Business email compromise: how to stop fake payment requests
By Muzamil Awan · Updated
Business email compromise (BEC) is when a criminal uses a hacked or fake email account to trick your team into paying them. Losses reported to the FBI reached $3.04 billion in 2025. The best defense is a payment rule no email can get around: the real approver confirms every risky payment outside email.
Common types
- Fake supplier invoices and bank-change requests
- A fake CEO or CFO asking for an urgent wire
- Payroll diversion, where an "employee" changes their direct deposit
- Fake lawyer or closing payments in a property or company sale
Why email security isn't enough
Filters catch a lot of phishing, but BEC often comes from a real, hacked inbox with no link or attachment to scan. The email looks normal because it is sent from a real account.
Controls to put in place
- A written rule: no bank-detail changes by email
- Two-person approval for new payees and bank changes
- Confirmation from the real approver outside email
- Training, so staff know they can pause a request from the "CEO"
- An audit log of every approval
Where Paysealed fits
Paysealed's Gmail and Outlook add-ons flag risky requests, like an email asking you to pay a new bank account or an urgent payment to a new payee, and Paysealed holds them until the real approver confirms on their own registered phone with Face ID or a fingerprint. An email, a call or a cloned voice can't produce that confirmation.
Questions
- What should we do if we already paid a fake invoice?
- Call your bank immediately and ask them to recall the payment. In the US, file a complaint at ic3.gov. Then tell your insurer and reset the passwords of any email account that may be compromised.
- Does BEC only target large companies?
- No. Small and mid-size companies are frequent targets because they often rely on email and trust, with fewer approval steps.
Sources
Try Paysealed free
Free pilot for founding customers.