Business email compromise is a simple, highly profitable scam. Criminals impersonate an executive, supplier or client — often from a genuine but compromised email account — and persuade someone to send money to the wrong place. No malware is required, and the losses can be large.
How the scam usually works
- Changed banking details: a “supplier” emails to say their bank account has changed, just before a large invoice is due.
- The urgent executive request: the “CEO” asks for a confidential wire transfer for a deal, often while supposedly travelling.
- Payroll diversion: an “employee” asks HR to update their direct-deposit details.
- Invoice interception: criminals inside a real mailbox reply to a genuine email thread with altered invoices.
Because the emails often come from real accounts, or addresses that differ by a single letter, they can be very convincing.
Why technology alone won't stop it
Email security tools help, but business email compromise targets your processes and people. The strongest defences are simple rules that everyone follows, every time.
Process controls that work
- Call back to verify: confirm any new or changed banking details by phone, using a number you already have on file — never one from the email.
- Two people approve payments: require dual approval above a set amount.
- Pause new payment details: wait before paying to newly changed account details, and verify during the wait.
- Permission to say no: make it clear that staff will never be penalized for delaying a payment to verify it — even if the request seems to come from the CEO.
Technical controls that help
- Multi-factor authentication on every email account.
- Email authentication for your domains, so criminals can't easily send email that appears to come from you.
- Banners that flag email from outside the organization.
- Alerts when someone creates mail-forwarding rules — a common sign of a compromised mailbox.
If money has already been sent
- Contact your bank immediately and ask them to recall or freeze the payment. Speed matters.
- Report it to your local police and the Canadian Anti-Fraud Centre.
- Secure the affected email accounts and preserve evidence, then get help investigating how the criminals got in.
Key takeaways
- Never change payment details based on an email alone.
- Verify by phone using a number you already trust.
- Make it safe for staff to slow down and check.