Fake invoice scams: how business email compromise fraud actually works
Your bookkeeper gets an email from a supplier you've worked with for years: "Please note our bank account has changed, use these new details for this month's payment." It looks right — correct logo, correct tone, even a reference to last month's invoice number. The payment goes out. Three weeks later the real supplier calls asking why they haven't been paid.
That's business email compromise (BEC) fraud, and it's one of the most financially damaging categories of cybercrime — not because it's technically sophisticated, but because it's not. It exploits trust in a name, not a vulnerability in a system.
The two versions of the scam
Almost every BEC case is a variant of one of these:
An attacker impersonates a company you already pay — a supplier, a contractor, your accountant — and sends a message claiming their bank details have changed. Because you have a legitimate, ongoing relationship with that name, the request doesn't look out of place.
An attacker impersonates someone senior inside your own company — often timed for when that person is travelling or hard to reach by phone — and asks an employee to make an urgent, confidential payment or purchase gift cards. The urgency and the appeal to authority are the attack.
Neither version requires breaking into your network. Some involve actually compromising a mailbox (hence the name), but a large share simply spoof a domain — sending mail with a forged "From" address, or from a look-alike domain that's one character off from the real one.
Why it works on careful people
BEC scams aren't sloppy phishing emails full of typos. The ones that succeed share three traits:
- They use a name you already trust. A first contact from a stranger gets scrutiny. A follow-up from "your supplier" doesn't.
- They create urgency or confidentiality. "This needs to go out before the end of today" or "please don't mention this to the rest of the team" are both designed to stop you from doing the one thing that would catch the fraud — checking with someone else.
- They target a process, not a person. Most businesses have no independent step where a changed bank account number gets verified through a channel other than email. The scam doesn't need to fool a person if the process has no check at all.
Where domain authentication fits in
Not every BEC attempt is a spoofed domain — some really are a compromised mailbox, where SPF, DKIM and DMARC won't help because the mail genuinely originates from the legitimate server. But a significant share rely on the receiving mail server accepting a forged "From" address, which is exactly what these three DNS records are built to prevent. We cover the mechanics in detail in our DMARC guide — the short version:
- SPF lists which mail servers are allowed to send as your domain.
- DKIM cryptographically signs your outgoing mail so it can't be altered in transit without detection.
- DMARC tells receiving servers what to do when a message fails those checks — and, critically, whether to reject it outright.
If your own domain has no DMARC policy (or one set to p=none), someone could send a message that looks like it's from you@yourcompany.com to one of your own clients or suppliers, and their mail server would have no policy telling it to block it. That's not a hypothetical — it's the default state for a domain that's never configured DMARC enforcement.
Look-alike domains: the other half of the problem
DMARC protects your exact domain. It does nothing about yourcompany-invoices.com or yourcompanny.com — domains an attacker registers separately that merely resemble yours. These are common in vendor-fraud cases: the email doesn't forge your domain at all, it comes from a domain that looks close enough at a glance. There's no DNS record that stops this; the defence is entirely procedural, which is why the checklist below matters as much as the technical fix.
A practical checklist to reduce your exposure
Before paying a new bank account number, confirm it by phone using a number you already have on file — not one provided in the email requesting the change. This single habit stops the vendor-fraud version of the scam regardless of how convincing the email looks.
This stops attackers from spoofing your exact domain to defraud your clients and suppliers — protecting your reputation as much as your own inbox. Aim for a DMARC policy of quarantine or reject, not just none.
Any request to change bank details or make an unplanned payment above a set threshold should need sign-off from a second person, through a channel other than replying to the same email thread.
Check the actual sending domain, not just the display name — most email clients let you view the full address by hovering or tapping the sender's name. Slight misspellings and extra hyphens are the most common tell.
Legitimate last-minute payment requests exist, but "urgent" and "don't tell anyone" are also the two levers every BEC scam pulls. Slowing down is the cheapest control you have.
None of these controls are expensive or technically complex. The reason BEC fraud remains so costly industry-wide isn't a lack of solutions — it's that many businesses have never sat down and closed these specific gaps.
Check whether your domain can be spoofed right now
See your SPF/DKIM/DMARC status in about 10 seconds — no signup needed.