Guide · Updated 2026-10-19 · By The PayOrScam team
Business email compromise (BEC): a prevention checklist for small businesses
Business email compromise (BEC) is when a criminal hijacks or imitates a real email account (a supplier, a client, or your own boss) and uses it to request a payment or a change of bank details. The FBI's IC3 counted 305,033 incidents and about $55.5 billion in exposed losses worldwide between October 2013 and December 2023, and roughly $3.05 billion in reported BEC losses in 2025 alone.
How a typical BEC attack works
Account takeover: a supplier's or colleague's mailbox is compromised by phishing, and the criminal replies inside a real email thread.
Spoofing or lookalike domains: the email appears to come from a known address, or from a near-identical domain (an extra letter, a different ending).
The ask: "our bank details have changed", an urgent wire for a deal, or a request for staff personal data.
Warning signs
A change of bank details, especially to a new bank or country
Urgency, secrecy or "I'm in a meeting, just get it done"
A reply-to address that differs from the sender, or a domain that is one character off
A request that skips your normal approval steps
Prevention checklist
Verify every bank-detail change out of band. The FBI recommends using secondary channels to verify changes in account information: call a number from your own records, never one in the email.
Require two people to approve new payees and payments above a set threshold.
Turn on multi-factor authentication for every email account, and use unique passwords.
Set up email authentication (SPF, DKIM and DMARC) on your own domain so criminals find it harder to spoof you. The FTC explains how in its small business cybersecurity guidance.
Show full sender addresses on staff computers and phones, and check them character by character.
Watch for mailbox forwarding rules you didn't create; attackers use them to hide replies.
Train the people who pay invoices. A short, regular reminder of these signs is the FTC's "best defense".
Have a plan for when it happens: call your bank to request a recall, then report to IC3 (US) or Action Fraud (UK) straight away. The FBI says time is of the essence.
Before you pay a request that arrived by email, paste the sender's address, website or invoice into PayOrScam. It checks the domain's age, lookalike spelling, mail records, the company register and the bank details, with a source for every finding. Then make the confirmation call.