Phishing and Business Email Scams: A Small Business Guide

Imagine an email that looks like it came from a supplier you pay every single month. The message is courteous, the invoice formatting is identical to previous statements, and there is only one minor update: “Please note our new bank account and routing details for this payment.”

Someone in your bookkeeping or operations office processes the payment as requested. Days later, the real supplier calls asking why their invoice is overdue. By then, the money is gone, routed through intermediate accounts, and virtually unrecoverable. This scenario is not hypothetical; it is the exact execution pattern behind Business Email Compromise (BEC)—the costliest cyber threat targeting small and mid-sized enterprises today.

According to the FBI Internet Crime Complaint Center (IC3) 2025 Annual Report, business email compromise caused $3,046,598,558 in reported losses in 2025, surging from $2,770,151,146 in 2024. Because these figures only represent victims who formally filed reports, the true economic damage is significantly higher. For a growing business, the critical question is practical: how do you identify these deceptive messages, and what procedural guardrails ensure that a single erroneous click or fraudulent payment cannot wipe out your operating capital?

This operational guide synthesizes official investigative findings and defense standards published by the Federal Bureau of Investigation (FBI), the Federal Trade Commission (FTC), and the Cybersecurity and Infrastructure Security Agency (CISA).

What Are Phishing and Business Email Compromise?

While often used interchangeably in casual conversation, phishing and business email compromise represent two distinct phases of cyber operations:

• Phishing: A fraudulent message engineered to trick an employee into executing an unsafe action—clicking a credential-harvesting link, downloading a malicious PDF attachment, or revealing private network access details. Most phishing campaigns are sent broadly across thousands of companies.
• Business Email Compromise (BEC): A sophisticated, tailored attack targeting companies that regularly conduct wire transfers or automated clearinghouse (ACH) payments. The FBI IC3 formally defines BEC as a scheme where criminals compromise legitimate corporate email accounts, phone numbers, or virtual meeting tools through social engineering or computer intrusion to execute unauthorized transfers of capital.

How They Connect: Phishing hunts for access; BEC hunts for capital. A successful phishing attack that captures an employee’s Microsoft 365 or Google Workspace password gives threat actors direct access to real email threads, vendor contracts, and billing schedules. Armed with legitimate message histories, scammers craft hyper-realistic spoofed invoices that internal staff have no reason to suspect.

The Warning Signs of an Email Scam

No single indicator conclusively proves an email is fraudulent, and legitimate vendor messages can occasionally look informal. However, whenever two or more of the following warning signs align, staff must pause and initiate verification:

Warning Sign	Real-World Indicator & Phrasing	Federal Guidance Source
Artificial Urgency & Pressure	“Pay within 2 hours or shipments will be halted,” “Wire immediately; I am boarding a flight and unreachable.”	CISA
Unprompted Payment Changes	Requests to update direct deposit accounts, remit to a new foreign entity, or use alternative ACH routing.	FTC, CISA
Unsolicited Account Lock Alerts	Notifications claiming a banking portal, Microsoft account, or payroll system has experienced “unusual activity.”	FTC
Generic Or Stilted Greetings	“Dear Valued Client” or “Dear Employee” from a primary vendor or executive who normally addresses you by first name.	FTC
Lookalike Domains & Typo-Squatting	A sender address with a subtle misspelling (e.g., @cornpany.com instead of @company.com) or strange top-level domains.	CISA
High-Fidelity Brand Imitation	Pixel-perfect replicas of QuickBooks, Intuit, DocuSign, Microsoft, or regional bank security banners.	FTC
Embedded Links to Update Details	The FTC emphasizes that legitimate banks and SaaS providers do not distribute unsolicited links to update financial credentials.	FTC

How AI Has Transformed the Threat Landscape

For decades, security awareness training taught staff to identify phishing by looking for poor grammar, spelling errors, and awkward phrasing. In 2026, that advice is dangerously obsolete.

The FBI IC3 2025 Annual Report highlights that large language models (LLMs) allow cybercriminals to instantly generate grammatically flawless, authoritative emails that mirror the exact corporate tone of a target’s CEO or chief financial officer. Furthermore, malicious actors increasingly deploy generative AI voice cloning during follow-up phone calls to confirm fraudulent wire instructions. In 2025, commercial enterprises reported losses exceeding $30 million directly attributable to AI-enhanced BEC campaigns.

The Operational Lesson: Defense cannot rely on human intuition or visual inspection of writing style. Protection must rely on enforceable operational verification protocols that hold firm even when the incoming message or voice call appears flawless.

Five Common Small-Business Attack Scenarios

Threat actors deploy specific narrative playbooks designed to induce anxiety, urgency, and procedural shortcuts:

• 1. The “Updated Bank Details” Trap: An email arrives from an established subcontractor or vendor stating that due to an internal bank audit or year-end restructuring, upcoming disbursements must be sent to a new account. The invoice attached is legitimate, but the banking destination belongs to the criminal.
• 2. The Phantom Invoice: A billing notice arrives for web hosting, domain maintenance, legal consultation, or IT licensing that nobody remembers ordering, coupled with a link to “review the contract and approve immediate payment.”
• 3. The Confidential Executive Directive: A message spoofing the founder, managing partner, or CEO requests an urgent wire or digital gift card purchase for a confidential client incentive, instructing the employee: “I am in meetings all day—please wire this quietly right now and text me confirmation.”
• 4. The Shared-Document Credential Harvester: An email claiming to be from a supplier or project partner shares an encrypted financial file or quote via OneDrive, SharePoint, or DocuSign. Clicking the link routes to an identical login portal designed to steal enterprise credentials.
• 5. The Payroll Routing Switch: A spoofed email purporting to come from an active staff member asks HR or bookkeeping to update their payroll direct deposit information before the upcoming pay cycle closes.

