The scam we run into most often with Coachella Valley businesses isn’t a virus. It’s a polite email from a vendor you already pay, with a normal-looking invoice and one small change: their bank details are new, so please send this payment to the new account. Everything looks right, and that’s the point.
How the scam works
- The scammer gets in or gets close. They break into a mailbox at your vendor (or at your own office), or they register an address that looks almost identical, such as one letter swapped in the company name.
- They watch and wait. With access to a real mailbox, they can read past invoices, learn who approves payments and copy the vendor’s wording and signature.
- They send the “update”. A real-looking invoice arrives, often replying in an existing email thread, saying the bank account has changed. There’s usually some urgency: a late fee, an audit, a closing date.
- The money moves. Once a wire or ACH payment lands in the scammer’s account, it’s usually moved on quickly, which makes it hard to get back.
Warning signs
- Any request to change where a payment goes, however routine it sounds.
- A sender address that is one character off, or a reply-to address that differs from the sender.
- Pressure to pay today, or a request to keep it quiet or skip the usual approval.
- A new phone number in the email “in case you have questions”.
- Small changes in tone, signature or invoice layout compared with earlier messages.
Four steps that stop it
- Call to confirm, using a number you already have. Before paying to new bank details, call the vendor on the number in your records or on their website, never the one in the email.
- Make bank changes a two-person job. One person receives the request, a second person confirms it by phone and approves it. Write this down so nobody feels awkward following it.
- Turn on multi-factor sign-in. Many of these scams start with a stolen email password. A second step at sign-in means a password alone isn’t enough to get into your mailbox.
- Protect your domain. SPF, DKIM and DMARC records make it much harder for someone to send email that appears to come from your company to your clients and your bank.
Tell your staff
The people who process invoices are your best defense. A five-minute conversation at the next staff meeting, plus the two-person rule above, goes a long way. Regular security awareness training and practice phishing emails keep it fresh.
Common questions
What should I do if we already paid?
Call your bank right away and ask them to recall or freeze the transfer; speed matters. Then report it to the FBI’s Internet Crime Complaint Center at ic3.gov, change the passwords on any email account that may have been involved, and call your IT provider to check for mailbox rules or other signs of a break-in.
The email really came from our vendor’s address. How?
Either the vendor’s own mailbox was broken into, or the scammer is using a look-alike address that differs by a letter or two. In both cases the message can look exactly like the vendor’s usual email, which is why a phone call to a number you already have is the check that works.
Can someone send these emails pretending to be our business?
Yes, if your domain is missing email protection records (SPF, DKIM and DMARC). Our free email security check shows in seconds whether yours are set up.
Next step
Want to know whether someone could send email pretending to be your business? Try ourfree email security check. For a closer look at your mailboxes, sign-in security and payment process, book a free IT assessment.