Business email compromise: how to verify an email sender before you pay

Quick answer

Business email compromise (BEC) is a scam where criminals send emails that look like they're from your boss, a supplier or a lawyer, asking you to pay or change bank details. To verify an email sender, check the real address and domain letter by letter, look for SPF, DKIM and DMARC "pass" in the message details, and never act on a payment request until you've called the person on a number you already had. If you paid, call your bank and report it right away.

Key numbers

• $3.05 billionlost to business email compromise reported to the FBI in 2025, across 24,768 complaintsFBI IC3 2025 Internet Crime Report
• $679 millionfrozen for victims by the FBI's Recovery Asset Team in 2025, a 58% success rate on $1.16 billion reportedFBI IC3 2025 Internet Crime Report
• £41.3 millionlost to invoice and mandate scams in the UK in 2025, across 2,305 casesUK Finance Annual Fraud Report 2026
• $55.5 billionin exposed BEC losses worldwide from October 2013 to December 2023, across 305,033 incidentsFBI IC3 PSA, September 2024

An email lands from a supplier you pay every month. They've changed banks, and the next invoice should go to the new account. Or your CEO writes from an airport: an urgent, confidential payment needs to go out before the end of the day. The name is right, the tone is right, and the logo is right. The question is whether the person you think sent it actually did.

This is business email compromise, and it is one of the costliest crimes the FBI tracks. Businesses and individuals reported losing $3.05 billion to BEC in 2025, across 24,768 complaints to the FBI's Internet Crime Complaint Center. The fix is simple but strict: a few checks on the email, and a callback rule that nobody skips.

What is business email compromise?

Business email compromise is a scam where criminals pose as someone you trust by email, such as a supplier, executive, employee or lawyer, to get you to send money or sensitive data. The FBI describes it as targeting people and businesses that regularly make wire transfers, using compromised or spoofed email accounts and, increasingly, phone numbers and video meeting apps too. Ireland's National Cyber Security Centre lists four common forms:

• Supplier or invoice fraud: a real vendor's email is hacked, or copied with a lookalike domain, to send fake invoices or "new bank details".
• CEO fraud: a fake executive asks for an urgent, secret transfer or gift cards.
• Payroll diversion: a fake employee asks HR to send their salary to a new account.
• Lawyer impersonation: a fake attorney or title company sends wiring instructions for a deal or a home closing.

In the UK, banks recorded £41.3 million lost to invoice and mandate scams in 2025 across 2,305 cases, and another £5.6 million to CEO fraud.

What does a business email compromise email look like?

It looks ordinary, and that's the point. BEC emails rarely carry malware or links. They rely on a believable story, a deadline and a small change. These are typical, paraphrased:

Hi, please note we've moved our banking to a new provider. Updated details attached. Kindly use these for invoice #4471 and all future payments. Our old account is closed.

Are you at your desk? I need you to handle a confidential payment for an acquisition today. Don't discuss with anyone yet. I'm in meetings, so email only.

Hi HR, I've switched banks. Can you update my direct deposit before this payroll run? New details below.

The FBI notes that AI now makes these emails more polished: chat tools can mimic an executive's writing style, and voice cloning can back up a request by phone. Businesses reported more than $30 million in BEC losses involving AI in 2025.

How do I verify an email sender?

Check the actual address, check the domain, check the authentication results, and then confirm by phone using a number you already had. Work through these in order.

1. Reveal the full address. The display name ("Sarah Lee, Accounts") can say anything. Tap or hover on it to see the real address. On phones, this step is easy to miss, which is why the FBI tells people to configure email to show full addresses.
2. Read the domain letter by letter. Look for swapped or added characters: "acme-corp.com" vs "acmecorp.com", "rn" for "m", "l" for "i", ".co" instead of ".com", or a free address like Gmail for a company that has its own domain.
3. Check the Reply-To. Hit reply and look at the "To" line before you type. If it changes to a different address, the email is designed to steer your answer elsewhere.
4. Check the authentication results (SPF, DKIM, DMARC), explained below.
5. Look at the conversation history. Is this a new thread that "continues" an old one? Did the signature, phone number or tone change?
6. Call to confirm using a number from your own records, never one in the email. This is the step that actually stops the loss.

