The e-mail looks routine. It comes from a supplier you pay every month, it refers to a real invoice, and it says the supplier has changed banks: “please use the new account details below for this and future payments.” Your accounts team updates the details and pays. A few weeks later the real supplier calls to ask why they haven’t been paid.

This is business e-mail compromise (BEC), and it is the most expensive kind of cybercrime aimed at businesses. In the US alone, the FBI received 24,768 BEC complaints in 2025, with reported losses of just over $3 billion. Indian businesses see the same scams every day, and we see them in our own consulting work. No malware is needed, and nothing looks broken. The attacker only has to persuade one person to pay one invoice to the wrong account.

How the scam works

  1. Getting in. The attacker either breaks into a real mailbox (yours, or your supplier’s) with a phishing e-mail or a reused password, or registers a lookalike domain such as cateye-tech.com or cateyetech.co.
  2. Watching. Inside a real mailbox, they read quietly for days or weeks. They learn who pays whom, when invoices go out, how people sign off their e-mails, and who is travelling.
  3. Striking. At the right moment they send the request: changed bank details, an urgent payment for a “confidential deal”, or a request from the CEO who is “in a meeting and can’t talk”. Often they reply inside a genuine e-mail thread, so it feels completely normal.
  4. Moving the money. The money lands in a mule account and is moved on within hours. The faster it is reported, the better the chance of getting any of it back.

The versions to watch for

  • Changed bank details from a supplier, the most common and most costly version.
  • The CEO or CFO asking for an urgent transfer, often “confidential, don’t discuss with anyone”.
  • Payroll diversion: an “employee” asks HR to change the account their salary goes to.
  • Gift cards or vouchers for a “client thank-you”, requested by a senior person.
  • Deepfake voices and video calls. In 2024 a finance employee at the engineering firm Arup in Hong Kong paid about US$25 million after a video call in which the CFO and other colleagues were all AI-generated fakes. A phone call or video call is no longer proof on its own.

Warning signs

  • New bank details, especially a different bank, branch or country from before.
  • Urgency and secrecy together: “today, before the cut-off” and “keep this between us”.
  • A sender address or reply-to address that is slightly different from the usual one.
  • A senior person who suddenly can’t take a call.
  • Small changes in tone, signature or e-mail layout.

Five checks before you pay

None of these needs new software. They need a short written rule that everyone in finance follows, every time, including for the boss.

  1. Call back on a number you already have. Any change of bank details is confirmed by phone, using the number in your own records or on an old invoice, never the number in the e-mail asking for the change.
  2. Read the full address, not just the name. Check the domain letter by letter, and check where a reply would actually go. Lookalike domains and a different reply-to address are the attacker’s favourite tools.
  3. Use the bank’s name check. In India, banks have offered a beneficiary name look-up for NEFT and RTGS since April 2025: before you send, the bank shows the name on the account. If it doesn’t match your supplier’s legal name, stop. In other countries, ask your bank what payee-verification it offers.
  4. Two people for new payees and changed details. One person enters a new account or a change, a second person approves it, and the first payment to a new account waits a day. That one day is often enough for the real supplier to notice.
  5. Treat “urgent and confidential” as a reason to slow down. Make it policy that no one is ever in trouble for delaying a payment to check it, and that urgent requests from senior people are verified in the same way as any other.

Technical controls that help

  • Multi-factor authentication on every mailbox, so a stolen password alone doesn’t give an attacker your e-mail.
  • SPF, DKIM and DMARC on your own domain, so others can’t easily send e-mail pretending to be you.
  • An “external sender” tag on e-mails from outside the company, so a fake “CEO” e-mail from outside stands out.
  • Alerts on new forwarding rules. Attackers who get into a mailbox often add a rule that forwards or hides messages, so a new rule should raise an alert.
  • Register the obvious lookalike domains of your own name, so they can’t be used against your customers.

If you use Microsoft 365, our checklist of 10 Microsoft 365 security settings covers most of these.

If you have already paid

  1. Call your bank immediately and ask them to recall or freeze the payment. Minutes and hours matter.
  2. Report it. In India, call the national cybercrime helpline on 1930 or report at cybercrime.gov.in. In the US, file at ic3.gov as quickly as possible.
  3. Keep the evidence. Don’t delete the e-mails. Keep them, with their full headers, and the payment records.
  4. Assume a mailbox may be compromised. Reset passwords, sign out all sessions, and check for forwarding rules, on your side and with the supplier.
  5. Tell the supplier through a known phone number, so they can check their own systems and warn their other customers.

Our post on the first 60 minutes after a cyber attack has a one-page plan for incidents like this.

How CATEYE can help

We help businesses in India and the US close the gaps that BEC relies on: phishing awareness for finance and leadership teams, payment-verification procedures, and e-mail security set-up. Our IT security audit checks your e-mail, accounts and processes and gives you a clear fix list. Talk to us about a review.