Business email compromise is not a new threat. But the 2025 wave of attacks targeting small business payment workflows is more patient, more targeted, and more expensive than anything the FBI’s Internet Crime Complaint Center has previously tracked. Finance teams approve payments they believe are legitimate — and by the time anyone notices, the money is gone. This piece breaks down what is actually happening, why business email compromise is an IT problem just as much as a financial controls problem, and what a well-run organization should already have in place.
What Is Actually Happening in Business Email Compromise Attacks
The playbook runs on patience. It typically begins with a compromised email account — either at the target company or at one of its vendors. The attacker monitors the account silently, sometimes for weeks, reading threads and learning the normal rhythm of payment requests, invoice formats, approval chains, and the informal language the parties use with each other.
Once they have enough context, they introduce a change. It might be an email appearing to come from a trusted vendor, informing the accounts payable team that banking details have changed. It might be a new vendor account submitted through the company’s own vendor portal, with documents that look legitimate because they are partially real. Either way, the next wire transfer goes to an account the attacker controls.
The FBI’s IC3 has consistently ranked business email compromise as the highest-dollar loss category for small and mid-size businesses. In its most recent annual report, IC3 recorded more than $2.9 billion in losses attributed to business email compromise in a single year — and that figure reflects only what was reported. The actual number is meaningfully higher.
What is different in 2025 is the integration of fraudulent vendor onboarding into the attack chain. Attackers are not just sending a fake invoice from a spoofed address. They are building complete vendor profiles — sometimes including fabricated tax identification documents and bank verification letters — and submitting them through the same portals your team uses to onboard real suppliers. The fraud happens upstream of the payment itself, which is why traditional payment approval controls alone are not catching it.
Why Accounts Payable Is the Preferred Target
Accounts payable sits at an intersection attackers find irresistible. The team is expected to process payment requests efficiently. There is natural pressure to keep vendors paid on time and to avoid the friction of questioning routine-looking requests. The dollar amounts are often large enough to be worth the attacker’s effort but routine enough that they do not automatically trigger extra scrutiny.
Payroll fraud and executive impersonation still occur. But vendor payment fraud has a structural advantage for the attacker: it spreads risk across many relationships. A company might have dozens or hundreds of vendor relationships, and not every team member knows every vendor’s normal communication style. That ambiguity is exactly what gets exploited.
There is also a timing element. Many small businesses run wire transfers on predictable schedules — often at the end of the month or before a fiscal quarter closes. Attackers who have been inside an email environment long enough know when those windows open. They time fraudulent payment requests to land when the volume of legitimate requests is highest and scrutiny per transaction is lowest.
The Silo Problem: When Finance and IT Do Not Talk
Most small businesses treat IT security and financial controls as two separate departments solving two separate problems. IT handles email filtering and endpoint protection. Finance handles payment approvals, vendor due diligence, and reconciliation. In practice, those two areas rarely coordinate — and that gap is exactly where business email compromise lives.
Consider what has to be true for this attack to succeed. An email account has to be compromised — an IT security event. A fraudulent vendor has to be onboarded — a financial controls event. A wire transfer has to be approved — a finance operations event. All three happen without any single person or system seeing the full picture.
An IT team that monitors email anomalies — unusual login locations, forwarding rules added by someone other than the account owner, large volumes of email marked read without the owner opening them — has a reasonable chance of catching the initial account compromise before the attacker reaches the payment stage. But that only works if IT is actually watching for those signals, and if there is a clear path for IT to communicate what they find to the people who approve payments.
In most small businesses, that path does not exist. IT handles a ticket. Finance handles an invoice. Nobody connects the dots between a suspicious login event last Tuesday and a vendor banking change request that arrived on Thursday. That is the silo problem — not primarily a technology problem, but an organizational design problem that technology can help solve, only if the organization is structured to use it.
What a Well-Run IT Environment Has in Place Against Business Email Compromise
A well-run IT environment does not treat email security as a commodity checkbox. It treats the email platform as a financial control surface — because that is effectively what it is. Here is what that looks like in practice:
- Email authentication standards are fully deployed. The three-part framework of sender verification, policy enforcement, and reporting (commonly referred to by the shorthand DMARC, though what matters is what it does, not what it is called) should be configured to reject — not just flag — unauthenticated messages claiming to come from your domain or your vendors’ domains. Most small businesses have partial implementations that create a false sense of protection.
