A vendor emails new bank details. Your "CEO" texts asking for gift cards. A title company sends updated wiring instructions an hour before closing. These are business email scams, and they hit small offices because one quick reply can move real money. The FBI has repeatedly warned businesses about this kind of fraud, known as business email compromise.
Red flags to train everyone on
- A change to payment details. New bank account, new wiring instructions, "our old account is under audit." Treat every change as suspicious until verified.
- Urgency and secrecy. "Need this done before 3 PM." "Keep this between us." Pressure is the tool.
- A look-alike address. nexgenguard.co instead of nexgenguard.com, or a real name with a free email address. Check the actual address, not just the display name.
- Gift cards or crypto. No real vendor or boss asks to be paid this way.
- A login page you didn't expect. A "shared document" or "voicemail" that asks for your Microsoft 365 password is almost always a trap.
The one rule that stops most losses
Verify every payment change by phone, using a number you already have, not one in the email. Make it a written office policy so no one feels awkward calling to check, even if the request seems to come from the owner.
If someone already clicked or paid
- Call your bank immediately and ask them to recall or freeze the transfer. Speed matters.
- Change the password for the account that was used, and make sure multi-factor authentication is on.
- Check the mailbox for rules you didn't create. Attackers often add rules that hide or forward replies.
- Report it to the FBI's Internet Crime Complaint Center at ic3.gov.
- Call your IT provider to check for other affected accounts and devices. If personal information was exposed, Texas has breach notification deadlines.
Make it harder to happen
MFA on every email account, email filtering, short phishing training with simulated tests, and a call-back rule for payments cover most of the risk. Not sure where your gaps are? Book a free IT security audit and we'll give you a short, plain-English list.