An email lands in your inbox from a vendor you know. It says, “Our bank has changed. Please send this month’s payment to the new account.” This is a vendor invoice scam, and the logo and tone often look right.<\/p>\n\n\n\n
The official name is business email compromise, or BEC. The Internet Crime Complaint Center (IC3)<\/a> describes it as a scam that targets both businesses and individuals who transfer funds.<\/p>\n\n\n\n We see why it works around Pierce County. Small offices pay the same few vendors again and again. Everyone is busy, and a routine request gets a routine yes. That is exactly what the scammer is counting on.<\/p>\n\n\n\n IC3 says the scam is often carried out when someone breaks into a real business email account. They do it through social engineering (fooling a person) or computer intrusion (breaking into the system).<\/p>\n\n\n\n In plain words, there are two common versions:<\/p>\n\n\n\n Either way, the goal is the same. They want your payment to land in their account instead of your vendor’s.<\/p>\n\n\n\n The first version is the nasty one. The email really does come from your vendor’s address. A quick glance at the sender won’t save you. That is why the fix is a check outside of email.<\/p>\n\n\n\n Scammers do homework. They may read old threads and copy the way your vendor writes. They may time the message right when an invoice is due.<\/p>\n\n\n\n Phones make it harder. IC3 advises you to check the sender’s address, “especially when using a mobile or handheld device.” Phone screens often show only a friendly name, not the full address behind it.<\/p>\n\n\n\n IC3 also suggests setting up your computers so full email extensions can be viewed. That means the whole address, not just the name. It takes a minute to turn on, and it makes odd addresses easier to spot.<\/p>\n\n\n\n IC3’s main advice is simple: use a second channel, or two-factor authentication, to verify requests for changes in account information with the intended recipient.<\/p>\n\n\n\n A second channel just means a different way of reaching the person. If the request came by email, confirm it another way.<\/p>\n\n\n\n This works because the scammer usually controls the email thread, not your vendor’s phone line. It is a slow step on purpose. A few minutes of friction costs far less than a lost payment.<\/p>\n\n\n\n A written rule also takes the pressure off the person who gets the odd request. It is the same idea as an office rule for gift card texts from a fake boss.<\/p>\n\n\n\n Don’t wait and hope. IC3 says to contact your bank (the originating financial institution) as soon as you recognize the fraud. Ask for a recall or reversal<\/strong> of the payment.<\/p>\n\n\n\n IC3 also says to ask for a Hold Harmless Letter or Letter of Indemnity<\/strong>. Getting those documents quickly “may reduce or eliminate” your losses, in IC3’s words. That is no promise, but speed clearly helps.<\/p>\n\n\n\n Then file a detailed complaint at IC3<\/a>. IC3 says it is vital to fill in every required field, including the bank information.<\/p>\n\n\n\n Also tell your real vendor. Their email account may be compromised, and they will want to know. And change the password on your own email, in case the scammer got in there too.<\/p>\n\n\n\n The scam depends on email accounts being open to a break-in. A few basics make that harder:<\/p>\n\n\n\n We covered more of the basics in 5 Common Cybersecurity Mistakes Small Businesses Make<\/a>. IC3 also suggests watching your financial accounts regularly for oddities such as missing deposits. A quick weekly look at your bank activity is a good habit.<\/p>\n\n\n\n If you want a second pair of eyes, we’re happy to help. Our free 30-minute assessment<\/a> looks at your computers, email and backups and tells you what to fix first. There’s no cost and no contract, and it can be remote or on-site. You can also read how we help with email and device security on our security page<\/a>.<\/p>\n\n\n\nHow the vendor invoice scam works<\/h2>\n\n\n\n
\n
Why a real-looking email isn’t proof<\/h2>\n\n\n\n
The one rule that helps most<\/h2>\n\n\n\n
\n
If you already sent the money<\/h2>\n\n\n\n
Lock down the email side too<\/h2>\n\n\n\n
\n
What to do this week<\/h2>\n\n\n\n
\n