Business Email Compromise: How One Polite Email Moves Your Money to a Stranger's Bank

The vendor's controller has a new bank, apparently

The bookkeeper at a 12-person architecture firm has worked with the same structural engineering vendor for six years. On a Tuesday afternoon an email arrives from the vendor's controller, same signature block, same slightly formal tone, with a PDF letter on the vendor's letterhead. The company has moved banks. Please update the remittance details for the next invoice.

She does what she has done a hundred times. She opens the accounting system, updates the IBAN, and pays the outstanding invoice on Friday with the rest of the batch. Three hundred and sixteen thousand dirhams. The confirmation goes out. The vendor's controller replies with thanks.

Forty days later the real controller calls. Not the one in the thread, the one she has met in person. He wants to know why two invoices are past due. She forwards him the email chain. He reads it in silence for a while and then says the words she will remember for a long time: "That is not my email address. Look at the domain again."

One letter was different. The l was a capital I. The firm's own mailbox had been read for three weeks before the first message went out, which is how the attacker knew which invoice was due, what the controller sounded like in writing, and which Friday the batch ran.

What the heck does this mean

Business email compromise, BEC for short, is fraud that uses email to talk your own people into sending money to the wrong place. No malware needs to run. No files get locked. Somebody simply asks nicely, at the right moment, from what looks like the right address, and the money goes.

Two versions do most of the damage. Invoice fraud is the one above: a vendor's bank details change, and the payment that was going to a real supplier goes to a mule account. Payroll diversion is the same trick pointed at HR. An "employee" emails payroll to change the bank account their salary is paid into, and the next pay run lands in an account the employee has never seen.

Funds transfer fraud, the insurer's term, is the umbrella: any time money moves because of a lie. Mailbox rules matter here too. Once an attacker is in a mailbox, they set a rule that hides replies from the real vendor, so nobody notices the conversation has forked.

I take this one personally. My wife's business was hit by a payroll reroute, and it came close to ending the company. That experience is one of the reasons AccuSights exists.

The numbers that matter

BEC and funds transfer fraud together made up 58% of cyber insurance claims in the Coalition 2026 Cyber Claims Report, and 52% of funds transfer fraud claims began with a compromised email account. Not ransomware. Email.

In the United States, losses to business email compromise came to roughly USD 3 billion out of USD 20.9 billion in total reported cybercrime losses in the FBI IC3 2025 Annual Report. That is the reported figure. Plenty of owners never file.

Phishing drove 85% of BEC incidents, according to the Arctic Wolf 2026 Threat Report. The attacker in our story did not guess a password. Somebody typed it into a fake login page a month earlier.

What to do this week

1. Adopt the callback rule and put it in writing: no change to bank details, salary accounts or payment instructions takes effect until someone phones the requester on a number already on file. The email is never the source of the phone number. (CIS 14 Security Awareness and Skills Training)
2. Turn on multi-factor authentication for every mailbox, including the owner's, and disable the legacy sign-in protocols that skip it. Ask your IT person specifically about basic authentication for IMAP and POP. (CIS 6 Access Control Management)
3. Have IT pull a report of every mailbox forwarding rule and every rule that moves messages to deleted items or an odd folder. Then set an alert for new ones. That rule is the attacker's favorite hiding place. (CIS 9 Email and Web Browser Protections)
4. Require two people to approve any payment above a threshold you set this week, and make sure the second approver checks the accounting system, not the email thread. (CIS 6 Access Control Management)
5. Run one drill with the finance and HR staff using a fake vendor bank-change email. Do it kindly. The point is practice, not embarrassment. (CIS 14 Security Awareness and Skills Training)
6. Write the "money moved" card: the bank's fraud desk number, the insurer's hotline, who calls whom in the first hour. Tape it inside the bookkeeper's drawer. (CIS 17 Incident Response Management)

Where AccuSights fits

Our assessment checks the things that let this fraud run for weeks: which mailboxes lack multi-factor authentication, which forwarding rules already exist, and whether anyone has written down a callback rule. The Cyber Hygiene Test takes three minutes and tells you where you stand. If the answer bothers you, 30 minutes with your Risk Assessor is the next step.

If money has already moved, report it through the Ministry of Interior channels or your emirate's police eCrime platform, and call your bank in the same hour. We map your email and payment controls to what your regulator expects, and the read-only compliance agent shows the forwarding rules and sign-in locations that usually come first. We have no access and do not remediate; you or your IT partner fix, we show you where.

The most expensive email your company will ever receive will be polite, on time and correctly spelled, except for one letter.