The Invoice Was Genuine. The Bank Details Were Fake: Inside a Business Email Compromise Attack

Imagine receiving an invoice from a supplier you have worked with for years. The company name is correct. The branding looks familiar. The amount matches the expected payment, and the email arrives in an existing conversation.

You approve the payment.

Only later do you discover that the bank account details were changed. The supplier never received the money, and the email that appeared to come from them may have been sent by someone who had gained access to the conversation or impersonated the supplier.

This is the reality of business email compromise (BEC), a form of cyber-enabled fraud that exploits trust, business relationships and weaknesses in email security.

Unlike attacks that rely on obvious malicious attachments or suspicious links, BEC can look remarkably ordinary. The criminal may not need to break into a financial system. They may only need to influence one payment decision.

For businesses, the consequences can extend beyond financial loss. A successful attack can expose confidential communications, disrupt supplier relationships and raise difficult questions about internal controls.

This guide explains how business email compromise works, how to recognise warning signs, what to do after a suspected attack and how digital investigations can help establish what happened.

What Is Business Email Compromise?

Business email compromise is a type of fraud in which criminals use email impersonation, compromised accounts or manipulated communications to deceive someone into transferring money, disclosing sensitive information or changing business arrangements.

The attacker may impersonate:

• A company executive
• A supplier or contractor
• A customer
• An employee in finance or accounts payable
• A solicitor or professional adviser
• A business partner

The central technique is impersonation combined with a request that appears legitimate.

A common example involves an attacker sending updated bank details during an existing supplier relationship. The recipient believes the request is genuine and transfers funds to an account controlled by the fraudster.

Other attacks involve fake executive instructions, fraudulent payment approvals, payroll diversion or requests for confidential company information.

The FBI’s Internet Crime Complaint Center (IC3) uses the term Business Email Compromise for this category of fraud. It is important to recognise that the attack may involve more than email alone: compromised accounts, domain impersonation, social engineering and fraudulent payment instructions can all play a role.

How a Business Email Compromise Attack Happens

There is no single method used in every BEC incident. However, many attacks follow a recognisable pattern.

1. The attacker studies the business

Before attempting fraud, criminals may gather publicly available information about a company.

This can include employee names, job titles, supplier relationships, executive contacts and information about ongoing projects.

Company websites, professional networking profiles, public documents and previously exposed information may help an attacker understand how the business communicates.

The objective is to make a fraudulent message appear consistent with normal business activity.

2. The attacker impersonates or compromises an email account

There are two important possibilities.

Email impersonation: The attacker creates an address or display name designed to resemble a legitimate sender. A small difference in the domain may be difficult to notice.

Account compromise: The attacker gains unauthorised access to a genuine email account. They may then be able to read messages, monitor conversations and send fraudulent instructions from the compromised account.

These situations are not identical. An investigation needs to establish whether the genuine account was accessed or whether someone simply imitated its owner.

3. The attacker chooses the right moment

Payment fraud is often timed around normal business activity.

An attacker may target a period when:

• An invoice is expected.
• A supplier payment is due.
• A senior employee is travelling.
• Finance staff are handling a high volume of transactions.
• A project is approaching a deadline.

The fraudulent request may appear in an existing conversation or arrive as a separate message that references a genuine transaction.

4. The payment details are changed

The attacker may claim that a supplier has changed banks, that an old account is no longer available, or that a payment needs to be redirected urgently.

The message may contain a new bank account, a revised invoice or instructions to disregard previous payment information.

If the recipient does not independently verify the change, the payment may be sent to the wrong destination.

5. The fraud is discovered

The victim may discover the problem when the genuine supplier follows up about an unpaid invoice.

By this stage, the attacker may have deleted messages, abandoned the impersonating account or attempted to move the money further.

The time between the fraudulent payment and discovery can be critical.

Seven Warning Signs That a Business Email May Be Fraudulent

A suspicious email does not always contain spelling mistakes or obvious technical errors. Some fraudulent messages are carefully prepared and closely resemble legitimate correspondence.

