Criminals impersonate your CEO or a trusted vendor and ask for an urgent wire transfer. Businesses lose billions to this scam every year.

You’re in the middle of a busy Tuesday when an email lands in your inbox. It’s from your CEO, and the subject line reads “URGENT: Wire Transfer Needed Today.” The message explains that she’s in a meeting with a potential acquisition target and needs you to wire $47,000 to close the deal. She apologizes for the short notice and asks you to keep it confidential until the announcement.

Your finger hovers over the reply button. The email address looks right. The tone sounds like her. And she did mention something about M&A discussions last week.

If you send that wire transfer, your company just became another statistic in the fastest-growing form of corporate theft: business email compromise.

The FBI reported that businesses lost $2.9 billion to business email compromise scams in 2023 alone¹. That number keeps climbing because these attacks have become sophisticated, targeted, and devastatingly convincing. The criminals aren’t random hackers sending obvious spam. They research your company, study your communication patterns, and strike at exactly the right moment with exactly the right story.

This isn’t a problem that only affects massive corporations with sloppy security. Small and medium-sized businesses are prime targets because they often lack dedicated security teams and formal verification procedures. One wire transfer can wipe out your operating budget, tank your quarterly results, or even put you out of business.

The good news? You can spot these scams before you lose a dime. You just need to know what to look for.

Understanding How Business Email Compromise Actually Works

Business email compromise isn’t a single trick. It’s a category of social engineering attacks where criminals manipulate you into sending money or sensitive data. The scam works because it exploits trust, urgency, and authority rather than technical vulnerabilities.

Here’s how a typical CEO fraud email scam unfolds. First, attackers research your organization through LinkedIn, your company website, press releases, and social media. They identify key executives, learn the reporting structure, and figure out who has authority to move money. They note communication styles, common phrases, and even out-of-office schedules.

Next, they create a convincing impersonation. Sometimes they hack a real email account through phishing or credential stuffing. More often, they register a domain that looks almost identical to your company’s actual domain. Instead of “johndoe@acmecorp.com,” they use “johndoe@acrnecorp.com” or “johndoe@acmecorp.co.” Your email client displays the name, not the full address, so you see “John Doe, CEO” and assume it’s legitimate.

Then comes the hook. The email creates urgency (deal closing today, vendor threatening to halt shipment, legal deadline), demands confidentiality (don’t discuss this with anyone, the board doesn’t know yet), and requests immediate action (wire the funds now, send the tax documents before 5 PM).

The fake invoice email scam works similarly but impersonates vendors instead of executives. You receive what appears to be a routine invoice from a supplier you work with regularly. The amount seems reasonable. The invoice number follows the right format. Everything looks normal except the bank account number has changed. The email includes a plausible explanation like “we’ve updated our payment processing system” or “we’re using a new account for international transactions.”

According to cybersecurity firm Proofpoint, 75% of organizations experienced at least one business email compromise attack in 2024². The average successful attack costs companies $125,000³. Some individual incidents have resulted in losses exceeding $50 million.

Red Flags That Scream ‘This Is a Scam’

Learning to recognize business email compromise attempts comes down to training yourself to notice the tells. Criminals are good, but they’re not perfect. Every scam leaves clues.

Check the actual email address, not just the display name. This is the single most important habit you can develop. Click on the sender’s name or hover over it to reveal the full email address. Look at every character. Is there an extra letter? A different domain extension? A hyphen where there shouldn’t be one? Scammers count on you glancing at “CEO Jane Smith” and not noticing the email comes from “jsmith@yourcompany-inc.com” instead of “jsmith@yourcompany.com.”

Watch for unusual urgency or secrecy. Legitimate business transactions rarely demand immediate wire transfers with zero discussion. Real executives don’t tell you to hide financial transactions from your colleagues. If an email creates artificial pressure and tells you not to verify through normal channels, that’s a red flag the size of a billboard.

Notice changes in communication style. Your CFO usually sends detailed emails with bullet points and attachments. This email is three short sentences with no context. Your vendor always calls to confirm large invoices. This time you only got an email. When someone’s communication pattern suddenly changes, pause.

Be suspicious of requests that bypass normal procedures. Every company has processes for payments, data sharing, and financial transactions. Scammers ask you to skip those processes. They know procedures exist specifically to catch fraud. If someone asks you to “make an exception just this once” or “handle this differently because it’s sensitive,” verify before proceeding.

Look for grammar and formatting inconsistencies. Many business email compromise scams originate overseas. Even when the English is good, you might notice odd phrasing, unusual punctuation, or formatting that doesn’t match your company’s style. Your CEO always signs emails “Best, Rebecca.” This email says “Regards, Rebecca Johnson.” Small detail. Big clue.

Question unexpected account changes. Vendors don’t randomly change bank accounts without advance notice through multiple channels. If you receive an invoice with new payment information, that should trigger immediate verification through a known phone number, not by replying to the email.

Dr. Sarah Chen, Chief Information Security Officer at SecureBusiness Solutions, puts it bluntly: “The moment you feel rushed or uncomfortable about a financial request, that discomfort is your brain detecting a pattern that doesn’t fit. Listen to that instinct. Legitimate business can wait 30 minutes for you to verify. Scams cannot.”

How to Verify Wire Transfer Requests Without Insulting Your Boss

You’ve received a suspicious email requesting a wire transfer. You’re 80% sure it’s a scam, but there’s that 20% chance it’s real and your CEO will be furious if you ignore her urgent request. How do you verify without damaging your career?

First, understand that no reasonable executive will punish you for following security protocols. If they do, you’re working for the wrong company. Verification isn’t about distrust. It’s about protecting company assets, which is literally your job.

