An "urgent" email from your boss or an "updated bank details" invoice — business email compromise
A fraudster hacks or spoofs a company email account and either (a) emails a finance clerk pretending to be the CEO demanding an urgent bank transfer, or (b) emails a customer saying "we've updated our bank details" and requests payment to a new account. Businesses lose millions this way — the second most-reported fraud type against UK SMEs.
Also known as: CEO fraud, business email compromise, BEC scam, fake supplier invoice fraud, "updated bank details" invoice scam
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Verify every bank details change by phone — call the supplier or executive on the number you already have on file, NOT the number in the email. Never call a number sent in the request
- 2 Set a written policy: any change to supplier bank details requires two-person verification, one of whom calls the known contact
- 3 Set up a 'callback' rule for internal transfer requests over a threshold — always call the requester on their internal extension before executing
- 4 Enable 'external' banners on emails from outside your organisation and dual-authorisation on your online banking (usually free)
- 5 Report to your bank immediately — same-day faster payments can sometimes be recalled if reported within hours
- 6 If your email account has been compromised, force password reset on every user, enable multi-factor authentication, and revoke all app passwords
- 7 Report to Action Fraud at https://www.actionfraud.police.uk or call 0300 123 2040.
Red flags
- ⚠ An urgent email from the CEO or Director asking for a same-day bank transfer while they are 'out of the office' or 'in a meeting'
- ⚠ The email address looks right at a glance but has a typo (john.smith@companv.co.uk vs @company.co.uk) or the reply-to is a personal Gmail
- ⚠ A supplier or contractor emails to say 'we've changed banks — please update the account for future payments'
- ⚠ Pressure to skip normal procedure: 'don't run this past accounts, I need it done in the next hour before the deadline'
- ⚠ The bank details supplied are for a personal account or a business name that doesn't match the supplier
- ⚠ The email arrives at end of business day, on a Friday, or before a bank holiday when verification is harder
Known variants
-
Fake CEO gift card variant: CEO email asks the finance clerk to urgently buy £5,000 of Amazon or iTunes gift cards for a 'client thank-you' and photograph the codes back to the CEO. The gift cards are drained within minutes. Small-value scam that mostly targets PAs and new hires.
Last seen: 5/1/2026
-
'Mandate' payroll fraud: HR receives an email from an employee saying 'I've changed my bank account — please update my payroll details for the next payday'. The email is from a compromised or spoofed staff account. The employee's salary goes to the scammer that month.
Last seen: 6/10/2026