Look for these warning signs:

1. Unexpected bank-detail changes

A supplier suddenly requests payment to a new account, particularly without a previously established verification process.

2. Unusual urgency

The sender insists that payment must happen immediately and discourages normal approval procedures.

3. A slightly different email domain

The address may contain an additional character, a substituted letter or a different domain ending.

4. Requests to bypass established procedures

The sender asks an employee to ignore normal approval requirements or keep the transaction confidential.

5. Unexpected changes in communication style

A familiar contact suddenly uses unusual language, changes their payment instructions or behaves differently from previous conversations.

6. Pressure from someone appearing to be senior management

A message claims that an urgent payment has been authorised by a director or executive.

7. Inconsistent payment information

The invoice, email, purchase order and supplier records do not agree about the beneficiary or account details.

One warning sign does not prove fraud. The safest approach is to verify sensitive changes through a separate, previously trusted communication channel.

What to Do Immediately After a Suspected BEC Attack

If a business discovers that money has been sent following fraudulent email instructions, it should act quickly and coordinate its response.

Contact the sending bank immediately

Ask the bank to treat the payment as suspected fraud. Provide the transaction reference, amount, date, recipient details and any relevant communications.

Ask whether a recall, payment trace or other intervention is available.

A recall is not guaranteed, particularly if the funds have already moved or the receiving institution is in another jurisdiction. Nevertheless, prompt notification may preserve options that could become unavailable later.

Contact the genuine supplier or impersonated party

Use a telephone number or contact method already known to the business, rather than details supplied in the suspicious email.

Confirm whether the payment instructions were genuine and whether the supplier’s email account may have been compromised.

Secure potentially affected email accounts

If account compromise is suspected:

• Reset affected passwords from a trusted device.
• Enable multifactor authentication.
• Review active sessions and revoke unfamiliar access.
• Check email forwarding rules and mailbox permissions.
• Review recovery email addresses and telephone numbers.
• Investigate unexpected application access or connected services.
• Preserve relevant account records before making changes where practical.

If the attacker may still have access, involve an appropriately qualified IT or incident-response professional.

Preserve the evidence

Do not rely exclusively on screenshots. Preserve original email messages, including available headers, attachments and relevant mailbox records.

Keep copies of invoices, payment confirmations, bank correspondence and supplier communications.

Cyb3rsect’s guide to preserving digital evidence before it disappears explains why maintaining original records and documenting evidence handling matters.

Report the incident

The appropriate reporting route depends on the country, the nature of the incident and the organisations involved.

In the United States, businesses can report suspected internet-enabled fraud to the FBI’s Internet Crime Complaint Center at ic3.gov. Suspected cyber incidents may also need to be reported to relevant law enforcement or regulatory bodies.

In Australia, businesses can report cybercrime through ReportCyber.

Keep copies of all reports and reference numbers.

How Digital Forensics Can Help Investigate Business Email Compromise

Once immediate containment and financial notifications are underway, the next question is often:

How did the attacker manage to make the fraudulent request look genuine?

A digital investigation may help establish whether an email account was compromised, whether a message was spoofed, and how the fraudulent communication fits into the wider incident.

Depending on available records and the agreed investigation scope, relevant areas may include the following.

Email header examination

Email headers can contain technical routing and authentication information that helps analysts assess how a message was transmitted.

They may provide clues about the sending infrastructure and whether authentication checks such as SPF, DKIM and DMARC were applied or passed.

However, header information must be interpreted carefully. A single header field does not independently prove who controlled an account or who sent a message.

Mailbox and account activity

Available account logs may help establish whether there were unfamiliar sign-ins, unexpected access locations, suspicious sessions or changes to mailbox settings.

The information available varies by email provider, subscription, retention settings and administrative configuration.

Forwarding rules and mailbox permissions

Attackers who gain access to an account may create forwarding rules or alter mailbox permissions.

These changes can allow them to monitor communications or receive copies of sensitive messages.

Reviewing mailbox configuration and available audit records can therefore be an important part of an investigation.

