4 min lesson

Fake invoices and "the boss needs this paid"

This is one of the most common ways small organisations lose money, and it almost never looks like a hack. It looks like a normal email, on a normal Tuesday, asking for a normal payment. That's the trick.

Business email compromise (often shortened to BEC) covers a few related scams. Two show up most often. The first is the fake invoice: a supplier you really do work with "writes" to say their bank details have changed, please update them for the next payment. The second is the boss impersonation: a short message that looks like it's from your CEO or trustee, asking you to quietly sort out a payment or buy some gift cards before the end of the day.

Both rely on the same thing, the email looking just normal enough that you act before you check. There may not be a dodgy link or attachment at all. The "attack" is the request itself.

Quiet signs worth a second look

"New bank details" on an existing supplier, even if the invoice looks identical.
A short, urgent request from a senior person who usually wouldn't email you directly.
Reply-to address that's slightly off (extra letter, swapped domain, .co vs .com).
"I'm in a meeting, can't talk, just sort it." Real bosses can pick up the phone.
Pressure to keep it confidential or skip the usual approval.

A small process beats a smart attacker

The fix isn't a clever tool, it's a habit. Any change to a payment, and any first-time payment, gets confirmed on a second channel before money moves. That means calling the supplier on a number from their website (not the email), or speaking to the colleague in person or on a known internal chat. A 30-second call has stopped tens of thousands of pounds being lost on a single invoice.

If you can, agree this as a written rule, even one paragraph in your finance notes is enough. That way, the answer to "can you just sort this quickly?" is always the same: "of course, I'll call you back to confirm the details first." Nothing to argue with, nothing personal.

If a payment has already gone

Don't wait. Call your bank straight away, in the UK you can dial 159 to reach your bank's fraud team safely, and tell them you think it was a scam payment. The earlier you call, the better the chance of recovering some or all of it.

Your one habit from this lesson

Any new payment, or any change to existing bank details, gets confirmed on a second channel (a known phone number or in-person) before money moves.

Track your progress and earn XP