The fake supplier scam: how business email compromise diverts payments and how to verify an account change

A company has a long-standing supplier, an open invoice and, the day before the due date, a short email arrives: “We changed banks, use the new details starting today.” The message has the tone, the signature and even the conversation history. The payment goes out, and weeks later the real supplier chases an invoice it never received. This is the standard script of business email compromise, known by its acronym BEC.

The scam predates cryptocurrencies and applies to any payment method: bank transfer, boleto, Pix or a USDT wallet. The difference is what happens afterward. A payment confirmed on the blockchain does not come back, and recovering an international transfer depends on a short window and on banks willing to cooperate. That is why verification has to come first.

Exposed BEC losses worldwide between Oct/2013 and Dec/2023 (FBI IC3, Sept/2024)

US$55.5 bn

BEC incidents in the same period, across 186 countries

305,033

BEC complaints to the IC3 in 2024, with losses of about US$2.77 billion (April 2025 report)

21,442

Rise in global exposed losses from Dec/2022 to Dec/2023

+9%

How business email compromise works

The FBI defines BEC as a sophisticated scam targeting businesses and individuals who make legitimate money transfers. The criminal takes over a real email account, through social engineering or intrusion, or creates a very similar one. From there, he interferes in a real billing conversation or starts a new one. There are four common variations:

None of this depends on sophisticated malware. The fraud relies on urgency, hierarchy and the trust the company places in an existing conversation. It is the same principle as the fake support scams described in Fake support and fake recovery crypto scams: the criminal wants the victim to make the transfer themselves.

What the FBI numbers say

In September 2024, the FBI's Internet Crime Complaint Center (IC3) updated its alert on the subject. Between October 2013 and December 2023, BEC incidents worldwide added up to US$55,499,915,582 in exposed losses. The term “exposed” includes actual losses and attempts, so the figure does not equal money actually diverted.

The first row covers all countries: the FBI alert does not break out data for Brazil. There is also a change in routing. In 2023, the IC3 recorded more cases in which the money was sent to institutions that hold funds for payment processors, peer-to-peer payment services and cryptocurrency exchanges. Banks in the United Kingdom and Hong Kong were the most frequent intermediate stops, followed by those in China, Mexico and the United Arab Emirates.

In the IC3 annual report released in April 2025, BEC ranks as the 7th most reported crime of 2024, with 21,442 complaints, but 2nd in losses, at about US$2.77 billion, behind only investment fraud. All crimes combined totaled US$16.6 billion. From 2022 to 2024, BEC losses reported to the IC3 reached almost US$8.5 billion, according to Nacha, the body that sets the rules for the United States' ACH payment network. It is a low-volume, high-value-per-case scam.

Warning signs before paying

• A request to change the account, bank or wallet made only by email or message.
• Unusual urgency, with a request for secrecy or for payment “today.”
• An email address with a minimal difference: one swapped letter, a domain such as .co instead of .com, or the right name with a different domain.
• A bank account in another country, in a third party's name, or a wallet different from the one used before.
• A refusal to take a call or video call to confirm.
• A change of tone, language or signature compared with earlier messages.

Second-channel verification protocol

The FBI recommends confirming any request to change details through a secondary channel or with two-factor authentication. To turn this into routine, companies can adopt a written procedure with a few steps:

1. Log the change as an exception: no payment to new details goes out without going through the procedure, even for a small amount.
2. Confirm through an already known channel, such as the phone number in the contract or the old record, never the number or link that came in the same email.
3. Ask for the new details in a formal document signed by a person the supplier has authorized, and compare the beneficiary's name with the one in the contract or invoice.
4. Require dual internal approval: the person who registers the details is not the one who releases the payment.
5. Make a low-value test payment and ask for confirmation of receipt before releasing the full amount.
6. Keep a record of the confirmation (date, person, channel) together with the invoice.

For USDT payments, step 3 includes checking the TRC-20 address character by character, through two channels, and looking at the history in the block explorer, as the guide How to check a USDT transaction on Tronscan shows. Anyone who copies addresses from their history also runs the risk described in Address poisoning in USDT.

If the payment has already gone out

Time decides the outcome. The FBI advises contacting the financial institution immediately to request a recall of the funds and the indemnity documents, and filing a complaint at ic3.gov as soon as possible, whatever the amount, to try to freeze the money. In Brazil, the company should also notify the bank and file a police report. On a blockchain there is no chargeback: the only chance is to quickly notify the exchange that received the funds or the stablecoin issuer, which can freeze the balance as long as it has not left there.

• Scams
• Social engineering
• Cybersecurity
• International payments
• Compliance
• Wallets