How do we stop fake invoices and wire-transfer fraud sent by email?
Short answer
Treat every request to change payment details as suspicious until it's verified by phone, using a number you already had, not one from the email. Add multi-factor authentication so your own mailboxes can't be taken over, set up email authentication so criminals can't send as your domain, and train the people who move money.
Business email compromise is simple and devastating: a convincing email asks someone to pay an invoice or change bank details, and the money goes to a criminal. The FBI consistently ranks it among the costliest cybercrimes.
A process that stops it
- Verify by phone any new or changed payment instructions, using a number from your records
- Require two people to approve wires and bank-detail changes above a threshold
- Slow down urgent requests. Urgency is the attacker's favorite tool
Technology that helps
- Multi-factor authentication on every mailbox
- SPF, DKIM, and DMARC so nobody can send email as your domain
- Email protection that flags impersonation and lookalike domains