looks like an obvious scam. It usually looks like an ordinary invoice, or a short note from someone you already do business with, saying the bank account on file has changed. Real estate closings, title transfers, and accounting departments are favorite targets because big transactions and last-minute changes are already normal there, and because the wiring instructions, invoices, and account numbers involved already travel by email in the first place. A scammer only has to compromise one inbox in a long chain of buyers, sellers, agents, title companies, and accountants to time a convincing, well-informed request. This guide covers how to verify any change in payment details before you act on it, how to spot a lookalike sender address, and exactly what to do if a fraudulent transfer already went out.
How to catch a business email compromise scam, step by step
!Would you catch the change?
An invoice looks perfect, right up until the bank account on it quietly changes.
1Verify by phone, not email
Any time a bank account or payment method changes, call a known number to confirm it, never a number from the email.
2Look past the display name
Check the actual email address, not just the name shown, for a misspelled domain or an extra letter.
3Call your bank immediately
Ask for a wire recall, and give them any documents they need. Minutes matter.
A few tips
- Slow down on urgency — “Wire it today” or “keep it quiet” are red flags, not reasons to hurry
- Use a second channel for big changes — A phone call or text to a known number, never the same email thread
- Train everyone who touches money — Not just accounting; agents, assistants, and anyone who approves a payment
Recap: business email compromise and wire-fraud scams
- Any bank-account or payment change gets a phone call to a known number
- Check the real email address, not just the display name
- If you already sent money, call your bank immediately for a recall
- Report it at ic3.gov so law enforcement can help
Printable quick guide
Frequently asked questions
What is business email compromise?
A scam, also called email account compromise, that targets businesses and individuals who perform legitimate transfers of funds. It’s usually carried out after a scammer compromises a real business or personal email account, through social engineering or a computer intrusion, and uses it to request an unauthorized transfer or a change in payment details.
Why do real estate, title, and accounting offices get targeted so often?
Because big transactions move on tight deadlines, so a last-minute change in payment type or bank account doesn’t always get a second look. Wiring instructions and invoices already travel by email, and a real estate deal involves several trusting parties, buyer, seller, agent, title company, and lender, so compromising just one of their inboxes can be enough to fool the rest.
How do I verify a changed bank account or invoice is real?
Call a phone number you already have on file for that person or company, never a number written in the email itself, and ask them to confirm the change directly. Also check the actual sending email address, not just the display name, for a misspelled domain or an extra letter.
What should I do if I already wired money to a scammer?
Call your bank immediately and ask for a wire recall, along with whatever documentation they need; time matters. Then file a complaint at ic3.gov, the FBI’s Internet Crime Complaint Center, regardless of the amount lost, since it can help both your financial institution and law enforcement with recovery.
Related guides
- The First Hour After a Cyberattack (Small Business)
- Email Security Explained: SPF, DKIM, DMARC in Plain English
- What to Do If Your Email Was Hacked
Source: Business Email Compromise: The $50 Billion Scam (FBI IC3 PSA I-060923-PSA)