That Email From Your Vendor? Read It Again.
Your accounts payable person got an email this morning. Looked exactly like the one from your roofing supplier. Same logo. Same sign-off. Same tone she has seen forty times before. It says they changed banks. Pay the new account for the invoice due Friday.
She paid it. Forty-three thousand dollars. Gone before lunch.
That happens every week somewhere in this country. Business Email Compromise cost U.S. businesses over three billion dollars in 2025, according to the FBI’s Internet Crime Complaint Center. Second only to investment fraud in total losses. Most small business owners in Raleigh and the rest of country have no earthly idea how exposed they are right now.
What Is Business Email Compromise?
The FBI defines it as targeted financial fraud delivered through email, aimed at businesses that handle wire transfers, pay invoices, or run payroll. Attackers either compromise a real email account or impersonate a trusted contact close enough that nobody questions it.
There is no malware involved most of the time. No system crashes. The goal is a wire transfer or an ACH payment moved to a bank account you will not recognize until it is already drained.
These people do their homework. They research your vendors, your payment schedules, your executives’ names and writing styles. They pick a target carefully, and it is usually not the owner. It is the person with payment access and a standing habit of not second-guessing anything.
That is why accounts payable fraud email looks nothing like what most people picture when they hear phishing. No broken English. No urgency about unclaimed inheritance. It reads like every other vendor email you have gotten for six years, because the attacker spent time making sure it would.
Digit’s Rule 8: Urgency in an email is a weapon. Slow down.
Why Business Email Compromise Works So Well on Smart People
This is the part that makes me want to go lie down in the yard.
Business Email Compromise does not beat your firewall. It beats the part of your brain that has been paying the same invoice since 2019 and stopped thinking about it. Attackers understand human routine better than most HR departments do.
Attackers know this. They study your patterns. They time their strikes around real invoice cycles, real shipment schedules, and real personnel transitions. New employee in accounts payable? Perfect. That person has not built the habit of questioning anything yet.
The psychological levers Business Email Compromise attacks pull:
- Authority. The email appears to come from a CEO, CFO, or a trusted vendor. Employees are conditioned not to challenge people above them or established partners.
- Urgency. Deadlines, end-of-quarter pressure, “we need this by close of business or the order cancels.”
- Confidentiality. “Please handle this quietly. I’ll explain later.” That line has redirected millions of dollars.
- Normalcy. The request is not weird. Paying invoices is normal. Updating vendor banking info happens. The attack lives in the mundane.
Seventy percent of organizations globally were targeted by at least one BEC attempt in 2025. Small businesses with under a thousand employees face a 70% weekly probability of being targeted. That is a standing appointment nobody put on the calendar.
How a Business Email Compromise Attack Actually Plays Out
Let me walk you through a real-world scenario. Details changed. The mechanics are accurate.
A mid-size plumbing contractor outside Raleigh had been using the same HVAC supply vendor for six years. The vendor’s email domain looked right at a glance. What nobody caught: one letter was off. Not their domain. A lookalike registered two months earlier for this exact purpose.
The fake vendor email arrived on a Thursday afternoon. It explained they had recently switched banks, provided new ACH details, and asked for payment on three outstanding invoices totaling just over $61,000. The accounts payable clerk had paid invoices from this vendor many times. The tone was right. The invoice numbers were right because the attacker had been watching intercepted correspondence for weeks.
The money moved on Friday. The real vendor called Monday asking about payment. By then, the window to recover those funds was already closing fast.
The FBI’s Recovery Asset Team has about a 66% success rate freezing fraudulent transfers when companies report immediately. But you have to catch it fast. Real fast. Hours, not days.
Sixty-one thousand dollars. Gone. Because one letter in a domain was different and nobody called to verify a banking change
The Three Things Making This Worse Right Now
- AI is writing the bait now.
By mid-2024, 40% of BEC phishing emails were AI-generated. That number is higher now. The typos are gone. The awkward phrasing is gone. These emails read like someone who actually knows your business wrote them, because the AI training included real business correspondence scraped from the web. Possibly yours. I do not enjoy saying that. It is still accurate.
- Vendor Email Compromise is on the rise.
Attackers are no longer just impersonating your boss. Now they compromise or spoof actual vendor accounts and insert themselves into existing email threads. The conversation history in the email chain looks real because it is real. The only thing that changed is the bank account information at the bottom. Vendor Email Compromise jumped sixty-six percent in the first half of 2024.
- The average loss is not pocket change.
The average loss per BEC complaint sits around $129,000. One incident. For a plumbing company, a law firm, a dental group, or a small construction outfit doing a million dollars a year in revenue, that is not an inconvenience. That is potentially payroll. Equipment. The difference between making it and not.
What You Can Actually Do About It
This is solvable. Walk with me.
Step 1: Implement Email Authentication.
Three protocols protect your domain from being spoofed. Most small businesses in the Triangle do not have them configured correctly, and that is not a judgment, it is something we see regularly and it is fixable in a matter of hours.
- SPF (Sender Policy Framework): Tells other mail servers which servers are actually authorized to send email from your domain. Without it, anyone can send an email claiming to be from you.
- DKIM (DomainKeys Identified Mail,): Adds a cryptographic signature to your outgoing mail. It proves the message actually came from you and was not altered in transit.
- DMARC (Domain-based Message Authentication Reporting and Conformance): The enforcement layer. It tells receiving servers what to do when an email fails those checks; reject it, quarantine it, or let it through while logging it. Without a DMARC policy set to enforcement, faked emails from your domain can still reach their targets.