A real email from a hacked account will pass every technical check. That's why step 6 is not optional for any payment or bank change.

How do I check SPF, DKIM and DMARC on an email?

Open the message's full details or headers and look for the words "pass" or "fail" next to SPF, DKIM and DMARC. In Gmail, open the email, click the three-dot menu and choose "Show original". In Outlook, open the message's properties or "View message source" and look for the "Authentication-Results" line.

A fail on a payment email is a stop sign. A pass only proves the email came from that domain. It does not prove the domain is the right one (a lookalike domain can pass all three) or that the account wasn't hacked. Treat these checks as a filter, not a verdict.

How do I check who owns a domain or email address?

Look up the domain's registration date, then check the person behind the address. Use ICANN's free registration data lookup. A supplier's domain that is ten years old is normal. A lookalike registered last week is a scam. Ireland's NCSC recommends blocking or flagging mail from newly registered domains for exactly this reason.

For a new contact, a new supplier, or a name you don't recognize, a Search A-Z business search helps. Enter the sender's full name and country, choose "Business contact", and add the email address and company. The report checks whether the email is real and its fraud risk, and shows the person's work email, current job and company, work history, public professional profiles, company registration (UK Companies House roles and the worldwide LEI register), news and web mentions, and any public scam or fraud warnings. If the "new accounts manager" has no trace at the supplier, that's your answer. The person is never told you searched.

What is a call-back verification policy?

A call-back policy is a written rule that any new payment, bank detail change or urgent transfer request is confirmed by an outbound phone call to a number already on file, before money moves. It's the single most effective BEC control, but only if it's done properly. JPMorgan's guidance on when callbacks go wrong lists the usual failures: trusting an inbound call that "confirms" the email, using the phone number printed in the email or invoice, and speaking to someone who isn't the right person.

A simple policy you can copy:

• Every change to a supplier's or employee's bank details is confirmed by an outbound call to a number from your vendor file, contract or the supplier's official website, never from the request.
• The call goes to a named person you have dealt with before.
• Requests marked urgent or confidential get more checks, not fewer.
• Payments above a set amount need two people to approve.
• New bank details are held for a cooling-off period (for example, 24 to 48 hours) before the first payment.
• Staff are told in writing that nobody, including the CEO, will be in trouble for delaying a payment to verify it.

A script for the call:

Hi, it's Alex from Northfield Accounts. We received an email about new bank details for your invoices. Before we change anything, can you confirm you sent it, and read me the last four digits of the new account number?

How should a business handle a request to change payment details?

Treat every payment change as suspicious until it's verified out of band, and record each step. This procedure works for small firms and large ones:

1. Log the request with the date, sender address and the details requested. Don't reply to it yet.
2. Call the supplier on the number already in your system, and confirm with your usual contact.
3. Check the new account name. In the UK, Confirmation of Payee tells you if the name on the account matches. In the eurozone, Verification of Payee has done the same for euro transfers since 9 October 2025. A "no match" or "close match" is a red flag.
4. Get a second approver to sign off the change.
5. Send a small test payment and confirm by phone that it arrived, before the full amount.
6. Watch for follow-ups. Pressure to skip any of these steps is itself a warning sign.

The same rules protect you as a supplier: tell your clients in writing that you will never change bank details by email alone. For new clients, our guide on checking a new client before you start covers the wider checks.

What should I do if I paid a fake invoice?

Call your bank immediately and ask it to recall the payment, then report it to the FBI or your national police the same day. Speed matters more than anything else. Ireland's NCSC warns that most funds are unrecoverable if not flagged within the first few hours.

