How do we stop fake invoices and wire-transfer fraud sent by email?
Short answer
Treat every request to change payment details as suspicious until it's verified by phone, using a number you already had, not one from the email. Add multi-factor authentication so your own mailboxes can't be taken over, set up email authentication so criminals can't send as your domain, and train the people who move money.
Draft · pending expert review
Business email compromise is simple and devastating: a convincing email asks someone to pay an invoice or change bank details, and the money goes to a criminal. The FBI consistently ranks it among the costliest cybercrimes.
A process that stops it
- Verify by phone any new or changed payment instructions, using a number from your records
- Require two people to approve wires and bank-detail changes above a threshold
- Slow down urgent requests. Urgency is the attacker's favorite tool
Technology that helps
- Multi-factor authentication on every mailbox
- SPF, DKIM, and DMARC so nobody can send email as your domain
- Email protection that flags impersonation and lookalike domains