Business Email Compromise and B2B Payments in 2026: What the FBI Reports and the Vendor-Change Controls Finance Teams Use

In business-to-business payments, one of the most common ways money goes to the wrong place is not a hacked payment network. It is an email asking an accounts payable team to update a vendor’s bank details. This article explains how that scam, known as business email compromise (BEC), works, what the FBI and its Internet Crime Complaint Center (IC3) report about it, and which verification controls finance teams commonly put around payment-detail changes. It is an explainer of mechanics, not a recommendation of any product or provider.

What business email compromise is

The FBI describes business email compromise, also called email account compromise, as an online scam in which criminals send emails that appear to come from a known source making a legitimate request. The FBI calls it “one of the most financially damaging online crimes.” One of the examples it gives is vendor impersonation: a vendor a company regularly uses appears to send an invoice with updated payment or mailing details.

According to the FBI, these scams are carried out by spoofing email accounts or websites with slight spelling changes, by spearphishing to collect details about accounts, calendars and billing, and by malware that gives access to email threads about invoices so that requests can be timed to avoid suspicion.

What IC3 reports

The FBI’s 2025 IC3 annual report lists 24,768 business email compromise complaints with reported losses of $3,046,598,558. The same report’s three-year comparison shows 21,442 complaints and $2,770,151,146 in reported losses for 2024, and 21,489 complaints and $2,946,830,270 for 2023. These are complaints submitted to IC3 and the losses reported in them. They show scale, not the loss any given company should expect.

Why B2B payment changes are a target

Several features of ordinary B2B payment operations make a change request easy to disguise:

• Large, infrequent payments. Invoices to a single vendor can be large enough that one redirected payment is meaningful.
• Existing email threads. A request that arrives inside a real thread, or from a lookalike address, can seem routine.
• Time pressure. The FBI lists pressure to act quickly as a warning sign.
• Payment rails that are hard to reverse. Wires and real-time payments are designed to settle quickly, which leaves little time to recall a payment once it leaves. Rail differences are covered in our comparison of ACH and real-time payments and our overview of FedNow.

Verification steps the FBI recommends

The FBI’s guidance on protecting against BEC includes these steps, which finance teams often write into their procedures:

1. Verify payment and purchase requests in person if possible or by calling the person to make sure the request is legitimate.
2. Verify any change to account numbers or payment procedures with the person making the request.
3. Look up the company’s phone number independently rather than using the number in the message.
4. Be cautious of requests that push for quick action.
5. Check email addresses, URLs and spelling carefully.
6. Do not click links or provide information in unsolicited messages asking to update account details.
7. Do not open unexpected attachments, and be wary of forwarded attachments.
8. Enable two-factor or multi-factor authentication wherever it is available.

Turning guidance into a written process

The list above is general. How a company applies it depends on its size, systems and bank. Questions many teams work through internally:

• Who is allowed to change vendor bank details in our system, and does a second person approve it?
• Is the callback made to a number already on file, not one supplied in the request?
• Are changes handled the same way when a senior person or a long-standing vendor asks for urgency?
• Is there a short hold on the first payment after a change, and who decides whether to apply it?
• Does our bank offer payee-confirmation or account-validation options, and do we use them?
• Do we know whom to call at the bank, and how fast, if a payment turns out to be fraudulent?

If a fraudulent payment goes out

The FBI’s page says to report the incident to IC3 at ic3.gov and to contact your financial institution immediately, asking it to contact the institution that received the transfer. Speed matters because it affects what your bank can attempt, though outcomes depend on the payment type and the receiving bank. For card, ACH and check differences in return and dispute rights, see our overview of paper checks versus ACH and the Nacha compliance guide.

Where a merchant account broker fits

Bridge Capital Partners helps businesses compare merchant account and payment processing options. Payment-fraud controls like those above sit mostly in your own approval workflow and your bank relationship rather than in a processing contract, but it is reasonable to ask any provider what account-validation, alerting and dispute tools they offer.

Sources

• FBI, Business Email Compromise (checked 8 October 2026)
• FBI Internet Crime Complaint Center, 2025 Internet Crime Report (checked 8 October 2026)

This content is for general informational purposes only and is not financial, legal, tax or investment advice. Payment rules, fraud patterns and bank practices change, so consult your bank, payment provider or a qualified professional about your specific situation.