The email looks routine. It comes from a vendor you have paid for years, references a real invoice, and politely notes that the company has “changed banks” and needs future payments sent to a new account. Your bookkeeper updates the vendor record, the next ACH goes out, and the money is gone. The vendor never sent that email. A criminal who had been quietly reading the vendor’s inbox did.
This is business email compromise (BEC), and it is one of the most expensive crimes facing small businesses and medical practices. The FBI’s 2024 Internet Crime Report recorded nearly $2.8 billion in BEC losses in a single year, and the true figure is higher because many victims never report. In 2026, AI-written emails and cloned voices have made these scams harder to spot than ever. The good news: a handful of disciplined payment controls stop the overwhelming majority of attacks.
Key Takeaways
- Most BEC losses start with a bank account change request or an urgent payment request that appears to come from a trusted person.
- Call-back verification using a phone number already on file, never one in the email, is the single most effective control.
- AI tools now produce flawless emails and convincing deepfake voice and video, so spelling errors are no longer a reliable warning sign.
- If money goes out, contact your bank and file at IC3.gov immediately. Recovery odds drop sharply after the first 24 to 72 hours.
How Business Email Compromise Actually Works
BEC rarely involves malware or dramatic hacking. It relies on trust, timing, and a busy finance team. Attackers usually gain access to a real email account through a phishing link or a reused password, then watch silently for weeks to learn who approves payments, which vendors are paid, and when invoices are due.
The Most Common Schemes in 2026
| Scheme | What It Looks Like | Who Gets Targeted |
|---|---|---|
| Vendor bank change | A real or spoofed vendor asks you to update remittance details | Accounts payable staff |
| CEO or owner impersonation | An “urgent, confidential” wire request from the boss while traveling | Controllers, office managers |
| Payroll diversion | An employee “asks” HR to change their direct deposit account | HR and payroll teams |
| Payer EFT redirection | A fake request to change where insurance reimbursements are deposited | Medical practice billing staff |
| Deepfake call or video | A cloned voice or video of an executive approving a transfer | Anyone with payment authority |
In one widely reported 2024 case, an employee at a multinational engineering firm transferred roughly $25 million after a video call in which every other participant, including the CFO, was a deepfake. Smaller businesses face the same tools at a smaller scale, often a cloned voicemail from the owner asking for a quick wire before the end of the day.
Why Small Businesses and Medical Practices Are Prime Targets
Large companies have treasury departments and dedicated security teams. A typical small business or practice has one or two people handling payables, payroll, and bank access, often with no second set of eyes. Criminals know that:
- Segregation of duties is thin. The person who updates vendor records is often the same person who releases payments.
- Year-end creates urgency. Bonus payrolls, equipment purchases, and vendor catch-up payments in the fourth quarter give scammers cover.
- ACH and wire payments are fast and final. Unlike a card charge, there is no simple dispute process once funds leave.
- Practices receive large, predictable deposits. Redirecting a single payer remittance can mean six figures.
Business email compromise is not a technology problem you can fully outsource to IT. It is a payment process problem, and the fix lives in your accounting procedures.
Seven Controls That Stop Payment Fraud
You do not need expensive software to dramatically cut your risk. These controls, built into your accounts payable process, stop most attacks cold:
- Verify every bank change by phone. Call the vendor or employee at a number already in your records, not one provided in the request. Document who you spoke with and when.
- Hold new banking details. Apply a waiting period, such as five business days, before a changed account can receive its first payment, and send a confirmation to the old contact on file.
- Require dual approval. No single person should be able to both set up a payee and release a payment. Most business banking platforms support this at no cost.
- Set a verbal code for urgent requests. Owners and executives should agree on a safe word or call-back rule so a cloned voice cannot authorize a wire.
- Turn on ACH and check positive pay. Your bank will flag debits and checks that do not match what you authorized.
- Lock down email. Enforce multi-factor authentication on every mailbox, block automatic forwarding to outside addresses, and review inbox rules regularly.
- Review the vendor master file monthly. Make vendor and payroll bank changes a line on your month-end close checklist so a second person signs off on every change.
For a deeper look at segregation of duties and other safeguards, see our guide to internal controls every small business needs.
Protecting Payroll and Patient Revenue
Payroll Direct Deposit Changes
Payroll diversion is quieter than a vendor scam but just as damaging, and it often goes unnoticed until an employee asks where their paycheck went. Require that direct deposit changes be made only through your payroll portal with multi-factor login, or in person with ID. Never accept a change by email alone. Our payroll services team builds these verification steps into every client setup.
Insurance Remittance and EFT Enrollment
Medical practices should treat any request to change EFT enrollment or remittance details with extreme suspicion. Confirm changes directly through the payer or clearinghouse portal, and reconcile expected payer deposits weekly so a missing remittance is caught in days rather than months. Our medical practice finance specialists monitor deposit patterns as part of routine reconciliation.
What to Do in the First 72 Hours After a Fraudulent Payment
Speed matters more than anything else. If you discover a fraudulent transfer:
- Call your bank immediately and request a wire recall or ACH reversal. Ask them to contact the receiving bank directly.
- File a complaint at IC3.gov with the transaction details. The FBI can sometimes freeze funds through its Recovery Asset Team when reports arrive quickly.
- Secure the compromised email account, reset passwords, and check for malicious forwarding rules.
- Notify your insurer. Review whether your cyber or crime policy includes social engineering coverage, which is often a separate endorsement with its own limit.
- Record the loss properly. Theft losses may be deductible, but documentation and timing matter, so involve your accountant early.
The Bottom Line
Business email compromise succeeds because it exploits ordinary, trusted processes. The defense is equally ordinary: verify every bank change, require two people to move money, and make reconciliation a habit. Those steps cost almost nothing and can prevent a loss that wipes out a year of profit.
Numbers Right can review your payment workflows, tighten approvals, and keep your books reconciled so fraud surfaces fast. Our CFO and advisory team can also help you build a written payment security policy before year-end. Schedule a free consultation and find out where your payment process is exposed.
