An invoice arrives from a vendor you know, with new bank details. The email address looks right. It’s off by one letter. Here’s how business email compromise works, at work and at home.
An email arrives from a company you actually do business with. Same name, same logo, same person you usually deal with. There’s an invoice attached, and a note: “We’ve changed banks, please send payment to our new account.”
Everything looks right. Except the email address has one extra letter in it.
One extra letter in an email address is a different house on a street with the same name. Before you send money to new bank details, call the person on a number you already had, not the one in the email.
Business email compromise, or BEC, is when a scammer tricks an organization into sending them money, usually with a fake invoice and a lookalike email address. It’s one of the most expensive scams out there, because the payments are often big.
The fake domain might have just one change: an extra letter, a missing letter, or a number that looks like a letter at a glance, like “arrowsupp1y.com” instead of “arrowsupply.com.” Security teams see cases where the fake domain was registered just minutes before the fake invoice was sent.
This scam used to arrive by fax: fake invoices for office supplies nobody ordered. Or someone would call the front desk asking to “confirm the shipping address” for an order, then ship toner nobody asked for and send a big bill. Today it’s email, and the fakes look far more convincing.
Homebuyers get fake emails from their “title company” with new wiring instructions right before closing. People paying a contractor get a lookalike email with “updated” bank details. Same trick, and the money is often gone within hours.
Lookalike addresses are a cousin of lookalike web addresses. The same habit works for both: read the part right before the .com, slowly. See What Is a URL?
One short email: the scam making the rounds, one tech word made simple, and one tip to keep you and your family safe. Free, no spam, unsubscribe anytime. Plus a free printable "How to Spot a Scam" sheet for your fridge.
We send one email to confirm it's really you. Your address stays with us and our email service, nobody else. Privacy
You bought a sealed gift card, loaded it, and it was already drained. Here is how scammers empty cards in the store before you ever pick them up, and what to check before you pay.
A call says your power will be shut off tonight unless you pay right now. Real utility companies send written notices first. Here is how to spot the fake before you panic.
A package you never ordered shows up with an Amazon smile and a QR code inside. Scan it and you land on a fake Amazon sign in page. Here's how the trick works and what to do instead.