Timeline reconstruction

A timeline can bring together the key events:

• The original supplier invoice
• The suspicious email
• Any changes to payment instructions
• Internal approval messages
• The payment transaction
• The discovery of the fraud
• Subsequent communications

A timeline helps investigators understand the sequence of events and identify gaps that may need further examination.

For related guidance, see Cyb3rsect’s email forensics service information.

Can Investigators Identify the Person Behind the Fraud?

Sometimes an investigation can develop useful leads about the infrastructure, accounts or services involved. However, identifying the person responsible is not always straightforward.

An email address, IP address or device record may provide investigative information, but it does not automatically identify a particular individual.

For example:

• An IP address may be associated with a VPN, proxy, corporate network or shared connection.
• A compromised email account may have been used by someone other than its registered owner.
• A domain registration may use privacy services or inaccurate information.
• A device may be shared or remotely accessed.

Attribution should be based on multiple sources of corroborating evidence wherever possible.

Private records held by email providers, telecommunications companies, financial institutions or other service providers may require formal legal processes to obtain.

A responsible report should explain what is confirmed, what is inferred and what remains unknown.

How Businesses Can Prevent Future Payment Redirection Fraud

Preventing BEC requires more than telling employees to be careful. Businesses need procedures that make fraudulent payment changes difficult to complete.

Consider introducing these controls:

Independent verification: Confirm every bank-detail change using a previously verified telephone number or established communication channel.

Dual approval: Require more than one authorised person to approve significant payments or changes to beneficiary details.

Multifactor authentication: Enable MFA across email, financial and administrative accounts.

Email authentication: Configure SPF, DKIM and DMARC appropriately to help protect against domain spoofing.

Access reviews: Regularly examine mailbox permissions, forwarding rules, connected applications and administrative access.

Payment controls: Use established supplier records and additional checks for new beneficiaries.

Employee awareness: Train finance teams, executives and procurement staff to recognise unusual payment requests.

Incident response planning: Establish a process for quickly contacting banks, suppliers, IT teams and relevant authorities.

The goal is to make verification a normal business process rather than something employees remember only after an incident.

What Should a Business Investigation Report Include?

A useful investigation report should explain the incident in a way that management, technical teams, legal advisers and other authorised stakeholders can understand.

Depending on the available evidence, it may include:

• The investigation scope and questions examined
• Relevant email messages and header analysis
• Account activity and available audit records
• Suspicious forwarding rules or permission changes
• A chronology of relevant events
• The relationship between the fraudulent request and the payment
• Evidence sources and preservation details
• Technical findings and their limitations
• Recommended security improvements

The report should avoid unsupported conclusions about who committed the fraud.

For more information, read what a professional digital forensic report should contain.

How Cyb3rsect Can Support a Digital Investigation

Business email compromise can involve overlapping technical, financial and human factors. Understanding the incident may require more than reviewing one suspicious email.

Cyb3rsect focuses on digital investigations, evidence analysis and the organisation of technical findings.

Depending on the services agreed and the records available, an engagement may involve reviewing relevant email evidence, examining account activity supplied by the client, organising incident records, developing a timeline and documenting findings.

The investigation scope should be established before work begins. It should make clear which systems and records can be examined, what permissions are required and what deliverables the client can expect.

Cyb3rsect does not promise that an investigation will identify a particular individual or recover transferred funds. The objective is to provide a clearer, evidence-based understanding of the incident and support informed next steps.

Businesses concerned about suspicious email activity, payment redirection or possible account compromise can visit Cyb3rsect to learn more.

Final Thoughts: Trust Should Never Replace Verification

Business email compromise succeeds because it takes advantage of ordinary business relationships.

A familiar supplier, an expected invoice or a message that appears to come from a senior executive can create a sense of confidence. But email alone should never be treated as sufficient verification for a change to payment instructions.

Businesses need independent verification procedures, strong account security and a clear incident-response process.

If a fraudulent payment has already occurred, act quickly, contact the relevant financial institutions, secure affected accounts and preserve original evidence.

The most important question is not simply who sent the suspicious email. It is how the attack happened, what information was exposed, which controls failed and what evidence can support the next steps.

That is where a structured digital investigation can make a difference.