The common forms
- Invoice or payment redirection — a supplier’s “new bank details”, or your own invoices altered before your client pays.
- Director impersonation — an urgent request, apparently from a director, for a payment or gift cards.
- A compromised mailbox — a criminal signs in to a real account, reads the conversation, and replies at exactly the right moment.
- Lookalike domains — yourcompany-uk.co.uk or a single swapped letter, which passes a quick glance.
How to stop it
- Verify bank detail changes by phone, on a number you already hold — never one from the email. This one control stops most BEC losses.
- Turn on multi-factor authentication for every mailbox, so a stolen password is not enough.
- Publish DMARC, so nobody can send email from your exact domain. Check yours with our free email security checker.
- Use impersonation protection that flags lookalike domains and display-name tricks.
- Tell your clients you will never change bank details by email, and put it on your invoices.
If it happens
Call your bank immediately — the sooner they act, the better the chance of recovering the money. Then report it: in England, Wales and Northern Ireland to Report Fraud, the national police service that replaced Action Fraud, at reportfraud.police.uk or 0300 123 2040; in Scotland, to Police Scotland on 101. Change the passwords on any affected mailbox, check for forwarding rules a criminal may have added, and tell anyone who may have received fraudulent emails from you.