Fake invoice and payment scams targeting contractors

How business email compromise works

Business email compromise, usually shortened to BEC, is fraud that uses email to trick someone into sending money or sensitive information. The attacker either breaks into a real mailbox, often a supplier's or your own, or creates an address that looks almost identical. Then they wait for the right moment: an invoice due date, a large customer deposit, a payroll run. The message that follows looks routine, uses the right names and asks for something small that turns out to be expensive, such as updated bank details.

It is not a rare crime. The FBI's Internet Crime Complaint Center received 21,442 BEC complaints in 2024 with adjusted losses of $2,770,151,146^[1]. Dividing one by the other gives an average of about $129,000 per complaint, a figure that would wipe out a year of profit at many small contractors. The FTC adds that in 2024 consumers lost more money to scams paid by bank transfer or cryptocurrency than through all other payment methods combined^[2].

The five versions contractors see most

The FTC's small business guidance describes the invoice version plainly: scammers create phony invoices that look like you ordered products or services, and they count on whoever pays the bills not checking^[3]. The same guidance warns that demands for payment by wire transfer, cryptocurrency or gift card are a scam and that caller ID can be faked^[3].

Why home service companies are exposed

Three features of the trades make this fraud easier. First, money moves in large lumps: a roof replacement, a new heat pump or a commercial cleaning contract often involves a deposit worth thousands of dollars, and the customer expects to send it by bank transfer. Second, offices are small. About 58.6% of US electrical contractor establishments had fewer than five employees in 2023^[4], so one person often receives invoices, approves them and pays them. Third, supplier relationships are informal and run on email and text, which makes a convincing message from a known rep hard to doubt.

People already suspect impersonation. Nine in ten US adults think people often or sometimes pretend to be someone else to steal personal information by phone or online^[5]. Suspicion alone does not protect anyone, though. A rule that applies every time, regardless of how believable the message is, does.

Verification rules to put in writing

1. 01

   Keep a vendor file with trusted contact details

   For each supplier record the bank details, the accounts contact and a phone number you got from a source other than an invoice, such as their website or your first contract.

2. 02

   Call back before any bank detail change

   Use the number in the vendor file, never one in the email. Ask the contact to confirm the old and new account details and the reason for the change.

3. 03

   Hold changed details for one payment cycle

   Pay the next invoice only after the callback is logged. A legitimate supplier will understand a short delay; a fraudster will push harder.

4. 04

   Require two people for new payees and large payments

   The person who enters a payment should not be the only one who approves it. In a two-person office, the owner approves; when the owner is away, set a clear threshold and a backup.

5. 05

   Match invoices to orders

   Every invoice should match a purchase order, a signed quote or a known recurring charge. Anything else goes to the owner before payment.

6. 06

   Protect your customers too

   Print on contracts, invoices and email signatures that your bank details will never change by email and that customers should call the office before sending a deposit.

A red-flag checklist for whoever pays the bills

Keep this list next to the computer used for payments. Any single item is a reason to stop and verify; two or more together almost always mean fraud.

• The sender's address or reply-to address differs from earlier emails by a letter, a hyphen or a different ending.
• The message asks you to keep it quiet, skip the usual approval or act before the end of the day.
• Bank details have changed, especially to a personal account, a new bank or an account in another country.
• The invoice arrives as a link to view or download rather than an attachment from a known system.
• The amount is slightly different from the usual bill, or a round number with no matching order.
• The sender cannot be reached on the phone number you already had, or answers only by email.
• The payment method is a wire, gift cards or cryptocurrency when the supplier normally takes a check or card.

Make it easy to stop. Tell the office that a delayed payment is always acceptable and a mistaken one is not, and give them a named person to call when something looks off. Most people who are fooled by these schemes noticed something strange and felt they had no time or authority to check.

Example: a deposit that almost went astray

Example: a fictional roofing company signs a homeowner for a full replacement and emails the contract with a deposit request. Two days later the homeowner receives a second email, apparently from the office manager, saying the company has changed banks and asking for the deposit to go to a new account. The homeowner remembers the line on the contract that says bank details never change by email and calls the office. The office manager confirms nothing was sent, finds a look-alike domain in the reply-to field and reports it. No money moves.

Example, continued: the company then turns on multifactor authentication for every mailbox, checks for forwarding rules and adds a short warning to its deposit request template. The line on the contract cost nothing and saved the job. Our cybersecurity basics guide explains how to lock down the mailbox side.

If money has already gone out

1. Call your bank's fraud line immediately and ask them to recall the payment and contact the receiving bank.
2. File a complaint at ic3.gov with the transaction details, the emails and the receiving account information.
3. Secure the mailbox involved: change the password from a clean device, sign out all sessions and remove unknown forwarding rules.
4. Tell the affected supplier or customer so they can secure their side and warn others.
5. Keep records of every step and time. Your insurer and your bank will ask for them.

Speed matters. In 2024 the IC3 Recovery Asset Team handled 3,020 Financial Fraud Kill Chain complaints involving $848.4 million in attempted theft and reported a 66% success rate in freezing funds^[1]. Those freezes depend on reports arriving while the money is still in the receiving account.

Train the people who touch money

A fifteen-minute briefing twice a year is enough for most offices. Show real examples of look-alike addresses, walk through the callback rule and make it clear that nobody will be criticized for delaying a payment to verify it. The owner should say that out loud, because the most effective lure is a message that appears to come from the owner and asks the office to skip the usual steps. Anyone who answers the phones should also know never to read out bank details, card numbers or account codes to a caller who cannot be verified.

Finally, review your insurance. Some business policies exclude social engineering losses unless you add specific cover. Ask your broker what is included and what proof of verification steps the insurer expects before it pays a claim.