Business Email Compromise Is a Payments Problem

The Decision in Front of You

Business email compromise, usually called BEC, is a fraud in which a criminal impersonates someone your company pays or obeys and redirects a payment to an account they control. The FBI defines it as a scam aimed at businesses that regularly pay suppliers by wire, carried out by compromising email accounts and other channels, including phone numbers and virtual meeting applications ¹. The decision is who owns the defense. Most companies give it to IT as a filtering problem. This paper argues that it belongs to the CFO as a payments control.

The losses are large and steady. The FBI's Internet Crime Complaint Center, known as IC3, received 24,768 BEC complaints in 2025 with reported losses of $3,046,598,558, second only to investment fraud among cyber-enabled crimes ¹. That is about $123,000 per complaint, and about 10% more in total than the $2.77 billion reported in 2024 ¹². Over 2023, 2024, and 2025 combined, reported BEC losses reached about $8.76 billion ¹.

Finance teams see the attempts directly. In the Association for Financial Professionals' 2025 survey of 521 corporate treasury and finance practitioners, 63% reported attempted or actual BEC fraud in 2024, the most common avenue, and wires were the payment method most often targeted through BEC, cited by 63%, up from 39% a year earlier ³. Coverage of the same survey reports that 36% of organizations lost money to BEC in 2024 ⁴.

What's Happening

The fraud is a change request, and the control point is finance

BEC attacks follow two patterns. In vendor impersonation, the criminal poses as a supplier and asks accounts payable to change the bank account or remittance address on file, then waits for the next scheduled invoice. In executive impersonation, the criminal poses as the CEO, CFO, or a deal lawyer and asks a staff member to send an urgent, confidential transfer. Both end with an authorized employee sending money through the company's own bank. No system has to be breached on your side.

The cases below come from a public company and city governments, which must disclose losses.

Six cases from 2024 and 2025

Orion S.A., 2024. The chemical company disclosed in an August 2024 filing with the Securities and Exchange Commission that an employee who was not a named executive officer had been the target of a criminal scheme that produced multiple fraudulent outbound wire transfers ⁵. It expected a one-time pre-tax charge of about $60 million for funds not recovered, and said it had no evidence of unauthorized access to its systems or data ⁵. The filing does not use the term BEC; coverage described it as the most likely explanation ⁵. A single employee sent $60 million in several wires, and no payment control stopped them.

City of Baltimore, 2025. In December 2024, a fraudster used a personal email address to submit a fake contact for a real city vendor in the city's Workday system, and an accounts payable employee approved it without verifying the person ⁶. In January the fraudster submitted fake voided checks and bank change requests, which two more employees approved in February ⁶. The city paid $803,384.44 on February 21 and $721,236.60 on March 10, 2025, recovered the second payment, and lost the first ⁶. The Inspector General found that city policy did not require phone verification of vendor contacts or bank changes, and that the same weaknesses had been flagged after frauds in 2020 and 2022 ⁶. Two approvers signed off, and neither called the vendor.

City of Hamilton, Ontario, 2024. Between November 2023 and January 2024, a criminal who had compromised a vendor's email asked the city twice to change the vendor's bank details, and staff processed both ⁷. The city lost C$274,000 and does not expect to recover it ⁷. An internal audit found that staff had overlooked red flags despite fraud training a few months earlier, and had changed bank details on emailed requests alone ⁷. In a separate case in March 2024, the city paid C$552,000 to a fraudster after changing bank details even though the real vendor had warned it not to ⁷. A compromised vendor mailbox passes every email filter, because the messages really do come from the vendor.

Mercer Island, Washington, 2025. In January 2025, someone impersonating a city contractor by name and title asked the city to change the mailing address for payments ⁸. Finance sent a check for $420,350.94 to the new address ⁸. The city recovered $370,350.94, about 88%, through bank seizures and its impersonation fraud insurance, leaving a net loss of the $50,000 deductible ⁸. It then required secondary review and formal approval of vendor data changes ⁸.

Milwaukee, 2025. In late June 2025, scammers impersonating a library construction contractor emailed the city to change the vendor's bank account ⁹. The message carried the company's signature and logo; the domain ended in ".us" in place of ".com" ⁹. The city rerouted a $460,866 payment and learned of it weeks later from the real vendor; police traced the accounts and the bank froze and returned the funds ⁹.

An Oregon city government, 2025. The IC3 annual report describes an April 2025 BEC against a city government office in Oregon with a reported loss of more than $6 million ¹. The receiving account had already been frozen after an earlier complaint, so the receiving bank asked the originating bank to confirm the wire instructions, which were found to be fraudulent, and the $6 million wire was recalled ¹. The money came back because an earlier victim had reported the same account quickly.

Why the Usual Approach Fails

The usual response to BEC is to buy better email filtering and run phishing training. Both help, and neither controls the payment.

