Wire Fraud and Business Email Compromise: How to Stop Payment Scams

This month, two Texas public organizations reported sending money to criminals.

The City of Liberty, northeast of Houston, said it wired about $600,000 after a payment request arrived from an email address built to look like one of its real vendors. The city said its own systems were not breached, and local police are investigating with federal agencies. On South Padre Island, city leaders said a cyberattack on the island's economic development organization sent money to a fraudulent account. The amount has not been disclosed, officials have not said how the attack worked, and a federal investigation is underway.

Neither loss needed a break-in to the victim's own network. Criminals needed one convincing message and one person to act on it. The FBI groups these schemes under business email compromise (BEC). In its 2025 Internet Crime Report, the FBI counted about $3 billion in reported BEC losses, second only to investment fraud.

The good news: the controls that stop wire fraud and payment scams are simple, inexpensive and mostly about process. A business of any size can put them in place this week.

Common types of payment and email scams

These attacks go by many names. Knowing them helps your team recognize one in progress.

• Business email compromise (BEC). The umbrella term for scams that use email to trick a business into sending money or sensitive information. Most of the types below are forms of BEC.
• Vendor email compromise and invoice fraud. Criminals pose as a supplier, contractor or other vendor and send a fake invoice or "updated bank details" so your next payment goes to their account. This is also called payment diversion or payment redirection fraud. Based on the city's account, Liberty's loss fits this pattern.
• CEO fraud (executive impersonation). A message that appears to come from an owner, executive or board member asks someone to send an urgent wire, pay an unfamiliar invoice or buy gift cards, often "confidentially."
• Lookalike domains and email spoofing. Criminals register a domain one character away from a real one (sometimes called typosquatting) or forge the sender's name and address so a message looks like it came from someone you trust.
• Email account takeover. Instead of faking an address, criminals break into a real mailbox at your company or a vendor, read real conversations, and reply inside genuine email threads. They often add hidden inbox rules so the real owner never sees the replies.
• Phishing and spear phishing. Emails, texts and fake login pages that steal passwords. Spear phishing is aimed at specific people, such as the bookkeeper or controller. A stolen password is often how account takeover begins.
• Payroll diversion. A fake request, apparently from an employee, asks HR or payroll to change the employee's direct deposit account. The FBI has warned about this scheme for years.
• AI voice and deepfake impersonation. Criminals now use AI to clone the voice, and sometimes the video, of a coworker or business partner to approve a transfer. The FBI's 2025 report counted about 22,000 complaints involving AI, with nearly $893 million in losses.

Whatever the name, the end goal is almost always a wire, ACH or other bank transfer to an account the criminal controls.

Warning signs to watch for

• A changed bank account. The request is the usual bill, payment or paycheck, but to different account details.
• A sender address that is almost right. A vendor's .com swapped for .co, an extra letter, or "rn" in place of "m". In a busy inbox it looks correct.
• A real-looking story. The message refers to a genuine invoice, project or amount, sometimes inside an existing email thread.
• Pressure and secrecy. The payment is urgent, the sender can't take a call, or the request is meant to stay quiet.

Simple steps that stop payment fraud

1. Call before any payment details change. Confirm every new or changed bank instruction, including employee direct deposit changes, by phone using a number you already have on file, never one from the email or invoice. The FBI recommends this check, and it stops most of these scams on its own. Make it a written rule with no exceptions, including for requests that appear to come from owners and executives.
2. Require two people for wires and bank changes. One person sets up the payment and a second approves it after the callback. Ask your bank about dual approval, callback confirmation and holds on new payees for online banking.
3. Treat urgency and secrecy as warning signs, even on the phone. "Pay this today" and "keep this between us" are reasons to slow down. Because voices can now be faked, if a call or voicemail asks for an urgent transfer, hang up and call the person back on a number you already know.
4. Read the sender's address, not just the name. Check the full address character by character when money is involved, to catch lookalike domains. Turn on external-sender warnings in Microsoft 365 or Google Workspace. When replying about a payment, type the address from your contacts instead of hitting Reply.
5. Lock down every email account to prevent account takeover. Turn on multi-factor authentication for all mailboxes, block older sign-in methods that skip it, and alert on new mail-forwarding and inbox rules, a common sign that an account has been taken over. Our Microsoft 365 security guide covers these settings.
6. Protect your own domain from spoofing. Publishing SPF, DKIM and an enforced DMARC policy stops criminals from sending email as your exact domain to your customers and vendors. It does not stop lookalike domains, which is why the callback rule still matters.
7. Train the people who pay the bills. Share real cases like these two with your accounting, HR and office staff, run short phishing exercises, and make it clear no one will be faulted for pausing a payment to verify it. Short, regular reminders work better than a once-a-year course.
8. Know your first hour. If money goes to the wrong account, call your bank immediately and ask it to contact the receiving bank, then file a report at ic3.gov. Contact your local FBI field office and police, save the emails, and notify your cyber insurer. Speed matters: the sooner banks are alerted, the better the chance of stopping the funds.
9. Check your cyber insurance before you need it. Many policies treat social engineering and payment fraud as a separate coverage, sometimes with a lower limit or a requirement that the request was verified. Know what yours covers. Our cyber liability insurance page explains what to look for.

Where to start

If you do only one thing after reading this, put the callback rule in writing and share it with everyone who can send money or change payroll. Then review who can move funds, and make sure every mailbox has multi-factor authentication.

HUFF DATA SYSTEMS helps Texas businesses review email security, Microsoft 365 settings, domain protection and payment controls. If you would like a second set of eyes on yours, talk with our team.

Sources

• City of Liberty loses $600,000 in fraudulent wire transfer after email impersonation scam, KPRC 2 Click2Houston
• South Padre Island says EDC cyberattack sent money to fake account, federal investigation underway, KRGV
• Business Email Compromise, FBI
• 2025 IC3 Annual Report, FBI Internet Crime Complaint Center
• Cryptocurrency and AI Scams Bilk Americans of Billions, FBI
• FBI Warns of Increasing Threat of Cyber Criminals Utilizing Artificial Intelligence, FBI San Francisco
• Public service announcement on payroll diversion (PSA190910), FBI Internet Crime Complaint Center

More from The HUFF DATA SYSTEMS Brief →