Imagine receiving an invoice from a supplier your business has worked with for years. The email arrives in the same conversation as previous invoices, uses the correct company name and refers to a genuine transaction.
Everything appears normal.
Your finance team processes the payment, and the money leaves your account. Only later does the real supplier contact you to ask why their invoice remains unpaid.
The problem? Someone changed the banking details on the invoice and directed your payment to an account they control.
This is one example of business email compromise, a form of cybercrime that exploits trust in business communications. Unlike obvious spam, these messages can be convincing enough to fool experienced employees because they imitate legitimate suppliers, colleagues and business partners.
For businesses that rely on email for invoices, quotations, purchase orders and payments, understanding this threat is an important part of protecting company finances.
What Is Business Email Compromise?
Business email compromise, commonly known as BEC, is a type of fraud in which criminals manipulate business email communications to steal money, obtain sensitive information or persuade employees to take unauthorised actions.
Sometimes attackers gain access to a genuine email account and use it to send fraudulent messages. In other cases, they create a lookalike email address that resembles a trusted supplier or company executive.
The goal is to make the request appear legitimate.
An attacker might ask a finance employee to update a supplier’s banking details, send an urgent payment, purchase gift cards or share confidential company information.
These attacks do not always require sophisticated malware. In many cases, the criminal succeeds by exploiting trust, urgency and the assumption that an email conversation is genuine.
How Fake Invoice Fraud Works
Understanding how these attacks happen makes them easier to recognise.
1. The Attacker Learns About a Real Business Relationship
Criminals may obtain information through compromised email accounts, phishing, exposed business information or other sources.
They look for conversations involving invoices, payment dates, supplier names and the people responsible for approving payments.
With enough information, an attacker can construct a message that fits naturally into an existing business relationship.
2. A Convincing Email Arrives
The fraudulent message may appear to come from a genuine supplier or from an attacker-controlled address that closely resembles the supplier’s real address.
In some cases, the attacker has access to the actual mailbox and can reply within an existing email thread.
The message might explain that the supplier has changed banks, moved to a new account or needs payment urgently.
Because the conversation appears familiar, the recipient may not question the request.
3. The Business Pays the Wrong Account
If the employee accepts the new payment instructions without independently verifying them, the business may transfer money directly to the fraudster.
The legitimate supplier may still be waiting for payment, while the customer has already lost control of the funds.
Recovering the money can be difficult, particularly if the fraudulent payment is not reported quickly.
Why Traditional Email Filtering May Not Be Enough
Most businesses already use some form of spam filtering. These controls are important, but not every fraudulent message looks like spam.
An email containing an obviously suspicious link or a known malicious attachment may be detected by conventional filters. A carefully prepared message using ordinary business language, however, may not contain those obvious warning signs.
The challenge becomes greater when an attacker uses a compromised legitimate mailbox. The sender may have a genuine account, a familiar display name and access to real correspondence.
This is why business email protection should consider more than whether a message looks like bulk spam.
Depending on the system and configuration, additional controls may help identify suspicious sender behaviour, lookalike domains, malicious links, dangerous attachments and indicators associated with fraudulent messages.
No email security product can guarantee that every fraudulent request will be detected. Technical protection works best when combined with clear payment procedures and employee awareness.
Warning Signs Every Business Should Recognise
Although some fraudulent emails are difficult to distinguish from legitimate correspondence, certain situations deserve extra attention.
A supplier suddenly changes banking details. A familiar contact requests an urgent payment outside the normal process. An executive asks an employee to keep a transaction confidential. A message contains a slightly different email domain, or a supplier’s writing style changes unexpectedly.
These signs do not prove that an email is fraudulent, but they should trigger verification before action is taken.
Businesses should be particularly cautious when a message requests a change to payment instructions, bank account details, payroll information or other sensitive financial arrangements.
The most important rule is simple: verify unusual payment requests through a separate, trusted channel before sending money.
If a supplier requests a banking change, call them using a telephone number already held in your records. Do not rely on a number supplied in the suspicious email. Follow your organisation’s approval procedures and document the verification.
This simple control can help prevent fraud even when a convincing message bypasses technical filters.
How to Protect Your Business Against Email Fraud
Establish a Verification Process for Banking Changes
Every business should have a clear procedure for changing supplier payment details.
Require independent verification before updating banking information, and consider requiring approval from a second authorised employee for significant payments or changes.
The verification process should use a trusted contact method that is independent of the email requesting the change.
This is especially important when a message appears to come from a long-standing supplier. Familiarity should not replace verification.
Protect Business Email Accounts
Use strong, unique passwords and enable multi-factor authentication wherever supported. Limit access to business mailboxes and remove access promptly when employees or contractors leave.
If an attacker takes control of a genuine mailbox, they may be able to read previous conversations and use that information to prepare convincing fraudulent messages.
Regularly review account access, recovery options and suspicious sign-in activity. Employees should report unexpected authentication requests rather than approving them automatically.