1. Call your bank's fraud team now. Ask for a wire recall and for the receiving bank to freeze the funds. Give the amount, date, receiving account and any reference.
2. US: file at ic3.gov with full transaction details, whatever the amount. The FBI's Recovery Asset Team uses the Financial Fraud Kill Chain to work with banks to freeze money. In 2025 it handled 3,900 incidents and froze $679 million, a 58% success rate. It can follow "second hop" transfers if you provide them, and works with FinCEN on international wires.
3. UK: report to Report Fraud, which replaced Action Fraud in December 2025, on 0300 123 2040, or Police Scotland on 101. Your bank will also start its own recovery process.
4. EU: report to your national police and your bank. In Ireland, the NCSC also asks to be told.
5. Secure the email account. Change passwords, turn on multi-factor authentication, and check for forwarding rules or inbox rules that hide replies. These are a common sign the account was taken over.
6. Keep evidence. Save the emails with full headers, invoices, call logs and transaction records. Don't delete anything.
7. Warn the real supplier or client. Their account, or yours, may still be compromised.

If a "recovery service" contacts you offering to get the money back for a fee, it's another scam. Real recovery goes through your bank and law enforcement.

How do I protect my business from email fraud?

Combine a strict payment process with a few technical basics. The FBI and Ireland's NCSC both recommend:

• Multi-factor authentication on every email account.
• SPF, DKIM and DMARC set up on your own domains, so criminals can't easily spoof you to your customers.
• Email that shows full sender addresses and flags external senders.
• Registering obvious lookalikes of your own domain, or monitoring for them.
• A verified supplier list with known phone contacts.
• Regular staff training using real examples like the ones above.

BEC often starts with research on your team: who approves payments, who the suppliers are, who's traveling. Our guide on spotting fake LinkedIn profiles explains how fake accounts gather that information.

The bottom line

You can't tell a hacked email from a real one by looking at it, so don't try to. Check the address and domain, treat SPF and DKIM as a first filter, and confirm every payment change by calling a number you already had. If money has gone, call your bank and report it within hours, not days.

Frequently asked questions

What is business email compromise?

Business email compromise (BEC) is a scam where criminals impersonate a trusted contact by email, such as a supplier, executive or lawyer, to trick you into sending money or changing bank details. The FBI received 24,768 BEC complaints with $3.05 billion in losses in 2025.

How can I tell if an email is really from who it says?

Reveal the full sender address, check the domain letter by letter, see where replies go, and look for SPF, DKIM and DMARC "pass" in the message details. For anything involving money, confirm by calling the person on a number you already had.

Can a real email address be used in a scam?

Yes. If a supplier's or colleague's account is hacked, scam emails come from their real address and pass every technical check. That's why payment changes must always be confirmed by phone, using a number from your own records.

What does DMARC fail mean?

It means the domain shown in the From line doesn't match a domain that passed SPF or DKIM checks. On a payment or bank change email, treat a DMARC fail as a strong sign the sender is spoofed.

Can I get my money back after paying a fake invoice?

Sometimes, if you act fast. Call your bank to request a recall straight away, and report to ic3.gov in the US or Report Fraud in the UK. The FBI's Recovery Asset Team froze $679 million for victims in 2025, but the chances drop sharply after the first few hours.

What is the FBI Financial Fraud Kill Chain?

It's the process the FBI's Recovery Asset Team uses to work with banks to freeze fraudulent transfers, including international wires through FinCEN. You trigger it by reporting quickly at ic3.gov with full transaction details and by asking your bank for a recall.

What is a lookalike domain?

A web or email domain made to look like a real one, such as acme-corp.com instead of acmecorp.com, or a letter swapped for a similar one. Check the registration date with ICANN's lookup: a lookalike is usually only days or weeks old.

Sources

1. FBI Internet Crime Complaint Center, 2025 Internet Crime Report
2. FBI IC3 PSA: Business Email Compromise, the $55 billion scam (September 2024)
3. UK Finance Annual Fraud Report 2026
4. National Cyber Security Centre (Ireland): business email compromise guidance (July 2025)
5. J.P. Morgan: when callbacks go wrong
6. City of London Police: Report Fraud service goes live (December 2025)
7. ICANN: registration data lookup (RDAP)
8. Mason Hayes & Curran: EU Instant Payments Regulation and Verification of Payee

Figures are the latest published by each source when this guide was updated. Reported fraud losses are a floor: most fraud is never reported.