Imagine your business receives an invoice from a supplier you have worked with for years. The email arrives in an existing conversation, contains the correct company name and refers to a genuine order. Everything looks normal, so your finance department processes the payment.
A few days later, the real supplier contacts you to ask why the invoice has not been paid.
You investigate and discover that the banking details on the invoice were changed. The money was transferred to an account controlled by criminals.
This is business email compromise, commonly known as BEC. It is a form of cybercrime that exploits trust in business communication to steal money, obtain confidential information or manipulate employees into performing unauthorised actions.
For businesses in Zimbabwe, where companies regularly use email to exchange quotations, invoices, purchase orders and payment instructions, this is a threat that deserves serious attention.
The most concerning part is that these attacks do not always look like traditional hacking. A fraudulent message can arrive in a genuine email conversation, use familiar language and appear to come from someone your employees already trust.
The good news is that businesses can reduce their exposure through better payment procedures, stronger email security and employee awareness. Additional protection, such as managed email threat filtering, can also help identify suspicious messages before they cause damage.
This guide explains how business email compromise works, how fake invoice fraud happens, how to protect your organisation and what to do if you suspect an attack.
If your organisation wants an additional layer of protection for its email environment, explore Tremhost Armor Mail.
What Is Business Email Compromise?
Business email compromise is a type of targeted fraud in which criminals manipulate business email communications to obtain money, sensitive information or unauthorised access.
An attacker may compromise a genuine email account, impersonate a supplier or employee, or register a domain name that closely resembles a legitimate business address.
The objective is to make the fraudulent request appear trustworthy.
For example, a criminal may impersonate a supplier and ask your finance department to update its banking details. Another attacker may pretend to be a company director and instruct an employee to make an urgent payment.
Some criminals monitor genuine conversations before sending their fraudulent instructions. This gives them information about suppliers, transaction amounts, invoice dates and the people responsible for processing payments.
Unlike mass phishing campaigns, business email compromise is often targeted at particular organisations and employees.
It is therefore important to understand that a professional-looking email is not necessarily a legitimate one.
How Fake Invoice Fraud Works
Fake invoice fraud is one of the most damaging forms of business email compromise because it directly targets company payments.
Consider how a typical attack might unfold.
1. Criminals Identify a Business Relationship
The attacker first identifies a company and one of its suppliers. They may obtain information through phishing, compromised accounts, exposed business information or other sources.
They look for conversations involving invoices, quotations, purchase orders and payment arrangements.
If they gain access to a genuine email account, they may be able to read previous messages and understand how the two organisations communicate.
2. The Attacker Prepares a Convincing Message
The criminal then creates a fraudulent payment request.
In some cases, the attacker uses an email address that resembles the supplier’s legitimate address. In other cases, they gain access to the genuine supplier mailbox and send a message from that account.
The email may explain that the supplier has changed banks, opened a new account or updated its payment arrangements.
The request may be placed in an existing conversation, making it appear to be part of normal business communication.
3. The Finance Department Receives the Invoice
The employee receives what appears to be a legitimate invoice or payment instruction.
The supplier’s name is familiar. The amount may match an expected transaction. The email may refer to a genuine order.
Because the information looks correct, the employee may not question the banking details.
4. The Business Transfers the Money
If the employee accepts the new payment instructions without independent verification, the money may be transferred to the fraudulent account.
The genuine supplier remains unpaid, while the business discovers that its money has gone to the wrong recipient.
Recovering the funds can be difficult, especially when the fraud is discovered several days after the transaction.
Why Business Email Compromise Is So Difficult to Detect
Traditional spam filtering is important, but business email compromise can be more difficult to identify than ordinary junk mail.
A typical spam message may contain suspicious links, generic language or obvious signs of impersonation. A carefully prepared BEC message may contain none of these characteristics.
Consider an attacker who has compromised a supplier’s real email account.
The attacker may already know the supplier’s name, the customer’s contact person, the invoice reference and the amount due. They can use this information to send a message that fits naturally into an existing conversation.