Train Employees to Recognise Suspicious Requests
Staff members who handle accounts payable, procurement, payroll and supplier communications should understand how invoice fraud works.
Training should include realistic examples of fraudulent payment requests, lookalike email addresses, suspicious attachments and unexpected changes to supplier instructions.
Employees should know whom to contact when something seems unusual. They should never be penalised for pausing a payment to verify a legitimate concern.
Use Appropriate Email Authentication and Security Controls
Email authentication mechanisms such as SPF, DKIM and DMARC can help receiving systems assess whether messages are authorised to use a domain. Correctly configured policies can reduce certain types of domain spoofing.
However, these controls do not prove that every message from an authenticated domain is safe. An attacker using a genuinely compromised account may still send fraudulent messages.
Businesses should combine email authentication with appropriate filtering, account security, monitoring and payment verification procedures.
Add Dedicated Email Threat Protection
Businesses that receive invoices and financial instructions by email may benefit from additional security designed to identify phishing, suspicious attachments, lookalike senders and potential business email compromise.
The specific capabilities depend on the protection service, the email platform and its configuration. Businesses should confirm which threats are covered, how suspicious messages are handled and what happens when a message is incorrectly flagged.
Additional filtering can reduce exposure to certain threats, but it should not replace independent verification of payment instructions.
How Tremhost Armor Mail Helps Protect Business Email
Tremhost offers Armor Mail, an email protection service designed to add another layer of security to business communications.
Armor Mail is intended to help identify and filter threats such as phishing links, credential-harvesting attempts, malicious attachments, lookalike domains and suspicious messages associated with business email compromise.
The service also includes support for handling quarantined messages and reporting on detected threats, according to the advertised offering.
For businesses that do not have a dedicated cybersecurity team, managed deployment and ongoing tuning can reduce the burden of configuring and reviewing another security system themselves.
Armor Mail is advertised for supported business email environments, including Microsoft 365, Google and Tremhost-hosted email. Deployment options and compatibility should be confirmed for the specific environment before activation.
The advertised package starts at $12 per month for 10 protected mailboxes, with a 10-mailbox minimum.
You can review the offer here: Tremhost Armor Mail.
The objective is to give businesses an additional opportunity to identify suspicious messages before they lead to compromised accounts, fraudulent payments or other damage.
However, email protection cannot guarantee that every fraudulent invoice will be caught. Independent verification of banking changes remains essential, even when a business uses advanced email filtering.
What Should You Do If You Suspect Invoice Fraud?
If an employee receives a suspicious payment request, do not act on it until it has been independently verified.
If money has already been transferred, contact your bank immediately and request urgent assistance with the transaction. Notify the genuine supplier through a trusted communication channel and inform the relevant internal management or finance personnel.
If you suspect that a mailbox has been compromised, secure the account, review sign-in activity and investigate whether unauthorised forwarding rules or other changes have been introduced. Change affected credentials, revoke suspicious sessions and review access to other accounts where necessary.
Preserve the relevant emails and transaction records. If the incident involves unauthorised access or financial loss, consider reporting it to the appropriate authorities and obtaining professional technical assistance.
Speed matters because early reporting may improve the chances of limiting further damage or recovering funds, although recovery is never guaranteed.
Frequently Asked Questions
Can a fake invoice email look completely genuine?
Yes. Criminals may imitate a supplier’s name, use a similar email address or compromise a real mailbox. They can also use information from genuine conversations to make fraudulent requests appear credible.
Can email security software prevent invoice fraud?
Email security software can help identify certain phishing messages, suspicious links, malicious attachments and other indicators of fraud. However, no system catches every threat. Businesses should independently verify changes to payment instructions.
Is SPF, DKIM and DMARC enough to protect business email?
No. These technologies help receiving systems assess email authenticity and can reduce certain types of spoofing. They do not guarantee that a message from a legitimate or compromised account is trustworthy.
How much does Tremhost Armor Mail cost?
The advertised starting package costs $12 per month for 10 protected mailboxes, with a minimum of 10 mailboxes. Review the Armor Mail offer for the current terms and service details.
What is the most important step a business can take against invoice fraud?
Independently verify any change to supplier banking details before making a payment. Call a known, trusted contact using details already held in your records rather than relying on information provided in the email requesting the change.
Conclusion
Business email compromise is dangerous because it exploits something companies rely on every day: trust in communication.
A convincing fraudulent invoice can resemble a genuine supplier request, and a single incorrect payment can cause significant financial damage.
Businesses can reduce their exposure by verifying payment changes independently, securing email accounts, training employees and implementing appropriate email threat protection.
For organisations looking to strengthen their email security, Tremhost Armor Mail offers an additional layer of protection for business mailboxes. Combined with sound payment procedures and account security, it can form part of a more effective defence against email-based fraud.
Before your next supplier invoice arrives, make sure your business has a process for checking that the payment instructions are genuine.
