Business email compromise: the $50K wire fraud hiding in your inbox.

A Charlotte-area professional services firm called us a few months ago. Their bookkeeper had wired $54,000 to what she thought was a long-standing vendor. The email chain looked normal — same subject line as the last invoice, same signature block, same tone. The vendor's real controller called two weeks later asking where payment was. The money was gone by then, moved through three accounts and out of the country.

No malware. No ransomware. No dramatic headline. Just business email compromise (BEC) — the quiet fraud that, according to the FBI's Internet Crime Report, drains billions of dollars out of U.S. businesses every year, most of it from small and mid-sized companies.

Here's how BEC actually works, why email filters don't catch it, and the process every SMB should adopt before the next fake invoice lands.

What BEC actually is

Business email compromise is a category of fraud where an attacker either takes over a real business email account, or convincingly impersonates someone with authority (your CEO, your vendor's controller, your law firm's partner), and uses that trust to move money. The FBI public service announcement on BEC notes the same pattern we see in every case: it's a social engineering play, not a technical exploit.

There are three flavors we see most often in SMBs:

• Vendor invoice fraud. Attacker compromises a mailbox at one of your vendors, watches for a real invoice going out, then intercepts the reply and provides “updated bank details” from an account they control. This is by far the most common at SMB scale.
• Executive impersonation. A spoofed or lookalike email from “the CEO” to a finance staffer asking for a quick, confidential wire. Often paired with a plausible reason (acquisition, urgent tax bill, retainer to a new law firm).
• Payroll redirect. Attacker phishes an employee's HR portal login, then submits a direct-deposit change form. Paycheck goes to a prepaid debit card the day it hits.

In all three, no ransomware runs. No file gets encrypted. Nothing looks broken. The first sign of trouble is usually the follow-up call from the real vendor two weeks later.

Why your email filter misses it

Every SMB owner we've talked to about BEC says the same thing: “We have Microsoft 365 with all the security add-ons.” That doesn't help here, and here's why.

Email filters are built to catch three things: malicious attachments, malicious links, and known bad senders. BEC emails have none of those. Look at what a modern BEC email actually looks like:

• Sent from a real, aged mailbox that the attacker has taken over — often your actual vendor's mailbox. Domain reputation is perfect.
• No attachment, or a PDF invoice that the vendor genuinely uses (sometimes the attacker copies it from a real prior invoice).
• No links, or only a link to a legitimate service like Docusign or a real bank's ACH portal.
• Correct grammar, correct signature block, correct thread context — because the attacker has been reading the mailbox for weeks.

To an email filter, this is indistinguishable from a normal business email. It is a normal business email. The only thing that changed is one line: the routing and account number.

This is why the FBI's own guidance on preventing BEC leads with process controls, not email filtering. See CISA's joint advisory on BEC.

How the fraud actually plays out

The pattern we see across almost every case is the same. Once you can name each step, they become surprisingly easy to interrupt.

Step 1: Access

The attacker gets into a mailbox somewhere in the payment chain. Usually not yours — more often a vendor, a title company, a law firm, or a construction sub you work with. Access typically comes from a phished credential where MFA wasn't enforced, or from an OAuth consent to a malicious “productivity” app.

Step 2: Reconnaissance

The attacker sits quietly for one to six weeks, reading email. They learn who sends invoices, who signs off, what dollar amounts are normal, which vendors are on ACH vs. check vs. wire, and when the next big payment is due. They build an inbox rule that quietly moves any reply containing certain keywords into a hidden folder, so the real user never sees inbound alerts.

Step 3: The switch

When a real invoice goes out (or when a big payment is due), the attacker replies from the compromised mailbox with a short note: “Quick heads up — our bank changed to XYZ. Please update on your end for this payment and future ones. New wire instructions attached.” The attached PDF is a doctored copy of the real vendor's remittance sheet with a new account number.

Step 4: The wire

Your controller wires the money. There's no fraud on your side of the transaction — the wire goes exactly where the paperwork said to send it. The bank processes it as authorized. The FBI's recovery guidance notes that unless you catch it within about 72 hours and file a Financial Fraud Kill Chain request, recovery is unlikely.

Step 5: The gap

Two to four weeks later, the real vendor calls asking about payment. That is usually when the business realizes what happened.

The North Carolina angle

For any business subject to N.C. Gen. Stat. § 75-65, BEC that involves compromise of an employee mailbox holding client or employee personal information is a reportable security breach, not just a fraud incident. If the mailbox held W-2s, financial account numbers, driver's license numbers, or medical information, you likely owe notice to affected individuals and, above the threshold, to the N.C. Attorney General. Insurance and legal counsel should be involved from day one.

What actually stops BEC

Because BEC is a social engineering and process attack, technical controls alone don't stop it. The businesses we see beat it are the ones that build controls into how money moves, and reinforce those controls with a few specific technical guardrails.

What WHT recommends

An action checklist any SMB can implement in a week or two:

1. Adopt a written dual-control wire policy. No wire or ACH over a set threshold (we default to $5,000 for SMBs) goes out on one person's authority. Two people, documented approvals, in a system that keeps a log.
2. Mandatory out-of-band callback for any bank-detail change. If a vendor emails to say their banking details changed, the ONLY acceptable verification is a phone call to a number you already had on file — not a number in the email. Same rule for the CEO asking finance for a wire: verbal confirmation from a known number.
3. Enforce phishing-resistant MFA on every mailbox. Not SMS. Not push-only. Number matching or FIDO2 hardware keys for anyone with financial authority. This is what prevents the initial mailbox takeover.
4. Publish DMARC at p=reject. DMARC, SPF, and DKIM won't stop a real compromised mailbox — but they will stop cheap lookalike domains and spoofed CEO impersonation. Every domain you own should be at DMARC p=reject.
5. Audit inbox rules monthly. Almost every BEC we investigate involves an attacker-created inbox rule that hides responses. Sweep your finance-team mailboxes monthly and flag any rule that auto-moves, auto-forwards, or auto-deletes.
6. Train the finance team on the pattern — not on typos. Once your controller and bookkeeper know exactly what a “bank details changed” email looks like and what the callback rule is, they will catch the next one. Most training programs still teach 2018-era “spot the typo” nonsense that doesn't apply.
7. Have a 72-hour incident playbook. If a wire goes out to the wrong account, the first four hours matter. Playbook: call the bank's wire recall desk, file with the FBI IC3, notify insurance, engage counsel, preserve the mailbox and headers. Don't figure this out under pressure.

The bottom line

BEC does not look like a cyber attack. It looks like a boring email about invoices. That is exactly why it works, and why it costs SMBs more, in aggregate, than the ransomware that gets the headlines.

The good news is that BEC is one of the most preventable attacks out there. A written wire policy, a callback rule, phishing-resistant MFA on finance mailboxes, and a monthly inbox-rule sweep — four controls — will stop the overwhelming majority of it. None of them require a big security budget. All of them require someone to actually own them.