Use a different communication channel to verify. Never reply to a suspicious email to ask if it’s real. The scammer controls that email account. Instead, call the person who supposedly sent the request using a phone number you already have saved or that appears on the company directory. Not a number included in the email. Walk to their office if they’re in the building. Send a text to their known mobile number. Verification must happen outside the potentially compromised channel.

When you make contact, be direct: “I received an email requesting a wire transfer for $47,000. Before I process it, I’m verifying this is legitimate.” That’s it. You don’t need to apologize or explain. You’re doing your job.

Implement a verbal verification code system. Some companies establish a simple protocol where any wire transfer over a certain threshold requires verbal confirmation with a pre-determined security phrase or code. When your CFO calls to confirm the transfer is real, she says the current month’s code word. No code word, no transfer.

Create escalation procedures for urgent requests. Work with your finance team to establish clear rules. Any wire transfer request that bypasses normal approval workflows automatically gets escalated to two people for verification. Any vendor payment with changed bank details requires confirmation via a known phone number before processing.

Document everything. Forward the suspicious email to your IT security team before you do anything else. Take screenshots. Save all related communications. If it’s a scam, this documentation helps your company and law enforcement. If it’s real, you have a record that you followed proper procedures.

Business email compromise prevention isn’t complicated. It just requires discipline. The verification call takes three minutes. The wire transfer you prevent from going to criminals is irreversible.

What to Do If You’ve Already Sent the Money

You verified the bank account. You processed the wire transfer. Then your actual CEO walked by your desk and asked if you’d seen any emails from her today. Your stomach drops.

Act immediately. Time is everything.

Contact your bank right now. Call your bank’s wire transfer department and report the fraudulent transfer. If you catch it within 24 hours, there’s a chance the funds can be recalled or frozen before they’re moved to another account. The success rate is low, around 17% according to the FBI⁴, but it drops to nearly zero after the first day.

Report it to law enforcement. File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Contact your local FBI field office. While recovery rates are discouraging, reporting creates a record and contributes to investigations that might prevent future attacks or lead to eventual recovery.

Notify your company’s cyber insurance carrier. If you have cyber liability insurance, it may cover business email compromise losses. Report the incident immediately. Delayed reporting can void your coverage.

Alert the recipient bank. Your bank can contact the receiving bank to request a freeze on the account. This works better for domestic transfers than international ones, but it’s worth attempting.

Preserve all evidence. Don’t delete the fraudulent emails. Save everything. Your IT team needs to investigate how the compromise happened. Was an email account actually hacked? Did the attacker only spoof an address? Understanding the attack vector helps prevent the next attempt.

Inform relevant parties internally. Your IT security team, legal department, and executive leadership need to know. This isn’t about assigning blame. It’s about protecting the company from additional attacks. Business email compromise criminals often hit the same target multiple times once they know the initial attack worked.

The emotional aftermath of falling for a business email compromise scam is brutal. You’ll feel embarrassed, angry, and stupid. Here’s the truth: these scams fool smart, careful people every single day. That’s why they’re effective. The criminals are professionals who study human psychology and organizational behavior.

Learn from it. Push for better verification procedures. Advocate for security training. Help protect your colleagues from the same attack.

Building a Culture That Stops These Scams Cold

Individual vigilance helps, but organizational culture determines whether business email compromise attacks succeed or fail at your company.

Conduct regular, realistic training. Generic cybersecurity presentations don’t work. People forget them immediately. Instead, run simulated business email compromise attacks against your own team. Send fake urgent requests from spoofed executive email addresses. Track who follows proper verification procedures and who doesn’t. Then provide immediate, specific feedback.

A 2024 study by KnowBe4 found that organizations running monthly simulated phishing and business email compromise exercises reduced successful attacks by 64% within six months⁵.

Establish and enforce verification requirements. Written policies matter less than consistent practice. If your company requires dual approval for wire transfers over $10,000 but executives regularly ask people to “just handle it quickly this time,” your policy is worthless. Rules without enforcement create confusion about when to actually follow them.

Make verification easy and rewarded. If your verification process requires filling out three forms and waiting for approvals from four people, employees will skip it when faced with urgent requests. Streamline your procedures. Celebrate employees who catch and report suspicious emails. Create a culture where verification is normal, not paranoid.

Implement technical controls. Train your email system to flag external emails that appear to come from internal senders. Use visual warnings for messages originating outside your organization. Require two-factor authentication for all email accounts. Register common misspellings of your domain to prevent spoofing.

Create clear escalation paths. Every employee should know exactly who to contact when they receive a suspicious financial request. That person should be available, responsive, and empowered to investigate quickly.

Your newest employee should feel completely comfortable calling the CEO’s assistant to verify that the CEO actually sent an email requesting a $30,000 wire transfer. If that feels uncomfortable or risky in your organizational culture, you have a culture problem that makes you vulnerable.

Key Takeaways

• Business email compromise scams cost companies $2.9 billion in 2023, with criminals impersonating executives or vendors to trick employees into wiring money or sharing sensitive data.
• Always verify the actual email address, not just the display name, by clicking or hovering to reveal the full address and checking for subtle misspellings or domain differences.
• Urgency combined with secrecy is a massive red flag. Legitimate business transactions rarely require immediate action with zero verification or discussion.
• Never verify a suspicious request by replying to the email. Use a different communication channel like calling a known phone number, texting a saved mobile contact, or walking to someone’s office.
• If you’ve already sent money to a scammer, contact your bank immediately. The first 24 hours offer the only realistic chance of recovery through wire transfer recalls or account freezes.
• Technical controls help, but organizational culture determines success. Companies that normalize verification, reward vigilance, and make security procedures fast and simple see 64% fewer successful attacks.

**