The Fake Invoice Email That Costs Small Businesses $123,000
The email arrives from a vendor you've worked with for six years. It's a reply in an existing thread — the same thread where you discussed the invoice two weeks ago. Same signature block. Same slightly-too-casual tone the accounts person always uses. It mentions the project by name.
The message says their bank recently changed processors, and asks that this month's payment go to updated account details, attached.
Your bookkeeper pays it. Nothing seems wrong, because nothing is wrong about the email — it came from your vendor's actual mailbox.
Six weeks later the vendor calls about the overdue invoice.
The FBI's Internet Crime Complaint Center recorded $3,046,598,558 in reported business email compromise losses in 2025 across 24,768 complaints — roughly $123,000 per reported incident, making BEC the second-costliest crime category by dollar loss. About 86% of that money moved by wire transfer or ACH — the ordinary rails of business banking.
Those are only the reported cases. Most small businesses that get hit never file.
How the attack actually unfolds
The version most people picture — a spoofed address, bad grammar, a suspicious link — is the amateur version. The one that empties accounts looks nothing like it. Here's the real sequence.
Stage 1: One password
It starts with a single set of credentials, usually harvested through a phishing page that looks like a Microsoft sign-in screen, or reused from a password exposed in an unrelated breach years earlier.
If multi-factor authentication isn't enforced on that account, the attacker is in. If MFA is enforced but relies on push notifications, they may still get in by fatiguing the user into approving a prompt at 2am.
Nothing happens next. That's the point.
Stage 2: A rule you'll never see
Within minutes of gaining access, the attacker creates an inbox rule. It's rarely a simple forward. The common pattern:
Move any message containing keywords like invoice, payment, wire, ACH, bank, or remittance to an obscure folder — RSS Subscriptions, Conversation History, or Notes are favorites, because nobody looks there
Mark those messages as read
Forward a copy to an external address
The victim's inbox now looks completely normal. Financial correspondence quietly disappears from view, and the attacker reads everything. Rules are often named things like . or .. or a single space — deliberately hard to spot in a list.
Stage 3: Weeks of reading
This is the stage that separates BEC from ordinary phishing. The attacker doesn't act. They read.
They learn who approves payments and who executes them. They learn the language your team uses. They see which invoices are outstanding and for how much. They learn that the CFO travels the first week of every month. They see the format of your remittance advice.
Median dwell time in these cases is frequently measured in weeks. The attacker is waiting for a specific thing: a real invoice, for a real amount, at a moment when payment is genuinely expected.
Stage 4: The ask
When it comes, it's a reply within a legitimate thread, from a legitimate mailbox, about a legitimate invoice. The only thing changed is the destination account.
Common variations:
The vendor's mailbox is the compromised one, and your business is the payer. You're the victim of someone else's breach.
Your mailbox is compromised, and your customers get the fraudulent details. Now you have a notification problem and a very hard conversation with clients.
Lookalike domain. No compromise at all — the attacker registers a domain differing by one character (rn instead of m, .co instead of .com) and spoofs the thread from outside. Less sophisticated, still effective.
Payroll diversion. An employee emails HR asking to update their direct deposit details. Small dollar amounts, easy to miss.
Stage 5: Money moves fast
Funds land in a mule account and get dispersed within hours. The IC3 Recovery Asset Team initiated 3,900 fraud response actions in 2025 against roughly $1.16 billion in attempted theft and froze about $679 million — a 58% success rate.
That success rate is genuinely encouraging, and it depends almost entirely on how fast the victim reports. Which brings us to the part of this article worth bookmarking.
The first hour matters more than everything else
If you suspect a fraudulent payment has gone out, do these things in parallel, not in sequence. Do not wait to investigate internally first — the investigation can happen while the recovery clock is running.
Call your bank immediately. Ask for a wire recall or reversal and state explicitly that it is fraud. Ask them to contact the receiving bank to request a freeze.