- Conditional access is enforced on every account that can initiate or approve payments. If someone’s credentials are used to log in from an unfamiliar device or an unusual location, access should be blocked and the event flagged for review — not silently permitted.
- Email forwarding rules are audited regularly. One of the most common signs of a compromised account in vendor fraud is a silent forwarding rule that copies all incoming email to an external address. It is invisible to the account owner and trivially easy to set up once an attacker is inside.
- Vendor onboarding workflows include identity verification steps that are not entirely email-based. If a vendor submits a banking change request by email, the verification step should involve a phone call to a number on file before the change was requested — not a reply to the same email thread.
- Finance team members receive scenario-based training, not just annual awareness videos. The difference between training that works and training that does not is specificity. Walking someone through the actual steps of a vendor fraud attack, using realistic examples, changes behavior in a way that a generic phishing video does not.
None of these controls are exotic. None require large capital expenditure. What they require is that someone is responsible for connecting IT security posture to financial operations risk — and that IT and finance are in regular communication.
The Cybersecurity and Infrastructure Security Agency (CISA) maintains a dedicated advisory on business email compromise that outlines the technical and procedural controls federal authorities recommend. Not every recommendation applies directly to a 30-person company, but the advisory makes clear how seriously this threat category is taken at the federal level.
The Human Layer Is Not Enough on Its Own
Every time a major fraud event makes the news, the instinct is to say better training would have prevented it. That is partially true and largely insufficient. People make mistakes under time pressure, under workload, and when a fraudulent communication is sophisticated enough to look completely normal. Building a financial control system that depends entirely on every person making the right call every time is not a system — it is wishful thinking.
What works is layered defense. Email authentication controls reduce the volume of impersonation attempts that reach inboxes. Conditional access controls catch compromised credentials before they are used to read financial email threads. Forwarding rule audits catch silent exfiltration early. Out-of-band verification for banking changes gives the human approver a moment outside the manipulated email thread to confirm what they are about to authorize. Each layer independently catches some attacks. Together, they catch most of them.
This is not a new concept in cybersecurity. It is a well-established framework for defending against business email compromise and related threats. What is new is the urgency of applying it specifically to financial workflows — because that is where attackers have concentrated their effort in 2025.
Organizations that have invested in a structured cybersecurity program as part of their overall IT management have a meaningful head start. Not because they are immune, but because the controls that protect against business email compromise are the same controls a disciplined security program puts in place across the board. They are not bolt-on additions. They are foundations.
What Business Owners Should Be Asking Right Now
If your business sends wire transfers — whether to vendors, for distributions, or for payroll — there are five questions worth putting to your IT provider or internal IT lead today:
- Are we monitoring email accounts for silent forwarding rules, and how often?
- What happens when someone logs into a financial team member’s email from an unrecognized device or location?
- Do we have a process for verifying vendor banking changes that does not rely solely on the email thread where the change was requested?
- When did we last review who has access to our payment systems — and does that list still match who actually needs it?
- Is there any regular communication between whoever manages our IT security and whoever oversees our payment approval workflows?
If the answers are vague — or if the honest answer to the last question is “no” — that is the gap business email compromise attacks are built to exploit.
The businesses that have avoided these losses are not necessarily the ones with the biggest IT budgets. They are the ones where IT security and financial operations are treated as two parts of the same organizational risk picture, with someone responsible for keeping both in view at the same time. That is a discipline, not a product.
It is also the discipline that separates businesses that receive an FBI IC3 loss notification from the ones that never need one. Our managed IT services are built around exactly this principle — connecting security posture directly to operational risk so that controls are in place before an attacker finds the gap.
We have maintained a zero-client-breach record across every organization we have served since 2004. That record does not happen by accident. It happens because we treat financial workflow exposure as an IT security issue, and we build the controls accordingly — before an attacker finds the gap, not after.
If you want a clear-eyed look at where your current environment stands, Book a Free Cybersecurity Strategy Call. No pressure, no obligation — just a direct conversation about what you have, what you are missing, and what it would take to close the gap.
Let’s Talk About Your IT Strategy
If anything in this post raised a question about your own environment, the fastest path to an answer is a 20-minute strategy call. We’ll look at your specific situation and tell you what we’d actually do about it.