One of the most expensive scams small businesses face doesn't involve viruses at all. A criminal sends an email that looks like it's from a vendor, a client or your own boss, asking you to pay an invoice or send money to a new bank account. The FBI calls this business email compromise, and it consistently ranks among the costliest kinds of cybercrime reported to its Internet Crime Complaint Center.
Seven warning signs
- Changed payment details. "We've switched banks, please use this new account." This is the single biggest red flag.
- Urgency or secrecy. "This needs to go out today," or "Don't mention this to anyone yet."
- A slightly wrong address. rn instead of m, an extra letter, or a different ending like .co instead of .com. Check the actual address, not just the display name.
- Reply-to doesn't match. The email appears to come from your vendor, but replies go somewhere else.
- An unexpected invoice or attachment, especially one that asks you to sign in to view it.
- A request from "the boss" that skips normal process, like gift cards or a wire to a new recipient.
- It arrives at the perfect moment. Criminals who've broken into a real mailbox wait for a real deal, then step in with "updated" instructions right before closing or payment.
The rule that stops most of these scams
Verify any new or changed payment instructions by phone, using a number you already have. Not the number in the email, and not a reply to the email. Make it a written policy, so nobody feels awkward following it.
Technical protections every business should have
- Multi-factor authentication on every mailbox, so a stolen password isn't enough to break in.
- SPF, DKIM and DMARC records on your domain, which make it much harder for criminals to send email pretending to be you.
- Email filtering that flags external senders and lookalike domains.
- Sign-in monitoring that alerts on logins from unusual places.
- Security awareness training, so staff recognize the warning signs.
If you think you've been caught
- Call your bank immediately and ask them to recall or freeze the transfer. Speed matters.
- Report it to the FBI at ic3.gov.
- Change the passwords on any accounts that may be compromised, and check mailboxes for forwarding rules you didn't create.
- Call your IT provider and your cyber insurance carrier.
Want a second set of eyes on your email security?
Our free security assessment checks multi-factor coverage and your SPF, DKIM and DMARC settings, among other things, then ranks your biggest risks in plain English. See how we protect Maine businesses.