At 4:42 p.m. on a Friday, an accounts payable coordinator receives an email from a familiar vendor. The sender asks that future payments be sent to a new bank account and includes an updated invoice for $68,000. The message uses the vendor’s logo, references an active project, and sounds like the person she normally works with. She updates the payment details and approves the transfer.
That business email compromise example is not a far-fetched cybersecurity story. It is how a legitimate-looking request can move money out of a New Jersey business before anyone realizes a criminal was involved. By Monday morning, the real vendor is still waiting to be paid, the bank account is empty, and recovering the funds becomes far more difficult.
Business email compromise, often called BEC, targets the people and processes that keep an organization moving. Unlike a loud ransomware attack that can shut down systems immediately, BEC is designed to look routine. It exploits trust, timing, and small gaps in payment and communication procedures.
What Happened in This Business Email Compromise Example?
The vendor did not send the email. A criminal gained access to the vendor’s Microsoft 365 account after stealing its employee’s password through a phishing page. The attacker reviewed messages, learned which customers had open invoices, and waited for the right moment.
Once inside the mailbox, the criminal created rules to hide replies and quietly monitored conversations. When the vendor sent a real invoice, the attacker either altered the payment details or sent a nearly identical message from the compromised account. Because the request came from a real address and matched an existing business relationship, it passed the initial smell test.
The receiving company made one understandable but costly mistake: it treated an emailed banking change as routine administrative work. No one called a known contact at the vendor using a number already on file. No second approver reviewed the change. The transfer was released based on an email alone.
This is why business email compromise is not only an IT issue. Technology can help identify suspicious activity, but payment controls, employee judgment, and clear ownership matter just as much.
Why BEC Attacks Work So Well
Most business leaders have trained staff to watch for misspellings, strange attachments, and obviously suspicious messages. Modern BEC attacks often avoid those signals. Attackers use real conversation threads, familiar names, accurate invoice amounts, and a tone that mirrors normal business communication.
They also create urgency without making the message look dramatic. A request may say that the change is needed before month-end, that a wire must go out before a shipment is released, or that an executive is traveling and cannot take calls. The goal is to encourage someone to bypass a normal check because the request appears time-sensitive.
Smaller organizations can be especially exposed because one employee may handle vendor management, invoices, payroll, and office administration. That person is not careless. They are busy, trusted, and trying to keep the business running. A good security program should support them with safeguards rather than rely on them to catch every deception.
The Most Common Forms of Business Email Compromise
A fake invoice is one of the most common BEC scenarios, but it is not the only one. Criminals adapt their approach to the information available in a mailbox.
Vendor payment fraud involves a request to change banking details, remit an overdue balance, or pay an invoice using new instructions. Executive impersonation, sometimes called CEO fraud, targets finance or operations staff with an urgent request that appears to come from an owner, president, or senior leader. Payroll diversion asks HR or payroll staff to redirect direct-deposit funds to a new account.
Real estate transactions, legal matters, and employee W-2 requests are also frequent targets. Any process involving money, sensitive information, or an urgent exception can be used against a business.
The practical takeaway is simple: an email is not sufficient proof for a financial change, even when it comes from a recognizable address. The more routine the request appears, the more carefully the process should be designed.
Warning Signs Staff Should Recognize
No single signal proves that an email is fraudulent. A legitimate vendor may change banks, and an executive may occasionally need an urgent payment processed. Risk rises when a request combines urgency, a financial change, and a departure from the usual process.
Pay attention when a vendor requests new payment instructions, asks for a wire instead of a check or ACH payment, or says a phone call is impossible. Watch for subtle changes in an email address, such as a swapped letter or a lookalike domain. Be cautious if an executive asks an employee to keep a payment confidential or bypass normal approval steps.
Even messages from a real account require verification when the request changes where money goes or exposes confidential data. A compromised mailbox can send highly convincing messages because the attacker has access to past conversations and contacts.
Build Controls That Do Not Depend on Luck
The strongest defense is a process that makes fraudulent requests harder to complete. For vendor banking changes, require a callback to a known contact using a phone number from your records, not a number included in the email. Document who completed the verification and when.
Payment approval should reflect the size and risk of the transaction. A small business may not need a complex enterprise workflow, but it should avoid allowing one person to create a vendor, change banking information, and release a payment without review. Separation of duties is not bureaucracy when it prevents a five-minute email exchange from becoming a six-figure loss.
For high-risk requests, establish an out-of-band confirmation method. That may be a phone call, a secure vendor portal, or a verbal verification code agreed upon in advance. Text messages can help, but they should not be the only control because phone numbers can also be compromised.
Technology should reinforce those procedures. Multifactor authentication for Microsoft 365 is essential because a stolen password should not be enough to open a mailbox. Conditional access policies, sign-in monitoring, mailbox rule alerts, and phishing protection can help identify account takeover attempts before they become payment fraud.
Email authentication settings also matter. Properly configured SPF, DKIM, and DMARC records reduce the chance that attackers can spoof your company’s domain to deceive customers, vendors, or employees. These controls do not eliminate BEC, particularly when a real account is compromised, but they close a common door.
What to Do If a Suspicious Request Arrives
Do not reply to the message to verify it. If the attacker controls the mailbox, they will answer as the vendor or executive. Instead, contact the person through an independently verified phone number or another established channel.
If money has already been sent, act immediately. Contact your bank’s fraud department and request a wire recall or ACH reversal. Notify the receiving bank if that information is available, preserve the original email and related records, and report the incident to law enforcement. Time matters because fraudulent funds may be moved through multiple accounts quickly.
Your IT provider should also investigate the affected email accounts. That includes reviewing sign-in activity, mailbox forwarding rules, delegated access, deleted messages, and other indicators that an account has been compromised. Simply changing a password may not remove everything an attacker left behind.
Proactive IT Support Changes the Equation
Break/fix IT support typically enters the picture after the damage is visible. By then, an unauthorized payment may have been sent, sensitive messages may have been accessed, and staff may be scrambling to understand what happened.
A proactive managed IT approach is different. It includes ongoing Microsoft 365 oversight, security monitoring, vulnerability management, backup planning, and direct access to experienced technicians who understand how the pieces fit together. It also creates the opportunity to test payment-verification procedures before an attacker tests them for you.
For New Jersey businesses, the right level of protection depends on the volume of payments, the sensitivity of the information handled, and how much access employees need to work efficiently. More restrictions can reduce risk, but they can also slow legitimate work if they are poorly designed. The goal is not to make every employee a cybersecurity specialist. It is to put sensible checks around the moments where one deceptive email can cause real business harm.
A quick conversation with your finance team can reveal whether a vendor banking change would be independently verified today. If the answer is unclear, that is a useful place to start. Marmic Associates helps businesses assess those gaps before they become an expensive Friday afternoon emergency.