Filters look for malicious links, attachments, and spoofed senders, and a typical BEC message has none. It is a polite request for a bank change sent from a lookalike domain, as in Milwaukee ⁹, or from the vendor's real mailbox, as in Hamilton ⁷. Increasingly the request arrives by phone or video, where no email filter applies ¹¹⁰.

Training decays under pressure. Hamilton's staff had fraud training months before they processed two fraudulent changes ⁷. Attackers create urgency and impersonate people staff do not want to question.

Dual approval often fails in practice. Baltimore had two employees approve the bank change, and both relied on the documents the fraudster supplied ⁶. A second approver who looks at the same email adds no protection. The second check has to use a channel the attacker does not control.

Recovery is treated as an afterthought. The IC3 Recovery Asset Team froze $679 million of $1.16 billion in attempted theft across 3,900 incidents in 2025, a 58% success rate, and its domestic process froze 61% of reported losses ¹¹³. Its guidance is to call your bank and request a recall as soon as fraud is recognized, then file with IC3 ¹. Freezes depend on speed. AFP respondents reported that only 22% of organizations recovered three-quarters or more of funds lost to payments fraud in 2024, down from 41% the year before ³.

The Framework: The Payment Change Control

The Payment Change Control is a short set of rules owned by the controller and enforced in the payment system. Exhibit 1 shows the path every change request takes.

flowchart LR
    A[Change request<br/>arrives by email,<br/>portal, phone or video] --> B[Log it<br/>no change made<br/>on the request]
    B --> C[Call the vendor<br/>on the number<br/>already on file]
    C --> D[Second person<br/>approves using<br/>the call record]
    D --> E[First payment<br/>held or small<br/>until confirmed]
    E --> F[Normal payments<br/>resume]

Callback from the vendor master. Any request to change bank details, remittance address, or the vendor's contact person is verified by phone using a number already in the vendor master or in the signed contract. Never use a number, link, or contact given in the request itself. IC3's guidance to businesses is to make no payment change without verifying it with the intended recipient ¹³. Record who called, the number, and who confirmed.

Independent second approval above a threshold. Changes to vendor banking data and any payment above a set amount need a second approver who did not handle the request and who reviews the callback record. The second approver checks the verification itself, which the fraudster cannot supply.

Hold the first payment. The first payment to a new or changed account is held for a set period, or sent as a small test amount, until the vendor confirms receipt through the known number. Baltimore, Hamilton, and Milwaukee all found out when the real vendor asked why it had not been paid ⁶⁷⁹. A hold moves that discovery ahead of the loss.

Assume voices and video can be faked. No payment moves on instruction from an executive by email, text, phone, or video call alone. Staff confirm through a second channel they initiate, such as a call to the executive's known number or a message on an internal system. The FBI's 2025 guidance gives the same instruction: verify independently by calling a number you have confirmed yourself, and treat requests for money with skepticism ¹². Executives sign the rule, and staff who delay a payment to verify it face no penalty.

A first-hour recovery plan. Treasury keeps one page with the bank's fraud desk number: on discovery, request a recall, then file at ic3.gov with full transaction details ¹¹³.

Email security stays in place as the second line: multi-factor authentication on mailboxes, with phishing-resistant methods where possible, as FinCEN recommends ¹¹, plus authentication of your own domain and monitoring for lookalike domains such as the one used against Milwaukee ⁹. These cut the attempts that reach accounts payable; the payment controls decide whether one that gets through costs money.

Banks and payment networks are moving in the same direction. Nacha, which governs the ACH network, has said that rule changes taking effect in 2026 aim to reduce successful fraud such as BEC and improve recovery ¹⁴.

What it costs to run

Consider the author's illustrative estimate. A company with 2,000 active vendors sees 5% of them change bank details each year, or 100 changes. Each callback and second review takes 20 minutes, about 33 hours a year. At a loaded cost of $60 an hour that is about $2,000 a year in staff time. The average BEC complaint to IC3 in 2025 reported a loss of about $123,000 ¹. Under these assumptions, one prevented loss pays for the control for decades.

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. In the last year, how many vendors changed bank details, and how was each change verified?
2. Where does the callback number come from, and could a fraudster have changed it first?
3. Which person in our company could send $1 million today without a second approver?
4. What would our staff do if the CEO called on video and asked for an urgent, confidential wire?
5. How long would it take us to call our bank and request a recall after spotting a fraudulent payment?
6. Who owns this control: finance, IT, or no one?
7. When did we last test our payment controls with a fake request?

Closing

Business email compromise moves money through your payment process, using your own staff and your own bank. Better email filtering reduces the attempts that reach accounts payable, and only finance can stop the payment. Make the CFO the owner, verify every change to payment details through a number already on file, require an independent second approver above a threshold, hold first payments to changed accounts, and treat any voice or video request for money as unverified until confirmed. These controls cost hours of staff time a year, against reported losses that average six figures per incident.