The email may come from a legitimate account and may not contain an obviously malicious attachment.
This is why businesses should not depend on spam filtering alone.
Email security should be combined with account protection, payment verification procedures, domain authentication and employee awareness.
8 Warning Signs of Business Email Compromise
Although some fraudulent messages are difficult to recognise, there are warning signs that should make employees pause before taking action.
Unexpected changes to banking details: A supplier suddenly requests that future payments be made to a different bank account. This should always trigger independent verification.
Urgent payment instructions: A message pressures an employee to make a payment immediately or claims that a transaction will fail unless action is taken quickly.
Slightly different email addresses: A sender’s address may contain a small spelling difference, an additional character or a different domain extension.
Unusual confidentiality requests: An employee is instructed not to discuss a transaction with colleagues or to bypass the normal approval process.
Unexpected changes in communication style: A familiar contact suddenly writes differently, makes unusual requests or communicates in a way that does not match previous interactions.
Requests to bypass normal procedures: A message asks an employee to ignore existing payment approvals, supplier verification or financial controls.
Unexpected attachments or links: An invoice or document arrives when nobody was expecting it, particularly if the sender asks the recipient to sign in or download unfamiliar software.
Messages from compromised accounts: An email appears to come from a genuine supplier or colleague but contains unusual instructions. A genuine sender address does not guarantee that the account has not been compromised.
These warning signs do not automatically prove that an email is fraudulent. They indicate that the request should be checked before the business acts on it.
How to Prevent Business Email Compromise and Invoice Fraud
Preventing BEC requires a combination of financial controls, technical protection and employee awareness. The following measures can help reduce the likelihood of a successful attack.
1. Independently Verify Every Change to Supplier Banking Details
This is one of the most important protections against invoice fraud.
If a supplier sends an email requesting a change to its banking details, do not simply update the records and process the next payment.
Contact the supplier using a telephone number or other contact method already held in your company records.
Do not use a telephone number supplied in the email requesting the change. If the email is fraudulent, the contact information could also belong to the attacker.
Ask the supplier to confirm the change and document the verification before updating the payment information.
This procedure should apply even when the email appears to come from a genuine supplier mailbox.
2. Introduce Two-Person Approval for Important Payments
Businesses should avoid allowing one employee to independently change supplier banking details and authorise a significant payment.
Introduce a process in which sensitive financial changes require approval from another authorised person.
For example, an accounts employee may receive and verify a supplier invoice, while a manager approves the payment before it is released.
The precise approval thresholds will depend on the size and structure of the business.
The important principle is to separate payment preparation from payment authorisation wherever practical.
3. Enable Multi-Factor Authentication
Email accounts should be protected with strong, unique passwords and multi-factor authentication wherever supported.
Multi-factor authentication introduces another verification step when someone attempts to access an account. This can make it more difficult for an attacker to gain access using a stolen password alone.
Prioritise accounts belonging to directors, finance employees, procurement teams and administrators.
Employees should also be trained not to approve unexpected authentication requests. An unexpected sign-in notification may indicate that someone is attempting to access their account.
4. Configure SPF, DKIM and DMARC
SPF, DKIM and DMARC are email authentication technologies that help receiving mail systems assess whether messages claiming to come from your domain are properly authorised.
SPF identifies authorised sending servers. DKIM uses a digital signature to help verify message authenticity. DMARC provides instructions for handling messages that fail relevant authentication checks and supports reporting.
Correctly configured email authentication can reduce certain types of domain spoofing, where an attacker attempts to make a message appear to come from your company’s domain.
However, these technologies do not prevent every form of BEC. An attacker using a compromised legitimate mailbox may still send fraudulent messages.
Businesses should ensure that all legitimate email-sending services are accounted for when configuring these records.
5. Use Advanced Email Threat Protection
Basic spam filtering is useful, but businesses that regularly exchange invoices and payment instructions may need additional protection.
