Business email compromise: what to do

What business email compromise looks like

An email arrives that looks exactly like one from your supplier, your director, or your own finance team. The sender name and signature match, and the request feels routine: an invoice, an urgent payment, or a change of bank account.

Behind it, a scammer has copied a real email thread or taken over an actual inbox. They study how your business normally communicates, then time the message to match a real deal already in progress.

The email usually adds pressure. It might say the payment is overdue, the deal will fall through, or the director is travelling and cannot take calls.

Why the changed bank details are believed

The request rarely looks strange on its own. It references a real invoice number, a real amount, or a real project, because the scammer read it from the compromised inbox.

Staff under time pressure can easily skip the one check that would catch it: calling the supplier on a known number. A domain that looks almost identical to the real one, with one letter swapped, is easy to miss in a busy inbox.

By the time the payment is queried, the money has already left and moved through the receiving account.

Can a diverted payment be recovered

Recovery depends almost entirely on speed. If you catch it within hours, your bank may still be able to recall the transfer or place a hold on the receiving account before it is emptied.

Once a day or more has passed, the funds are usually moved on quickly, which makes tracing harder. A civil claim against the scammer can still be worth exploring for larger amounts, even after a recall has failed.

No one can promise the money will come back. What matters most is acting immediately rather than waiting to confirm every detail first.

What to do first

Contact your bank the moment you suspect the payment is wrong, and ask them to attempt a recall while you gather details. Read how a bank recall works so you know what to expect.

Report the matter through the first actions after a scam, including a call to the National Scam Response Centre on 997 if the transfer was recent. Then make a police report so the Commercial Crime Investigation Department (CCID) can open a case.

Preserve the original email with its full headers, the invoice, and any chat messages about the change. This is the evidence a bank or investigator will ask for first.

When a lawyer helps

A lawyer is useful once the immediate reporting is done and the amount is significant enough to weigh a civil claim or a freezing order. They can also help if your business needs to show due diligence to insurers or auditors afterward.

A first assessment can tell you honestly whether pursuing the receiving account is worth the cost. You do not need every document ready before you ask.