Business Email Compromise

The criminal may gain access through phishing, stolen passwords or malicious software. They can quietly monitor emails to learn about suppliers, invoices, payment schedules and approval processes. At the right time, they send or alter a message asking for payment to a new or updated bank account.

A business receives a genuine-looking invoice from a regular supplier. The email says the supplier has changed banks and provides new account details. The supplier’s email account has been compromised, and the new account is controlled by a criminal.

Sarah receives an invoice from a supplier she knows. The logo, signature and wording all look familiar, but the bank details have changed. Sarah calls the supplier using a saved phone number and confirms they did not send the request.

• An unexpected change to bank account details
• An urgent or confidential payment request
• Pressure to bypass normal approval or verification steps
• Small changes to an email address or domain name
• Payments requested at an unusual time or to a new or overseas account

• Confirm all new or changed payment details using a trusted phone number
• Do not use contact details provided in the email requesting the change
• Use strong, unique passwords and multi-factor authentication
• Regularly check email forwarding rules, sent items and deleted folders for unusual activity
• Contact your bank immediately if a suspicious payment has been made