A dedicated email security service may provide capabilities designed to identify suspicious links, malicious attachments, lookalike domains, phishing attempts and potential business email compromise.
The precise capabilities depend on the service and its configuration.
For organisations that handle financial transactions through email, additional filtering can provide another opportunity to identify suspicious messages before employees act on them.
It is important to choose a service that explains what it protects, how suspicious messages are handled and what happens when a legitimate message is incorrectly flagged.
6. Train Employees to Recognise Fraudulent Requests
Technology alone cannot eliminate business email compromise.
Employees who handle invoices, procurement, payroll and supplier communication should understand how these attacks work.
Training should explain why a genuine-looking email may still be fraudulent, how to recognise suspicious sender addresses and why payment changes must be verified independently.
Staff should also know exactly who to contact when they receive a suspicious message.
A good security culture encourages employees to pause and verify unusual instructions rather than rushing to complete a task because an email claims it is urgent.
7. Review Mailbox Access and Forwarding Rules
When criminals compromise an email account, they may create forwarding rules to receive copies of incoming messages.
They may also create rules that hide certain messages or change how emails are organised.
Administrators should periodically review mailbox forwarding, account permissions, delegates and connected applications.
Remove unfamiliar access and investigate unexplained changes.
When employees leave the organisation, their access should be removed promptly, with business information retained according to the company’s policies.
8. Establish a Clear Incident Response Process
Employees must know what to do if they suspect an email account has been compromised or a fraudulent payment request has been received.
The organisation should have a process for reporting suspicious messages, securing affected accounts, notifying the relevant people and contacting the bank if money has already been transferred.
The faster a business responds, the sooner it can attempt to contain the incident and limit further losses.
What Should You Do If Your Business Has Already Paid a Fraudulent Invoice?
If your business discovers that it has transferred money to a fraudulent account, act immediately.
First, contact your bank through its official contact channels. Explain that the payment may have resulted from fraud and request urgent assistance with tracing, recalling or attempting to freeze the transaction.
Do not wait for the genuine supplier to investigate the matter before contacting your bank.
Next, notify the supplier using independently verified contact details. Confirm whether its email account was compromised and whether other customers may have received similar fraudulent instructions.
Inform company management and the finance team. Preserve the original email, message headers, invoice, payment confirmation and any related communication. These records may be important during an investigation.
If an employee’s mailbox may have been compromised, secure the account from a trusted device. Change the password, review multi-factor authentication and recovery settings, revoke suspicious sessions where supported and investigate forwarding rules or unfamiliar permissions.
Also consider whether the attacker may have accessed other accounts through password-reset messages or information contained in the mailbox.
If the incident involves unauthorised access, financial loss or exposed information, consider reporting it to the appropriate authorities and obtaining professional cybersecurity assistance.
Financial recovery is never guaranteed, but early action may improve the opportunity to limit further damage.
How Tremhost Armor Mail Helps Protect Against Business Email Compromise
Businesses need more than a mailbox that can send and receive messages. They also need to consider the threats that can arrive through those mailboxes.
Tremhost Armor Mail is an additional email protection service designed to help organisations reduce exposure to phishing, fake invoices, malicious attachments and other email-based threats.
According to the published Armor Mail service offering, its features include:
- Phishing and credential-harvesting links filtered before delivery.
- Business email compromise and fake-invoice detection.
- Malware and malicious attachment protection.
- Display-name and lookalike-domain impersonation detection.
- Warnings when a supplier’s mailbox appears compromised.
- Quarantine and message-release management.
- Tuning against the organisation’s actual email traffic.
- Monthly reporting on detected threats.
Armor Mail is advertised for supported environments including Microsoft 365, Google Workspace and Tremhost-hosted email. Deployment options depend on the email platform, and compatibility should be confirmed before activation.
The advertised starting package is US$12 per month for 10 protected mailboxes, with a 10-mailbox minimum.
The service also advertises managed deployment and two weeks of tuning against the organisation’s real email traffic. This helps the protection service account for legitimate business communication before enforcement decisions are made.
