“My supplier emailed new bank details. Is that normal?” Suppliers do change banks now and then. But an email that asks you to send money somewhere new is also the heart of what the FBI calls business email compromise: payments redirected to an account a criminal controls. The email alone cannot tell you which one you are looking at. Treat every change of payment details as a fraud until you have confirmed it on a phone number you already had. The rest of this article is why, and what to do if a payment has already gone.
How big the problem is
The FBI's Internet Crime Complaint Center (IC3) received 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558. In 2024 the figures were 21,442 complaints and $2,770,151,146. Of the crime types in the report, only investment fraud cost victims more. In a 2024 public service announcement the IC3 put the exposed losses from October 2013 to December 2023 at $55.5 billion, across 305,033 domestic and international incidents.
The IC3 defines the scam as one “targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments,” carried out “by compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques.” A contractor who pays suppliers and subs by transfer, and is paid by homeowners the same way, fits that description exactly.
Three ways it reaches a contractor
1. The supplier's “new account.” An FBI notice from November 2020 lays out the usual sequence. The criminal gets into a business email account, studies the correspondence, then “impersonates an employee over email communications to redirect pending or future payments to fraudulent bank accounts.” The same notice points to an earlier FBI warning about construction companies, which described criminals registering lookalike domains to impersonate vendors the victims already did business with. So the email can come from your rep's real address, or from one letter off it, and both look normal.
2. Your customer's final payment. Turn the first case around. If someone reads your mailbox, or registers a domain that looks like yours, they can email a homeowner “updated” wire instructions just before the final payment. The IC3's 2025 report describes a property closing in which the victim received a compromised email, supposedly from the title company, with wire instructions for over $1.3 million to a fraudulent account; the IC3's Recovery Asset Team got the receiving account frozen. A homeowner paying a remodeler can receive the same kind of email.
3. Your name used against your supplier. A 2023 IC3 announcement describes criminals who spoof real companies' email domains and employees' names to order goods from vendors on Net-30 and Net-60 terms, backed by fake credit references and fraudulent W-9 forms. Construction materials are first on its list of the goods they go after. Your supplier may learn your company's name was used only when the bill goes unpaid.
The 2025 report adds a newer wrinkle: chat generators that write official-sounding emails, and voice cloning used to request wire payments. Businesses reported more than $30 million in 2025 business email compromise losses involving AI. A familiar voice on the phone is no longer proof on its own, which is why the rule below has you place the call yourself.
The call-back rule
Write one rule down and hold everyone to it, including yourself: any change to where money goes is confirmed by phone, on a number from your own records, before a dollar moves. “Your own records” means the number on a contract, an invoice you have already paid, or the supplier's account paperwork, never the number in the email asking for the change. CISA's 2015 alert on these scams (now in its archive) put it plainly: verify a change in payment instructions by calling to confirm, and “the phone number should not come from the electronic communication, but should instead be taken from a known contact list for that vendor.” The IC3's 2024 announcement says the same in fewer words: use secondary channels or two-factor authentication to verify requests for changes in account information.
Lock the mailbox
The FBI's 2020 notice describes these schemes as starting with a compromised business email account, through social engineering or computer intrusion, so the mailbox is the thing to protect. CISA's small-business page on multifactor authentication says to turn it on “across systems like email, file storage and remote access” and to use the strongest option available. Its broader guidance is blunter: “Any form of MFA is better than no MFA.”
Then look for the trap the FBI's 2020 notice describes. Criminals who get in create auto-forwarding rules so the victim is less likely to notice the fraudulent messages. In one case it cites, a rule forwarded every email containing “bank,” “payment,” “invoice,” “wire” or “check” to the criminal. Because a rule made in the web version of an email account may not show in the desktop app, check both. The notice also recommends blocking automatic forwarding to outside addresses, and keeping logs of changes to mailbox logins and settings for at least 90 days.
If your business email still runs on a free webmail address, moving it to your own domain with SPF, DKIM and DMARC records is covered in Domain Email and Deliverability. Records on your domain say nothing about a lookalike domain someone else registered, though, which is why the call-back rule comes first.
A worked example
Say a remodeler gets an email from the cabinet supplier's usual rep, from the usual address, with the usual signature. The supplier has “moved banks,” and the next payment should go to the account in the attached letter. The remodeler finds the supplier's main number on last month's paid invoice and phones the accounts desk. They have not changed banks. The remodeler then forwards the email to the supplier, because the rep's real account has been compromised and other customers are probably getting the same letter, and changes the remodeler's own email password and turns on MFA in case the trouble started on that end. Total cost: one phone call.
The first hour after money goes to the wrong account
- Phone your bank's fraud line now. The IC3's 2025 report: “If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents.” It adds that institutions have different policies, so ask what yours will do.
- File at ic3.gov the same day. “Regardless of the amount lost, file a complaint at www.ic3.gov,” with the full transaction details. The IC3's Recovery Asset Team works with banks to freeze money in the receiving account. In 2025 it acted on 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, a success rate the report gives as 58 percent.
- Gather what the report needs. The 2023 announcement asks for the names used, phone numbers, email addresses, transaction information and domains. Save the emails with their full headers; do not delete anything.
- Secure the mailbox. Change the password from a device you trust, turn on MFA, sign out every other session, and remove any forwarding rule you did not create.
- Warn the people on the other side. Tell the real supplier, and any customer who may have received fake instructions in your name.
Do not count on the consumer protections you may know from your personal checking account. Federal Regulation E, the rule for electronic fund transfers from consumer accounts, applies to accounts “established primarily for personal, family, or household purposes” (12 CFR 1005.2(b)(1)), and its definition of an electronic fund transfer leaves out “any transfer of funds through Fedwire or through a similar wire transfer system” used primarily between financial institutions or businesses (12 CFR 1005.3(c)(3)). A wire from a business account sits outside both, which is one more reason the call-back is worth the minute it takes. Keeping business money in its own account, as Separate Business and Personal Money explains, at least keeps a loss in one place.
General information, not legal or tax advice. Rules change and vary by state; check with the agency named above or a professional for your situation.