Business email compromise in plain words: how it works, the callback rule that stops it, a poster for the finance desk, a five-minute staff briefing, and what to do in the first hours if money has gone.
Free to print and adaptLast reviewed October 2026
How it works
Business email compromise is a con, not a hack. The attacker’s tool is a convincing email at the right moment.
The fake supplier. An email that appears to come from a supplier says their bank details have changed. The next invoice is paid to the criminal.
The urgent instruction. An email that appears to come from the director or treasurer asks for an urgent, confidential payment.
The payroll switch. An “employee” asks to change the account their salary goes into.
The real mailbox. Often the attacker has broken into a genuine email account, yours or the supplier’s, and waits for a real invoice to intercept. The email may come from the right address and quote a real conversation.
The FBI’s IC3 describes business email compromise as using social engineering or computer intrusion to bring about an unauthorized transfer of funds. Its advice starts with the same thing as ours: verify changes through a second channel.
Warning signs
None of these prove fraud. Any of them is a reason to call.
A change of bank details, especially to an account in a different name or country.
Urgency, secrecy, or pressure not to call: “I’m in a meeting, just get it done.”
A sender address that is nearly right, or a reply-to address that differs from the sender.
A request that bypasses your normal approval process.
An invoice that looks right but arrives at an unusual time or for an unusual amount.
The callback procedure
One rule stops most of these frauds: no bank detail changes on the strength of an email alone.
Stop.Any request to change bank details, or to make an urgent or unusual payment, is treated as suspicious until checked. Even if it comes from the boss.
Look up the number yourself.Use a number you already had: from the contract, a previous invoice you have paid, or the organization’s official website. Never the number, link or reply address in the message.
Call and ask.Speak to someone you know or can verify. Read back the new details and ask them to confirm. Do not ask “did you send this?” in a way that invites a yes.
Second person approves.A second person checks the call was made and approves the change before it is entered.
Write it down.Record who called whom, on which number, when, and who approved. Keep it with the payment record.
Apply it to supplier changes, payroll changes and any first payment to a new account. Put it in writing, and tell your suppliers you will always call to confirm, so a genuine supplier expects it.
Read it aloud at a team meeting, adapt the names, then put the poster up.
“I want to talk about one specific fraud, because it costs organizations like ours real money, and it is easy to stop.
Criminals send emails that look like they come from our suppliers, or from one of us, asking us to change bank details or make an urgent payment. Sometimes they have broken into a real email account, so the message can come from the right address and mention a real invoice.
So from today, our rule is simple. If anyone asks us to change bank details, or to pay a new account, or to make an urgent payment outside the usual process, we do not do it from the email. We call them back on a number we already had, not one in the message. A second person approves the change. And we write down who we called.
This applies to everyone, including me. If I ever email you asking for an urgent payment, I expect you to call me to check. You will never be in trouble for checking. You might be for not checking.
If you think a payment has already gone to the wrong place, tell me or the finance lead immediately, even if it is late or you are not sure. The first hour is when the bank has the best chance of stopping it.
The poster with the steps is going up by the finance desk. Any questions?”
If money has gone
The first hours.
Speed matters more than anything else. Do the first two at once, in parallel if you can.
Call your bank now.Use the fraud number on your bank’s website or card. Ask them to recall or reverse the payment and to contact the receiving bank. Minutes matter: the sooner the bank acts, the better the chance of stopping the money.
Report to the national agency.In the United States, file a complaint with the FBI’s IC3, including the banking details. In the United Kingdom, report to Report Fraud (England, Wales and Northern Ireland) or Police Scotland. Other countries are listed below.
Secure the email account.Assume the mailbox that sent or received the request may be compromised. Change the password, sign out all sessions, check for forwarding rules and inbox rules you did not create, and turn on multi-factor authentication.
Keep the evidence.Do not delete the emails. Save them with full headers, along with invoices, payment confirmations and call notes.
Warn the real supplier or person.Call them on a known number. Their account may be the one compromised, and others may be targeted next.
Tell your insurer and your board.If you have cyber or crime insurance, call the insurer early; many policies have conditions about notice. Then brief your leadership.
Elsewhere, report to the police and your national cyber security agency; our security field guide lists several.
Sources
Where this comes from.
Primary sources only: governments, regulators, standards bodies and the vendors themselves. Each was opened and checked on 18 October 2026. If something here no longer matches the source, the source wins; please tell us at hello@moraph.org.