For businesses without a dedicated cybersecurity team, managed quarantine and threat reporting can also reduce the administrative burden on employees.
You can review the package and its current features at Tremhost Armor Mail.
It is important to understand that no email security product can guarantee that every fraudulent request will be detected. Even with additional protection, businesses must independently verify changes to supplier banking details and maintain proper payment approval procedures.
The strongest approach combines technology with sound financial controls.
Who Should Consider Additional Email Fraud Protection?
Additional email security is particularly relevant to organisations that regularly receive invoices, process supplier payments or exchange sensitive financial information.
Finance departments are obvious targets, but the risk extends beyond accounts employees.
Directors may receive urgent payment instructions. Procurement teams may communicate with numerous suppliers. Reception and administrative employees may receive messages that appear to come from senior management.
Businesses should identify which mailboxes receive invoices and which employees can authorise payments. Those accounts should receive particular attention when planning email security.
A small company may not need to protect every mailbox with the same level of priority. It can begin by identifying the accounts most closely connected to financial activity and sensitive business decisions.
For a company with 10 relevant mailboxes, Tremhost Armor Mail’s advertised minimum package provides a starting point for evaluating managed protection.
Visit Tremhost Armor Mail to review the current package.
Frequently Asked Questions About Business Email Compromise
What is the difference between phishing and business email compromise?
Phishing generally involves deceptive messages designed to trick people into revealing information, opening malicious files or visiting fraudulent websites. Business email compromise is a more targeted form of fraud that uses impersonation or compromised accounts to manipulate business transactions and communication.
Can a fake invoice come from a genuine supplier email address?
Yes. If criminals compromise a supplier’s mailbox, they may send fraudulent invoices or payment instructions from the genuine account. This is one reason why verifying changes to banking details independently is so important.
Can SPF, DKIM and DMARC stop business email compromise?
These technologies help receiving mail systems assess whether messages are authorised to use a domain. They can reduce certain types of spoofing, but they cannot guarantee protection against messages sent from compromised legitimate accounts.
Does ordinary spam filtering prevent invoice fraud?
Not always. Basic spam filtering can block many unwanted messages, but sophisticated invoice fraud may appear as a normal business conversation. Additional threat protection and independent payment verification can provide further safeguards.
How much does Tremhost Armor Mail cost?
The advertised starting package is US$12 per month for 10 protected mailboxes, with a minimum of 10 mailboxes. Visit Tremhost Armor Mail to confirm the current package and terms.
Does Armor Mail work with Microsoft 365 and Google Workspace?
The published service page lists support for Microsoft 365, Google Workspace and Tremhost-hosted email. Confirm the deployment method and compatibility requirements for your particular environment before subscribing.
Can a business recover money lost through invoice fraud?
Possibly, but recovery is not guaranteed. Contact your bank immediately, preserve the evidence and notify the relevant parties. The speed of reporting can matter when attempting to trace or recall a fraudulent payment.
What is the best way to prevent fake supplier banking details?
Independently verify every requested banking change by contacting the supplier through a trusted telephone number or another communication method already held in your records. Do not rely on the contact details contained in the email requesting the change.
Conclusion: Do Not Let a Fake Invoice Cost Your Business
Business email compromise is dangerous because it exploits the trust that keeps everyday business operations moving.
A fraudulent payment request may look like an ordinary supplier email. It may arrive in a genuine conversation, contain accurate invoice information and appear to come from someone your employees already know.
That is why businesses need to approach email security as both a technology issue and a financial control issue.
Verify banking changes independently. Introduce proper payment approvals. Secure employee accounts with multi-factor authentication. Train staff to recognise suspicious requests and use appropriate email threat protection.
For organisations that want an additional layer of protection against phishing, fake invoices and business email compromise, Tremhost Armor Mail offers a managed email security option starting at US$12 per month for 10 mailboxes.
The most important step, however, costs nothing: never change a supplier’s banking details based on an email alone. Verify the request independently before your business sends the money.
