Business email compromise and invoice diversion

Summary

What the record shows

An offender studies a payment relationship, then sends altered banking instructions from a compromised mailbox or a near-match domain. The request may appear in an existing email thread and use genuine invoice details.

FBI reporting continues to treat business email compromise as a major loss category. Controls are most effective when payment changes are verified through a known second channel before funds move.

Key findings

What is established and what is not

A familiar display name and accurate invoice do not authenticate changed bank details.
Use dual approval and call a previously known contact number—not one included in the change request.
If funds were sent, contact both banks and law enforcement immediately; recall opportunities shrink quickly.

Response and denials

The other side of the record

The reviewed material describes a distributed pattern using changing accounts, numbers and sites. No single identifiable operator or attributable operator denial was located.

Some approaches misuse the identity of suppliers, executives, employees, conveyancers or banks. Those impersonated organisations are not treated as participants; verify any contact through an independently located official channel.

Global Scam Report evaluation

Summary assessment

Active, high-loss payment-diversion pattern — very high confidence. Responsibility in a particular case can involve account security and process failures across several parties and should not be assumed without evidence.

Scope qualificationThis profile does not determine contractual liability for a misdirected payment. Preserve full message headers, access logs and verification records for specialist review.

Reference record