- PCI DSS v4.0: This came into full effect in early 2025, requires DMARC enforcement for organizations handling card data. Even if that does not apply to you directly, that requirement tells you where the industry is heading.
Step 2: Change How You Approve Payments.
Any request to update banking information from a vendor requires a phone verification call before a single dollar moves. You call a number already on file, not a number that arrived in the same email making the request. Any wire transfer over a defined threshold gets two sets of eyes before it clears. Build that into your process and write it down. If your accounts payable person can approve a sixty-thousand-dollar transfer without a second call, that gap needs to close this week.
Step 3: Enable Multi-Factor Authentication.
If an attacker gets into a real employee email account, MFA is what stops them from quietly living inside it for weeks. In 2023, fifty-eight percent of Business Email Compromise attacks targeted organizations without MFA on their email accounts. Turn it on. Email, banking portals, anything with a login that connects to money or sensitive data.
Rule 5 applies here: Multi-factor authentication is not optional. You’re either locking the door or you’re not.
Step 4: Train Your Staff on the Actual Tactics.
Not a once-a-year checkbox. Real training that covers what these emails actually look like, what the psychological triggers feel like when they hit, and what the escalation process is when something smells off.
A well-trained team reduces phishing incident rates by up to eighty-six percent. I did not make that number up. Train your people.
Rule 15: Security awareness training is not a checkbox. Neither is a smoke detector with no battery.
Step 5: Know Your Domains.
Go right now and look up every domain that is one letter off from yours. Attackers register them deliberately. Some managed service providers monitor for these on your behalf. If someone registered your-company-name.co or yourcornpany.com last month, you should know about it.
Common Myths That Get People Robbed {#myths}
“We have antivirus. We’re covered.”
Antivirus catches malware. BEC does not use malware. It uses a well-written email and your employee’s existing trust in a vendor. Those are different problems.
“Our email is with Google or Microsoft. They protect us.”
They filter a significant volume of threats. They do not configure your DMARC policy for you. Most small business Microsoft 365 accounts have DMARC either missing entirely or sitting on monitor-only, which means it is collecting data and doing nothing to stop spoofed email from your domain reaching people.
“If something went wrong, our bank would catch it.”
Banks process what you authorize. A payment your employee legitimately initiated, even if fraudulently induced, is generally treated as authorized by the account holder. Recovery depends entirely on how fast you report it.
“Our IT person handles this.”
Does your IT person know what your current DMARC policy is set to? Ask them. Today. If they pause too long, you have your answer.
Digit’s Rule 11: Probably fine is a threat waiting for a timeline
Digit’s Rule 7: The vendor who cannot answer a direct question about security has already answered your question about security.
When Should You Act?
Now.
BEC losses topped 3 billion in 2025, up from $2.77 billion the year before. The AI-generated lures are harder to spot every quarter. The attackers running these operations are specifically targeting companies in secondary markets, cities like Raleigh, Durham, and Cary, because the revenue is worth targeting and the security controls often have not kept pace with the growth of the business.
You have a vendor somewhere whose email you trust without thinking. You have a payment process built on years of routine. That is how a functioning business runs. Build the controls around that routine. SPF, DKIM, and DMARC this week. MFA on email this week. Payment verification process written down and handed to your AP person before Friday.
The window to fix this is before the transfer goes out.
- FAQ SECTION {#faq}
How do I know if my business has been targeted by a BEC scam?
Look for emails about payment or banking changes you did not expect, subtle domain misspellings in sender addresses, or unusual urgency around financial requests. Your email provider may also log delivery of suspicious messages. A managed service provider can review your email logs and authentication configuration to identify gaps attackers could exploit.
What should I do immediately if I think a wire transfer was fraud?
Call your bank the same day, before close of business if possible. Ask them to initiate a SWIFT recall or domestic wire reversal. Then report it to the FBI’s Internet Crime Complaint Center at ic3.gov. The FBI’s Financial Fraud Kill Chain has a 66% success rate when companies act fast. Every hour matters. Do not wait for confirmation before making those calls.
What is DMARC and does my small business actually need it?
DMARC is an email authentication protocol that tells other mail servers what to do when someone tries to send email pretending to be from your domain. Yes, you need it. Without it, criminals can send emails that appear to come from your address. PCI DSS v4.0 now requires it for businesses handling card data, and Google and Yahoo enforce it for bulk senders. An MSP can set it up and configure it correctly in a matter of hours.
How is a BEC scam different from regular phishing?
Regular phishing casts a wide net, often with generic messages designed to steal passwords. BEC is targeted and financial. Attackers research your company, your vendors, your personnel, and your payment processes before crafting a message. The goal is not your password. It is your money, moved by you, to them, through what looks like a completely routine transaction.
Get Help Before You Need It
Here is what matters coming out of this:
- BEC is financially targeted, not technically complex. The protection is achievable at any size.
- Email authentication, meaning SPF, DKIM, and DMARC, is the foundation. Most small businesses in the Triangle do not have it configured correctly.
- MFA and a written payment verification process stop the majority of BEC attempts before they succeed.
- Your staff needs real training, not an annual checkbox.
If you want to know where your business actually stands, start with a free vulnerability scan. We look at your email authentication, your access controls, and the gaps that matter most. Then we tell you what we found in plain English, including what needs to be fixed first and what can wait.
We are in the Triangle. We work with businesses exactly like yours. Give us a call.