The “Verify Before You Act” Payment Rule

Regardless of whether an incoming request involves a $500 invoice or a $75,000 progress wire, staff must adhere to the Verify Before You Act protocol codified by CISA and FTC fraud defense frameworks:

Payment Controls That Stop Wire & ACH Fraud

Employee awareness training is helpful, but institutional rules are vastly superior because they do not depend on an individual’s alertness during a chaotic Friday afternoon rush. Implement these six internal controls:

• Mandatory Out-of-Band Callback: Whenever a payee requests changed banking coordinates, phone the vendor using a pre-existing number stored in your master accounting system—never the phone number printed on the email or invoice footer.
• Dual-Custody Approvals: Configure banking portals and accounting software so that no single individual can unilaterally add a new vendor, modify bank routing, and release an outgoing wire. Every payment above a predetermined threshold ($2,500) must require two independent signers.
• Pacing Protocol on Urgent Requests: Institute an explicit operational rule that urgency is a pause indicator. Real suppliers and business partners expect verified accounting procedures and will accommodate a 15-minute verification delay.
• Pre-Approved Vendor Whitelist: Maintain a vetted list of authorized payees. Any modification to vendor tax IDs, remittance addresses, or banking details requires formal manager sign-off.
• Executive Confirmation Channels: Establish a predetermined verbal or encrypted chat protocol for senior leadership. Company executives should never request financial transfers exclusively over unconfirmed email.
• Bank Fraud Safeguards: Inquire with your commercial banking representative about Positive Pay, ACH blocks, dual-token authorization, and automated transaction monitoring.

Cultivating Resilient Staff Habits

Technology defenses are only as effective as the organizational culture supporting them. Leadership must cultivate a blame-free reporting environment. An employee who promptly reports an accidental click allows IT to isolate credentials immediately; an employee who conceals a mistake out of fear of punishment gives attackers days of undetected lateral movement.

• Never Click or Unsubscribe: CISA explicitly instructs users to avoid clicking “unsubscribe” links within suspicious emails, as doing so confirms to the attacker that the email address is actively monitored.
• Report to Official Clearinghouses: In addition to notifying internal IT, forward suspicious phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forward SMS phishing texts to 7726 (SPAM), and submit fraudulent business schemes to the FTC at ReportFraud.ftc.gov.
• Conduct 5-Minute Scenario Drills: Dedicate five minutes during monthly team meetings to review a real phishing sample. Interactive walkthroughs build far stronger operational memory than annual compliance videos.

Incident Response: The First Hour After a Breach or Fraudulent Wire

If an employee clicks a malicious link, enters credentials, or releases an unauthorized wire, speed is the single most critical variable. Execute this sequence immediately:

Timeframe / Step	Immediate Action Required	Authoritative Guidance
Minute 0 – 15: Financial Recall	If funds moved, call your bank’s wire/fraud department immediately. Request an emergency wire recall and instruct them to contact the beneficiary bank.	FBI Financial Fraud Kill Chain
Minute 15 – 30: Federal Reporting	File a comprehensive incident complaint at ic3.gov. Include transaction numbers, SWIFT codes, recipient details, and raw email headers. In 2025, the FBI Recovery Asset Team froze $679,013,183 across 3,900 incidents.	FBI IC3 RAT
Minute 30 – 45: Credential Quarantine	Terminate active web sessions, reset compromised account passwords, and enforce hardware-backed MFA across Microsoft 365, Google Workspace, and accounting systems.	CISA Cyber Hygiene
Minute 45 – 60: System Sanitization	Isolate the affected workstation from the local network, run full endpoint malware scans, and verify whether forwarding rules were added to the employee’s inbox.	FTC Business Guidance
Post-Hour: Legal & Identity Review	If PII, Social Security, or banking data was compromised, consult IdentityTheft.gov, notify cyber insurers, and review state breach disclosure requirements.	FTC & State Law

Frequently Asked Questions

Action Checklist: Five Steps to Take This Week

1. Formalize the Out-of-Band Callback Rule: Draft and circulate a mandatory one-page policy: any new vendor setup or bank change requires verbal phone verification on a known number and a second approver before payment release.
2. Distribute the Five BEC Scenarios: Share the five attack patterns (bank change, fake invoice, CEO directive, shared login, payroll change) with every team member handling email or disbursements.
3. Establish a Blame-Free Reporting Policy: Reassure staff that rapid reporting of accidental clicks will be met with immediate technical support rather than disciplinary reprimand.
4. Record Emergency Fraud Contacts: Document your commercial bank’s direct wire fraud dispatch number and keep it accessible to primary accounting personnel.
5. Enforce Multi-Factor Authentication: Verify that hardware or authenticator app-based MFA is activated across all executive, bookkeeping, email, and banking accounts.