Email fraud · checked 18 October 2026
Business email compromise: how small businesses get hit
Business email compromise (BEC) is when a criminal emails as you, your boss or your supplier and asks for a payment, usually "new bank details" on a real-looking invoice. The FBI received 24,768 BEC complaints in 2025, with $3.05 billion in reported losses.
The three ways it's done
| Method | What the victim sees | What stops it |
|---|---|---|
| Spoofing your real domain | An email that shows your exact address | DMARC set to quarantine or reject |
| A lookalike domain | yourc0mpany.com or yourcompany-billing.com | Spotting and reporting lookalikes; staff training |
| A hacked mailbox | A real email from a real account, often replying in an existing thread | Two-factor login; checking forwarding rules; call-back checks on payments |
Our free check covers the first two for your domain: it reads your SPF, DKIM and DMARC records and looks for registered lookalikes.
Five checks for this week
- DMARC: make sure your domain publishes a DMARC record and plan to move it to
p=quarantineorp=reject. How to set up DMARC. - Lookalikes: see which typo versions of your domain are registered and can receive email. Lookalike domain check.
- Two-factor login on every email account, especially finance and the owner's.
- Forwarding and inbox rules: attackers who get into a mailbox often add a rule that forwards or hides emails about invoices. Check them in Gmail or Outlook settings.
- Leaked passwords: see whether staff addresses appear in known breaches. What dark web monitoring checks.
The payment side
Email settings can't stop a hacked supplier from asking you to pay a new account. The fix there is a rule: any change of bank details gets a call-back on a number you already had, and a second person approves it. Our sister tool PayeeGuard explains how to set that up.
If you've already paid
- Call your bank's fraud line straight away and ask them to recall the payment. The first hours matter most.
- Report it at ic3.gov (US) or to your national fraud reporting service.
- Change the password on any mailbox that may have been used and sign it out everywhere.
Sources: FBI Internet Crime Complaint Center, 2025 IC3 Report, as reported by McDonald Hopkins ($3.046 billion BEC losses, 24,768 complaints) and Insurance Business. Read 18 October 2026.