Watch Out for This Email Scam: When a Vendor Asks You to Send Money to a New Bank
Cybercriminals are becoming more sophisticated, and one of the most dangerous scams we’re seeing involves inserting fake emails into ongoing, legitimate business conversations — typically requesting a change in payment instructions. This type of attack is known as business email compromise (BEC), and it can result in major financial loss before anyone realizes something is wrong.
.
How the scam works:
An email appears to come from a trusted party — a landlord, vendor, or partner — and continues an existing conversation thread. The message may look completely normal, but it contains updated banking information. Often, the sender’s email address has been subtly altered (e.g., from examplegroup.com to examplegroups.com). These fraudulent messages are difficult to detect because they are inserted into real conversations and mimic the tone and structure of legitimate communication.
.
Why this is especially dangerous:
– The fraudulent email appears mid-thread, making it seem like a natural continuation of the conversation.
– It comes from a lookalike domain, often with just one letter changed.
– It includes familiar names and sometimes even prior message content.
.
What to do if it happens to you:
Stop and verify. Always call a known contact to confirm any request involving financial or banking changes. Examine the sender’s address carefully, and involve your IT or finance team immediately if anything seems off. Avoid clicking links or attachments until the email is confirmed as authentic.
.
Best practices to reduce risk:
– Implement dual-verification steps for all changes in payment instructions.
– Monitor for lookalike domains and ensure email authentication tools (SPF, DKIM, DMARC) are in place.
– Use geo-fencing to block access from foreign IP addresses where appropriate.
– Train your team regularly on phishing and business email compromise risks.
.
Now, about insurance:
This type of fraud often is not covered under general liability or property insurance. Because the transfer of funds is technically “authorized,” even if based on deception, insurance carriers may classify the loss as voluntary — not theft. Businesses should confirm that their policy includes cybercrime or social engineering coverage, which specifically addresses these types of impersonation attacks.
.
Final thought:
Don’t assume a fraud attempt will be obvious. These attacks are subtle, professional, and targeted. A moment of verification can prevent irreversible damage — and the right insurance can ensure recovery if something slips through.
.
In our next post, we will tell you the technical side of how the scam works.