File at ic3.gov right away. This is what activates the FBI's Recovery Asset Team and the Financial Fraud Kill Chain. Have the wire details ready: amounts, dates, originating and receiving account numbers, receiving bank name. The recovery window is roughly 24 to 72 hours, and it narrows sharply once funds leave the first receiving account.
Notify your cyber insurance carrier. Policies carry notification deadlines, and late notice is itself a common reason claims get denied.
Reset the password on the affected mailbox and revoke active sessions. A password reset alone is insufficient — an attacker holding a valid session token stays in until sessions are explicitly revoked.
Preserve evidence. Don't delete the fraudulent messages or the malicious rules. Export them. Your carrier and any forensic investigator will need them.
Also call your vendor or customer on a number you already have, and warn them. If your mailbox was the compromised one, the same attacker likely sent the same request to several of your contacts.
How to check your own tenant right now
This is the part most articles skip, and it's the part that actually tells you whether you have a problem today. The instructions below are for Microsoft 365. Google Workspace has equivalents in the Admin console.
Check your own mailbox (any user can do this)
In Outlook on the web, open Settings (gear icon) → Mail → Forwarding. Confirm nothing is enabled that you didn't set up.
Then go to Settings → Mail → Rules. Read every rule. Look specifically for rules that move messages to unusual folders, mark things as read, or forward externally — and for rules with blank or single-character names.
Check every mailbox (admin required)
Exchange admin center: Go to Recipients → Mailboxes, select a user, then Mail flow settings → Email forwarding. This shows mailbox-level forwarding but not inbox rules, which is why the PowerShell check below matters.
PowerShell — mailbox-level forwarding across the tenant:
Connect-ExchangeOnline
Get-Mailbox -ResultSize Unlimited |
Where-Object { $_.ForwardingSmtpAddress -ne $null -or $_.ForwardingAddress -ne $null } |
Select-Object DisplayName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward
PowerShell — inbox rules across every mailbox:
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
Get-InboxRule -Mailbox $_.Identity |
Select-Object @{n='Mailbox';e={$_.MailboxOwnerID}},
Name, Enabled, Description,
ForwardTo, RedirectTo, ForwardAsAttachmentTo,
MoveToFolder, MarkAsRead, DeleteMessage
} | Export-Csv .\inbox-rules-audit.csv -NoTypeInformation
Open the CSV and read it. Any rule with a value in ForwardTo, RedirectTo, or ForwardAsAttachmentTo pointing to an external address needs explaining. So does any rule combining a financial keyword with MoveToFolder and MarkAsRead.
Check the audit log
In Microsoft Purview → Audit, search for the activities
New-InboxRule, Set-InboxRule, and UpdateInboxRules
over the last 90 days. Rule creation from an unfamiliar IP address is the clearest single indicator of compromise you'll find.
While you're there, review Entra ID sign-in logs for the affected accounts — sign-ins from unexpected countries, or two sign-ins from geographically impossible locations within a short window.
Check for OAuth persistence
This one gets missed constantly. Attackers frequently grant a malicious application access to the mailbox, which survives a password reset entirely. In Entra ID → Enterprise applications, review consented applications and revoke anything unrecognized.
Turn on the alerts
In Microsoft Defender, enable the alert policies for Creation of forwarding/redirect rule and Suspicious email forwarding activity. Confirm they're routing to a mailbox someone actually monitors.
Also verify your outbound spam filter policy. Microsoft blocks automatic external forwarding by default in current tenants, but that setting gets loosened during migrations and never restored.
The control that stops this cold
Every technical measure above is worth implementing. None of them is as effective as one procedural rule:
Any change to banking details gets verified by a phone call to a number you already have on file — never a number from the email.
That's it. It costs nothing, it defeats the attack even when the email is genuinely from a compromised legitimate mailbox, and it works regardless of how convincing the message is.
