I was on the phone with a banker in Alabama last week. Her voice had that particular tightness you only hear after a real financial shock. She told me about a client, a well established local company, that had nearly been wiped out. An employee received an email. It looked exactly like a routine vendor request. The instructions were simple, familiar. The payment went through. Only it wasn’t the vendor. It was a thief. The company came within inches of losing over a hundred thousand dollars in seconds.
This isn’t an isolated horror story. It’s the new normal. The FBI’s Internet Crime Complaint Center tracks these business email compromise scams. Their latest report is a gut punch. In 2024, reported losses hit $14.7 billion. That’s billion with a B. The number of complaints soared to over 60,000. Let that sink in. $14.7 billion vanished from American businesses, one convincing email at a time.
The mechanics are deceptively simple. That’s what makes them so dangerous. A criminal gains access to a corporate email account, often through a sophisticated phishing attack. They study the communication patterns. They learn who talks to whom, about what invoices and for how much money. Then, they strike. They impersonate a CEO asking an assistant for an urgent wire transfer. They pose as a regular supplier sending “updated” banking details. The request seems legitimate because it’s coming from a known, trusted address. Or so it appears.
The BBB of Central and South Alabama confirmed the attempt on their member business. The scammer had done their homework. The email was impeccably timed and perfectly crafted. It bypassed the mental alarms that usually go off. This is not a scam of spelling errors and desperate pleas. It’s a crime of patience, research, and psychological precision.
Who’s most at risk? Any company that sends money electronically. But data shows certain sectors are bleeding more than others. Real estate is a prime target. The sheer volume of large, time sensitive wire transfers for closings is a magnet for fraudsters. The IC3 report notes that critical infrastructure sectors, including healthcare and manufacturing, are also heavily targeted. Their complex supply chains and frequent invoice payments create countless opportunities for interception.
The loss is only the first blow. The aftermath is a maze of recovery efforts that often fail. Once a wire is sent, it’s usually gone. Banks are not typically liable if your employee authorizes the transaction even under false pretenses. The FBI works to trace the funds, but the money moves globally at lightning speed. It gets funneled through a series of accounts and often disappears overseas within hours. The chance of full recovery is slim. You’re left with a financial hole and a brutal internal investigation.
So what do you do? You build a culture of verification, not just trust. Your finance team needs a strict, non negotiable protocol for any payment or change to payment instructions. A simple phone call, using a previously known number, can stop almost every single one of these scams. The rule must be absolute. No email, no matter how urgent or authoritative looking, can change banking details or trigger a payment without a live voice confirmation.
| Security Measure | Description |
|---|---|
| Culture of Verification | Strict protocols for payments |
| Phone Confirmation | Confirm requests via known numbers |
| Multi-Factor Authentication | Critical for email accounts |
| Positive Pay Services | Blocks unauthorized transactions |
| Dual Approval Process | Requires two approvals for wires |
| Regular Training | Employee awareness of scams |
Talk to your team. Regularly. Make them understand that they are the last and most important firewall. Train them to spot the subtle signs. Is the email tone slightly off from the usual correspondence? Is there a new, unusual sense of pressure? Does the request bypass normal channels? Empower every single employee, not just in accounting, to speak up if something feels wrong. The Alabama business that almost got hit had a vigilant clerk who double checked at the last possible second. That clerk saved the company.
The $14.7 billion figure is not just a statistic. It’s a direct measure of our collective vulnerability. It represents payrolls that couldn’t be met, investments that were canceled, and businesses that closed. The scam artists are not lazy opportunists. They are skilled, patient, and well funded adversaries who treat this as a profession. Your defense must be equally professional. Start with a phone call. It’s the cheapest, most effective security tool you have. In a world of digital complexity, sometimes the oldest solutions are the strongest.
