Business Email Compromise: How Glendale Businesses Stop Fake Payment Emails

An email arrives from a vendor you have paid for years. The invoice looks normal, the signature is right, and there is one small change: new bank details. A week later the real vendor calls about an unpaid invoice, and the money is gone. This is business email compromise, and it is the most expensive type of cybercrime reported by businesses in the United States.

According to the FBI’s 2025 Internet Crime Report from the Internet Crime Complaint Center (IC3), business email compromise (BEC) caused more than $3 billion in reported losses from 24,768 complaints, an average of about $123,000 per case. California ranked first in the country for both cybercrime complaints and losses. For businesses that move money every week, such as real estate, escrow, law, accounting and medical offices, it is one of the most important risks to manage. As a provider of IT services in Glendale, we help local businesses put the right checks in place.

This guide explains how these scams work, the red flags to watch for, the controls that stop them, and what to do in the first hours if money has already been sent.

The Short Answer

Business email compromise is a scam in which criminals use a fake or hacked email account to trick someone into sending money or sensitive data. Most attacks do not involve malware at all. They rely on a convincing email at the right moment and a payment process with no second check. The most effective defense is simple: never change payment details or send a wire based on email alone. Confirm by phone, using a number you already have.

How Business Email Compromise Works

Attackers usually follow the same steps:

1. Research. They study your website, LinkedIn and public records to learn who handles payments, who your vendors are and when large payments are due.
2. Access or imitation. They either break into a real mailbox (often after a phishing email steals the password) or register a look-alike domain such as techb1eed.com.
3. Waiting. In a hacked mailbox, they quietly read email and often create inbox rules that hide or forward replies, so the real owner does not notice.
4. The request. At the right moment, they send an invoice with new bank details, an urgent wire request or a request for W-2 forms.
5. Cash out. The money moves through other accounts within hours.

Common Types of Business Email Compromise

Type	What it looks like	Who is most at risk
Vendor invoice fraud	A real or fake vendor email with updated bank details	Any business that pays suppliers
Executive impersonation	“I’m in a meeting, send this wire today and keep it confidential”	Office managers and bookkeepers
Real estate and escrow fraud	Fake closing instructions sent to a buyer or escrow officer	Real estate, escrow and title offices
Payroll diversion	An “employee” asks HR to change their direct deposit account	Any business with payroll
Data theft	A request for W-2s or client records	Accounting, medical and law offices

Real estate is a frequent target. The National Association of Realtors reports that online real estate fraud reached $275 million in 2025, from more than 12,000 victims.

AI Makes the Scams More Convincing

AI tools now write fluent, error-free emails and can imitate a person’s voice from short audio clips. The FBI tracked AI-related cybercrime separately for the first time in 2025 and reported that businesses lost more than $30 million to business email compromise scams that involved AI. Spelling mistakes are no longer a reliable warning sign, which is why verification by phone matters more than ever.

Red Flags in a Payment Email

• A change of bank details, especially to a new bank or an account in another state or country
• Urgency or secrecy: “today”, “before the deadline”, “don’t call, I’m traveling”
• A sender address that is slightly different from the real one
• A reply-to address that differs from the sender
• A request that skips your normal approval process
• A new phone number in the email signature
• An executive asking for gift cards, wires or W-2 forms by email

How to Stop Fake Payment Emails

The best protection combines a clear payment process with basic email security.

Payment Process Controls

1. Call-back rule. Confirm every new payee or change of bank details by phone, using a number from your records, not from the email.
2. Two-person approval. Require a second approver for wires and payments above a set amount.
3. No exceptions for urgency. Make it clear that no one will be blamed for pausing a payment to verify it.
4. Vendor change log. Keep a record of who changed payment details, when and how they were verified.
5. Agree with key vendors and clients that bank details will never change by email alone.

Technical Controls

1. Multi-factor authentication (MFA) on every email account, so a stolen password alone is not enough.
2. SPF, DKIM and DMARC records for your domain, which make it harder for criminals to send email that looks like it comes from you.
3. External email warnings that label messages from outside your organization.
4. Alerts for suspicious inbox rules and sign-ins from unusual locations.
5. Security awareness training with real examples, at least twice a year. Our guide on how to prevent phishing attacks covers the basics for staff.

What to Do in the First Hours After a Fake Payment

Speed matters. In 2025, the FBI’s Recovery Asset Team handled 3,900 fraudulent transfer incidents and froze $679 million, a 58% success rate. Those results depend on reporting quickly.

1. Call your bank’s fraud department immediately and ask for a wire recall. Phone, not email.
2. File a complaint at ic3.gov with the transaction details, regardless of the amount.
3. Secure the mailbox. Reset the password, sign out all sessions, turn on MFA and check for forwarding or hidden inbox rules.
4. Warn the people involved. Tell the real vendor or client, and your team, so the attacker cannot try again.
5. Preserve evidence. Keep the emails with full headers, invoices and payment confirmations.
6. Contact your cyber insurer if you have a policy, and check the notification deadline.

If you are not sure whether a mailbox was hacked, our guide to the signs your business has been hacked explains what to check.

Business Email Compromise Checklist

• Payment detail changes are always confirmed by phone with a known number
• Wires above a set amount need two approvals
• Every email account uses multi-factor authentication
• SPF, DKIM and DMARC are set up for our domain
• External emails are labeled
• We get alerts for new inbox rules and unusual sign-ins
• Staff had security awareness training in the last six months
• Everyone knows who calls the bank and files the IC3 report if something goes wrong

How Managed IT Helps Prevent Business Email Compromise

Most small businesses have the right intentions but no one responsible for setting up and watching these controls. With managed IT services, email security becomes part of everyday IT management:

• MFA, SPF, DKIM and DMARC are configured and checked
• Suspicious sign-ins and inbox rules trigger alerts that someone actually reviews
• New employees are trained, and departing employees lose access the same day
• If something goes wrong, there is a clear plan and a team ready to secure accounts

Our cybersecurity services add email filtering and threat monitoring for businesses that handle large payments or sensitive client data.

Want to know whether your email is protected against business email compromise? Contact Techbleed for a quick review.