The Email Looked Normal. The Wire Transfer Was Real.

Picture this. Your bookkeeper gets an email from a vendor you’ve paid every month for two years. Same logo, same signature, same friendly tone. The only thing different is one line near the bottom: “We’ve switched banks, please use this updated account number for this month’s payment.” She updates the file, sends the wire, and moves on with her day. Three weeks later the real vendor calls asking where their money is. It’s gone. So is the $42,000 you just sent to a criminal’s account.

This is called business email compromise, or BEC, and it’s quietly one of the most expensive scams hitting small businesses in South Florida right now. No malware. No ransomware. No flashing skull on a screen. Just a believable email and a payment that clears before anyone thinks to question it.

The FBI tracks BEC as one of the costliest cybercrimes in the country, with reported losses in the billions every year. And here’s the kicker: most of those victims never had their computers hacked at all. They just got fooled.

Why This Scam Hits Small Businesses So Hard

Big companies have layers of approval, fraud teams, and software watching every transaction. A 12-person law firm in Delray Beach has a bookkeeper, a busy owner, and a lot of trust. Criminals know exactly who’s easier to fool.

They actually do their homework

These aren’t lazy spam blasts. Before a single email goes out, the scammer studies your business. They read your LinkedIn, your website team page, and your public vendor announcements. They learn that you call your office manager “Sandy” and that you work with a specific printing company. When the fake email lands, it uses the right names and the right tone. It feels like an inside conversation because, in a way, it is.

They wait for the perfect moment

Sometimes the criminal has already slipped into a real email account, often a vendor’s account, not even yours. They sit quietly and read. They watch for an invoice going back and forth. Then, at the exact moment a payment is due, they jump in with “new banking details.” The timing is so natural that nobody blinks.

They create pressure

Notice how these emails always have a clock on them. “The wire needs to go out today.” “I’m heading into a meeting, can you handle this quick.” “The vendor is threatening to pause our account.” Urgency shuts off the part of your brain that double-checks things. That’s the whole point.

The Red Flags Hiding in Plain Sight

Once you know what to look for, these emails get a lot easier to catch. Train your team to slow down when they see any of these:

  • A surprise change to payment details. Banking info almost never changes by email. This is the single biggest warning sign. Treat every “we switched banks” message as a scam until you prove otherwise.
  • A sender address that’s almost right. Look hard at the domain. [email protected] is real. [email protected] or yourtech.so1utions (with a number one instead of an L) is a trap.
  • Pressure plus secrecy. “Do this now and don’t loop in anyone else” is how scammers isolate the one person who can move money.
  • A reply-to address that doesn’t match the sender. The name says your CEO. The actual reply goes to a Gmail account. That’s a hijack in progress.
  • Slightly off wording. A vendor who always says “Hi team” suddenly opening with “Dear Sir/Madam” is worth a second look.

How to Shut This Down Before It Costs You

The good news is that stopping BEC doesn’t take fancy software. It takes a few simple habits that you build into how your business handles money.

Make a phone call the rule, not the exception

Here’s the one policy that stops most of these attacks cold: any change to payment information or any wire request gets verified by a phone call to a known number. Not the number in the email. The number you already have on file. Thirty seconds on the phone beats a five-figure loss every single time. Write this rule down, post it where your finance person can see it, and make it non-negotiable.

Lock down your email accounts

Turn on multi-factor authentication for every business email account, no exceptions. A huge chunk of BEC starts when a criminal gets into a real inbox using a stolen password. MFA blocks that even when your password leaks. If your email runs on Microsoft 365 or Google Workspace, this takes about ten minutes to set up.

Add a second set of eyes on payments

For any payment over a set dollar amount, require two people to sign off. One person can be tricked. Two people both getting fooled at the same moment is a lot rarer. It feels like a small hassle until the day it saves your business.

Train your people, then train them again

Your team is your firewall here. A quick walkthrough of what these scams look like, plus a reminder every few months, keeps it fresh. The bookkeeper who’s seen a fake invoice example is the one who catches the real one.

What to Do If the Money Already Went Out

If you think you’ve been hit, speed is everything. Wire transfers can sometimes be clawed back, but only if you move fast.

  • Call your bank immediately and ask them to recall the wire. Hours matter.
  • Report it to the FBI at the Internet Crime Complaint Center (ic3.gov). They run a recovery process that has pulled money back for businesses who reported quickly.
  • Change passwords and check your email rules. Scammers often set up hidden inbox forwarding so they can keep reading your mail. Get someone to check.
  • Tell your team what happened. No shame allowed. If one person got targeted, others probably will be too.

The Bottom Line

BEC works because it doesn’t feel like a hack. It feels like a normal Tuesday. There’s no virus to scan for and no alarm to go off, just a polite email and a payment that quietly disappears. The businesses that don’t get burned are the ones that build one stubborn habit: verify money changes by phone, every time, no exceptions.

If you’re not sure your email accounts are locked down, or you don’t have a clear payment-approval process, that’s exactly the kind of thing we sort out for small businesses from Delray Beach to West Palm Beach. A quick review now is a lot cheaper than a wire transfer you’ll never see again. Always happy to troubleshoot.