Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again put business email compromise at the top of its loss table. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
In mid-March 2021, the FBI’s Internet Crime Complaint Center (IC3) released its 2020 Internet Crime Report. It recorded 791,790 complaints, up sharply on the previous year, with reported losses of more than $4.1 billion. Business email compromise (BEC), in which criminals impersonate executives, vendors or other trusted parties to redirect payments, again accounted for the largest reported losses of any category: about $1.8 billion from roughly 19,000 complaints. Ransomware drew more headlines, but BEC caused far more reported loss. The report also described the IC3 Recovery Asset Team, which works with financial institutions to freeze fraudulent domestic transfers when victims report quickly.
BEC is usually filed under cybersecurity, and email security vendors sell directly against it. That filing is understandable and incomplete. The loss does not happen in the inbox. It happens when a payment instruction is changed and a payment is released. For banks, credit unions and their business customers, the problem divides into three control points in sequence: the instruction (how a request to pay, or to change payment details, is verified), the release (how the payment system decides whether to send), and the recovery (what happens in the first hours after fraud is discovered). Email filtering touches only the first, and only partly.
The instruction: verifying changes, not messages
Most BEC losses follow a request that looks routine: a vendor’s new bank account, an executive’s urgent wire, a payroll redirection, a real estate closing with updated wiring instructions. Email authentication standards such as SPF, DKIM and DMARC make it harder to spoof an organization’s own domain, and impersonation detection catches many lookalike domains. Those controls cut the volume of attempts.
They do not stop the cases that cause the largest losses. When a genuine vendor or customer mailbox has been taken over, the fraudulent message arrives from a trusted address, often inside an existing thread about a real invoice. The email is authentic in every technical sense. Only a process outside email can show that the instruction is not.
The effective control is procedural. Any change to payment details is confirmed through an independent channel using contact information already on file, never details supplied in the request. A good implementation adds a cooling-off period before the first payment to a changed account, and requires a second person to approve the change in the vendor master file.
This fails less from ignorance than from ownership. Accounts payable owns vendor records, treasury owns wires, and IT owns email. A verification rule that sits between those three teams needs one owner with authority to enforce it, and an audit that samples changes each month to confirm the callback happened.
The release: where institutions add friction
Financial institutions sit at the second control point. They see the payment, not the email. That limits what they know without leaving them blind. A first-time beneficiary, a new account at a different institution, an unusual amount or timing, or a beneficiary account opened recently can each justify a hold, a callback or an extra approval. The receiving side matters too. An institution that notices a newly opened account receiving large business payments inconsistent with its stated purpose may be looking at a money mule.
For commercial customers, the most useful tools are often already in the treasury platform: dual approval for new beneficiaries, separate entitlements for creating and approving payments, payment templates that cannot be edited without re-approval, and alerts to a second contact when templates change. Many customers had these features and had not turned them on. Configuring them with business clients was, and remains, one of the highest-value fraud conversations a bank or credit union can have.
The trade-off is friction. Every hold delays a legitimate payment for someone, and relationship managers hear about it. Institutions that handled this well tuned holds to risk, explained them to clients in advance, and measured false positives so that the rules stayed credible.
Liability shapes the incentives. For commercial wire transfers, Article 4A of the Uniform Commercial Code generally places the loss from a payment order the customer itself authorized on the customer, provided the bank followed the agreed security procedure. A BEC victim usually did authorize the payment, having been deceived about where it was going. Banks are therefore often not legally liable, and some treat BEC as the client’s problem. That is a commercial mistake. Clients who lose six figures to a fraud their bank could have flagged rarely stay, and disputes over whether a security procedure was commercially reasonable are costly even when the bank wins. Organizations should check the specifics with counsel.
The recovery: the first hours decide the outcome
The third control point is time. The IC3 report highlighted the Recovery Asset Team’s work with receiving institutions to freeze funds, which depends on a fast report. Once money moves onward, especially abroad or into crypto assets, recovery becomes much less likely.
That makes recovery an operations question. Can a customer report suspected wire fraud at any hour and reach someone who can act? Do branch and call center staff escalate immediately instead of opening a routine ticket? Does the fraud team have a current contact list for counterpart teams at receiving banks, and a template recall request ready to send? Institutions that could answer yes turned some BEC losses into near misses.
Seeing BEC this way moves ownership. It belongs with the executive who runs payment operations and fraud, supported by security. It also changes the metrics. Counting blocked phishing emails says little about losses. Better measures are the share of payment-detail changes independently verified, the share of commercial clients using dual control, and the median time from a customer’s fraud report to a recall request.
With hindsight
Looking back, the 2020 report marked a stage in a trend that kept growing. Later IC3 reports showed reported losses rising year after year; the 2024 report put total reported losses at about $16.6 billion, with BEC still among the costliest categories at nearly $2.8 billion. The tools changed. By 2024, criminals were using voice cloning and deepfake video to impersonate executives, as in a widely reported Hong Kong case where an employee was persuaded on a video call to transfer about $25 million. The control points did not change: independent verification of payment changes and fast recovery paths still prevent most losses. Payment rules moved too. Nacha’s risk-based fraud monitoring requirements for ACH took effect in two phases in March and June 2026, and they push receiving institutions to watch for the mule accounts that BEC relies on. Organizations should check with counsel and their payment providers on how those obligations apply to them.