Make it a written policy. Put it in your vendor onboarding. Tell your customers you follow it, so they're not surprised when you call. And make explicit that no one is exempt — the version of this attack that succeeds most often is the one where the request appears to come from the owner, and staff don't feel able to push back.
Supporting controls, in rough order of value:
MFA on every account, with no exceptions, including admins and shared mailboxes with sign-in enabled. Phishing-resistant methods where practical.
Dual authorization for payments above a threshold you set — two people, two devices.
DMARC at enforcement. A record set to p=none is monitoring only; it stops nothing. This defeats the lookalike-domain variant.
Impersonation protection configured specifically for your finance staff and executives.
Alerting on inbox rule creation, routed somewhere it will be seen.
Training that includes this specific scenario. Generic phishing training doesn't prepare someone for a legitimate-looking reply in a real thread from a real vendor.
Why it lands on small businesses
There's an assumption that criminals target large organizations because that's where the money is. The IC3 data doesn't support it. BEC concentrates on organizations that move meaningful sums with informal approval processes — which describes a great many businesses with fewer than fifty employees.
A 20-person firm often has a single bookkeeper who can execute a wire, an owner who approves by text message, and no formal verification step for banking changes. That's a faster path to $80,000 than a large enterprise with a controller, a treasury function, and dual authorization.
It also isn't detectable by most email security tooling. These messages carry no malicious link, no attachment payload, no suspicious domain to block. In many cases they're sent from a legitimate mailbox through legitimate infrastructure. The FBI's data shows roughly 85 cents of every dollar lost in 2025 came from cyber-enabled fraud where someone received something convincing and acted on it — not from malware or zero-days.
The defense is procedural, because the attack is procedural.
Frequently asked questions
How do I know if my email has been compromised? Check for inbox rules you didn't create, unexpected mailbox forwarding, sign-ins from unfamiliar locations in your Entra ID logs, and consented applications you don't recognize. The rule audit above is the fastest single check.
Can I get the money back after a fraudulent wire? Sometimes, if you act fast. The FBI's Recovery Asset Team froze about $679 million in 2025 across 3,900 response actions, a 58% success rate. Recovery depends heavily on reporting within the first 24 to 72 hours.
Does cyber insurance cover business email compromise? Often, but not automatically. Social engineering and funds transfer fraud are frequently separate endorsements rather than part of base coverage, and sublimits are common. Check your policy before you need it, and notify your carrier promptly if an incident occurs.
Will MFA stop this? It stops the most common entry point, which is credential theft. It doesn't stop the lookalike-domain variant, and it doesn't stop an attack that begins with your vendor's compromised mailbox rather than yours. That's why the call-back rule matters independently.
What if the compromised mailbox belonged to our vendor, not us? You're still out the money, and the legal question of who bears the loss is genuinely contested. Prevention on your side — the verification call — is the only reliable protection.
Should I report it to the FBI even if the amount is small? Yes. Reporting is what enables the Financial Fraud Kill Chain, and it's free. File at ic3.gov.
Where this leaves you
Run the inbox rule audit this week. It takes about twenty minutes across a small tenant, and it either tells you you're clean or tells you something you badly need to know. Then write down the call-back rule and tell your finance staff it's mandatory.
Those two actions cover most of the realistic exposure, and neither one requires buying anything.
Zien Solutions helps businesses across Washington DC, Northern Virginia, and Maryland audit their Microsoft 365 tenants for compromise indicators, configure alerting, and build payment verification controls that hold up. If you'd like a second set of eyes on your environment, get in touch.
Last updated: Aug 3rd, 2026
Sources
FBI Internet Crime Complaint Center, 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
FBI IC3 — report an incident: https://www.ic3.gov/
CISA — guidance on phishing and multi-factor authentication: https://www.cisa.gov/
Microsoft Learn — Responding to a compromised email account: https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account
Microsoft Learn — Configuring outbound spam filter policies and external forwarding controls