HOW FRAUD HAPPENS
Everything looks legitimate. Until the money is gone.
The email comes from a real business account. The documents look official. Someone even confirms the payment change by phone.
So how can the money still end up in the wrong hands?
THE THREAT
The business you trust may have been hacked without knowing it.
Criminals can secretly gain access to a business's real email account. They can read past conversations, monitor upcoming payments, and learn who the business works with, all without anyone realizing they're there.
When they're ready, they can send fraudulent payment instructions directly from the email address you already recognize.
No fake email address. No obvious warning signs. Just a message that looks like any other business conversation.
You recognize the business. You recognize the email address.
But do you know who's actually sending the message?
THE PAYMENT RISK
You could send money to the wrong business, and your bank may not catch it.
When you send money by ACH or wire transfer, your bank doesn't necessarily confirm that the account belongs to the business you think you're paying.
Criminals know this. They can provide payment instructions for an account they control, sometimes even registering a separate company with the same name as the business you're trying to pay.
The account can be legitimate. The company name can match. The payment can go through without raising an alarm.
By the time you realize you've paid the wrong business, your money may already be gone.
Business A
Riverbend Supply Co.
The business you intended to pay
Business B
Riverbend Supply Co.
A separate company, same name
HOW THE SCAM WORKS
How the scam unfolds
A common example of how criminals steal business payments.
- 1
Criminals hack the email account of a business you need to pay.
Your email hasn't been hacked. Criminals have secretly accessed the company's email, allowing them to read your conversations without either of you knowing.
- 2
They wait for the perfect timing.
They study invoices, payment schedules, and conversations, sometimes spending weeks or months waiting until you're about to make a payment.
- 3
They ask you to update your records with the company's new bank account.
Using the company's actual email account, they claim its banking information has changed and ask you to update your records before paying.
- 4
They know you'll double-check.
When you question the change, they've prepared to provide documents, accurate company information, or even arrange for someone to answer your call and pretend to be an authorized employee.
- 5
You send the payment. The criminals get the money.
Your bank processes the payment as instructed, and everything appears normal. But the money goes to criminals instead of the business you intended to pay.
FALSE CONFIDENCE
You can follow every procedure and still be deceived.
Checking an email address, reviewing documents, or making a phone call may seem like enough. But what are those checks actually proving?
| What you checked | What it doesn't prove |
|---|---|
| The email came from the correct address | The real employee sent it |
| The bank letter looked official | The document is genuine |
| The company information matched | The requester works for that company |
| Someone confirmed the change by phone | You spoke to the actual employee |
| The bank account was valid | It belongs to the business you intended to pay |
The most convincing scams don't look suspicious.
Most payment requests are legitimate. But criminals know what businesses look for, and they prepare accordingly.
Whether you're paying for equipment, supplies, transportation, or contracted work, a new business relationship or a change in payment instructions deserves an independent check before you send money.
THE CONSEQUENCES
One wrong payment costs more than the money.
The cost is not only the money. It is the payroll that gets delayed, the supplier who stops shipping, the owner who has to explain it, and too often the employee who gets the blame for following the process.
Your accounts payable team is not the weak link. A request can look perfect from the inside, and no one should be expected to spot it from an inbox.
Warning signs worth a closer look
- A change of bank account, especially close to a payment date
- Pressure to hurry or keep it quiet
- A new account in a different state, a different name or a personal name
- A new contact, or a familiar contact who suddenly writes differently
- A reason you cannot call, such as "I'm traveling"
Where BeVerifyd comes in
Know who you're dealing with before you send money.
BeVerifyd provides an independent, human-led verification service for businesses reviewing new business relationships and changes to payment instructions.
BeVerifyd provides an additional verification step to help businesses make more informed payment decisions. Verification does not guarantee fraud prevention or independently establish ownership of a receiving bank account.