The request to pay looked routine, and it came from a person you know.
An invoice, a new bank account, a change to a direct deposit. It arrives in the same inbox as the real ones, from a name on your contact list. The FBI’s Internet Crime Complaint Center (IC3) calls this business email compromise, “a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests.”
You have a mail filter and a bank that watches for fraud, and mostly that’s handled. A filter looks for forged senders and bad links. When the request is sent from a real account that someone else has broken into, the sender is genuine and there may be no link at all. The check that catches it happens outside the mailbox.
Four forms it takes
- A payment request from a real account. IC3 describes attackers who get into legitimate business or personal email accounts, through social engineering or computer intrusion, and use them to trigger unauthorized transfers. The account can belong to a vendor, a customer, or your own colleague.
- A changed direct deposit. IC3 has reported spoofed emails to HR or payroll that seem to come from an employee, asking to change the deposit account. The new account usually leads to a prepaid card. Sometimes a phishing page that imitates the email login comes first, to collect the employee’s credentials.
- A request for employee data. IC3 notes the goal isn’t always money. Compromised business accounts have been used to ask for employees’ personal information or W-2 forms.
- A fake invoice. The FTC describes bills for things the business never ordered, sometimes marked past due. Staff are expected to assume the invoice is real and pay it. An invoice by email may also be an attempt to get into your systems, so the FTC says not to open attachments from unexpected ones.
Where it leaves traces in a mailbox
Which mailbox matters. If the account was broken into, these are Microsoft’s listed signs. If you only received the message, look at the sender instead.
- In the broken-into mailbox: rules that forward mail to an unknown address, or move it to Notes, Junk Email, or RSS Subscriptions.
- Messages in Sent Items or Deleted Items that the owner didn’t write.
- A changed name, phone number, or postal code in the company address list, and a signature nobody set up.
- Unexplained password changes or lockouts.
- In the message you received: IC3 advises checking the sender’s full address, especially on a phone, turning on the setting that shows full email extensions, and looking for misspelled domains in links.
What the person who pays can do differently
- Confirm every change of destination through a second channel. IC3 says to verify account-change requests that way. Use a phone number from your own records or a past signed contract, never one from the email.
- Keep one written procedure for approving invoices and purchases, and ask staff to check invoices closely, as the FTC advises. Treat a request that skips the procedure as the reason to look closer, not a reason to hurry.
- Treat the payment method as information. The FTC says that if someone demands payment by wire transfer, cryptocurrency, or gift cards, don’t pay.
- Don’t send logins or personal information by email, and don’t answer a request for them even when it appears to come from a manager.
- Look at your bank accounts regularly for irregularities such as missing deposits, as IC3 advises.
If money already moved
IC3 says to contact your financial institution right away to request a recall of the funds and any indemnification paperwork, and to file an IC3 complaint whatever the amount. The pages on money sent to a fraudster and on payment details changed in an email cover the next hour and the call.
What your own mailbox can and can’t show
A clean mailbox on your side doesn’t clear the request. If a vendor’s account was the one broken into, the evidence is in the vendor’s mailbox, and yours holds only an ordinary-looking message. A call settles the request. It doesn’t tell you how the other account was entered.
We look at the rules, forwarding, sign-in history, and sign-in methods with you, and tell you what we found and what we didn’t, with dates. A clean result covers what we examined, on that date.
The mailbox can be perfectly ordinary and the request still false, so the check that matters happens outside it.
Related
Sources
- FBI IC3: Business Email Compromise, PSA I-091124-PSA (September 11, 2024)
- FBI IC3: Business Email Compromise, PSA I-091019-PSA (September 10, 2019)
- FTC: Scams and Your Small Business, A Guide for Business
- FTC Consumer Alerts: Run a small business? Pay your bills, not scammers (May 2026)
- Microsoft Learn: Respond to a compromised email account in Microsoft 365
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.