Log In× Close
October 15, 2026
by Joe Bolsover and Michael Koch
It’s 4pm on Friday. An accounts payable employee receives an email from a long-time vendor requesting that future payments be redirected to a new bank account. “No big deal,” they think. The email address looks legitimate, and the attached invoice references an ongoing project. The employee updates the payment details and approves payment. On Monday morning, the vendor notifies the organization that their email account was compromised. The organization sent money to a bank account controlled by a criminal, and recovering the money may be impossible.
The organization has fallen victim to one of the most common and costly forms of financial fraud: Business Email Compromise.
Business Email Compromise (BEC) is a type of fraud where an attacker impersonates or compromises a trusted person or organization to trick an employee into transferring money or changing payment information. According to the FBI Internet Crime Complaint Center (IC3), over $3 billion in losses were reported due to Business Email Compromise, making it the second most costly kind of cyber-enabled fraud.
What steps can your business take to reduce the risk of this type of fraud?
The strongest defense against BEC is independent verification. Any request that involves a change in bank details should be verified through a separate trusted communication method. If an employee receives an email asking to change bank details, they should call the vendor with a known, trusted phone number and verify that the request is legitimate. Likewise, if an employee receives an email from their CEO, CFO or Manager, for example asking for an outgoing wire transfer, the employee should call that person using a trusted phone number to verify the request. Businesses should establish financial procedures around independent verification for any financial changes or requests received. This can help stop a BEC attack even if the employee has become a victim of social engineering.
Businesses should also protect and secure their email accounts. Email accounts should have strong, unique passwords and multi-factor authentication. Devices used to access email should be protected with antivirus software that is kept up to date. This includes all computers, phones, and other devices commonly used to access work emails.
Employees are your first line of defense against cybersecurity threats, so investing in ongoing employee training is integral to ensuring the safety of any business. All staff should be trained to understand social engineering and spot red flags for phishing attacks. Proper password security should also be part of any cybersecurity training.
Reacting to Security IncidentsIf the attack succeeds, time is of the essence. Immediately contact your bank’s fraud department and request that the funds be recalled, stopped, or reversed. If an email account in your organization is compromised, at a minimum, block sign-ins on the affected account, reset the password and multi-factor authentication, and notify your IT team immediately. If the account is still sending malicious emails, contact a trusted IT Security partner to assist in containing the account.
The next time any email involving money shows up in your inbox, remember to always stop, think, and independently verify the request before sending any funds (wire, ACH, etc.) and/or changing bank account information. Treat unusual urgency in emails as a reason to slow down, not to speed up. Scammers create this sense of urgency, and they use fear and intimidation practices when doing so. Establish business-wide policies around financial change requests. This would also be true for doing business with a new company where they can create a fake invoice. Secure email accounts to protect them from compromise. Finally, if a BEC happens to your organization, contact your bank immediately to limit the damage and improve the chances of recovering stolen funds. You’ll also want to talk with law enforcement, IC3.gov, Federal Trade Commission and other law enforcement organizations.
Michael Koch is New Tripoli Bank's Business Development Manager and has previously served as a Branch Manager. He has been a member of the New Tripoli Bank team for over 20 years and has decades of experience working with business customers.
Joe Bolsover is a Network Specialist for New Tripoli Bank with years of experience in IT Support. He is responsible for maintaining bank cybersecurity and technology to better serve our customers.
Log into Online Banking