Business Email Compromise

How Business Email Pressure Bypasses Normal Checks

What this scam looks like

Common examples

• A fake executive email asks an assistant to buy gift cards for a client event.
• A vendor email says future invoices should be paid to a new account.
• A message asks payroll to change an employee's direct deposit details.
• An invoice arrives from a lookalike domain with new payment instructions.
• A fake client asks for sensitive documents before a deal can move forward.
• A reply in an existing thread asks for a rush payment outside the usual process.
• A manager-like message says the request is confidential and cannot be discussed.

How to verify safely

• Call the sender using a known number, not a number listed only in the new email.
• Confirm payment or payroll changes through an established internal process.
• Check the exact email domain and address for small differences.
• Compare the request with past invoices, payment instructions, and normal approval steps.
• Use a separate channel to verify any urgent or confidential money request.
• Do not rely only on email signatures, logos, or reply-chain appearance.
• Encourage staff to pause and ask for a second check without fear of blame.

Warning signs

• An email asks for a payment, wire, payroll change, invoice update, or gift card purchase outside the normal process.
• The sender appears to be an executive, vendor, client, or coworker but the timing or wording feels unusual.
• You are told the request is confidential, urgent, or cannot wait for normal approval.
• A vendor suddenly changes bank or payment instructions by email.
• The message comes from a lookalike address, personal email, or slightly changed domain.
• The request avoids a phone call, purchase order, second approval, or other normal business check.

Questions to ask

• Does this request follow our normal payment, payroll, or approval process?
• Can I verify the request through a known number or separate trusted channel?
• Did the sender's email address and domain match exactly?
• Why is the request urgent, confidential, or outside normal workflow?
• Has this vendor, employee, or executive used these instructions before?

Safer next steps

• Pause before changing payment instructions, payroll details, or invoice information.
• Verify unusual requests through a separate channel, such as a known phone number or internal contact method.
• Use normal approval steps even when the email says the matter is urgent or confidential.
• Check sender addresses carefully for small spelling changes or personal email accounts.
• Do not send gift cards, private records, tax forms, or payment details based only on an email request.
• Create a simple internal habit of second checks for payment changes and sensitive files.

What to do if you already clicked, paid, or shared information

• Pause related payments or file sharing until the request is verified through trusted channels.
• Contact the relevant bank, platform, employer, or agency through an official channel.
• Notify the real executive, vendor, client, or employee through a separate known contact method.
• Gather the email, invoice, payment instructions, timestamps, and related messages for review.
• If money was sent, contact the bank or payment provider through an official channel to ask about available options.
• If private business records were shared, notify the appropriate internal decision-maker through a trusted channel.
• Watch for follow-up messages that try to redirect questions or create new urgent payments.

How to report it

• Report the email through your email provider or workplace reporting process if available.
• Notify the real vendor, client, employee, or executive through a separate trusted channel.
• Report suspicious payments to the bank or payment platform through official channels.
• Use official consumer-protection or fraud-reporting channels in your region.
• Visit the site's /reporting page for general reporting options.

Common questions