Email scams and wire fraud: what small businesses should know

People and businesses reported just over $3 billion in losses to business email compromise in 2025, according to the FBI’s Internet Crime Complaint Center (IC3), which puts it second only to investment fraud among the cyber-enabled frauds in the IC3’s report. Business email compromise, or BEC, is a scam where a criminal gets into, or convincingly imitates, an email account you trust, then uses it to redirect a payment: the supplier with “new bank details,” the business partner who needs an urgent wire, the client confirming where to send a refund.

Most of the insurance a small business carries isn’t built for this. Property insurance covers physical damage and general liability covers harm to other people, so money your own staff sent on purpose, even under false pretenses, usually falls outside both, while some cyber insurance policies can help, subject to their terms and often only up to a sublimitSublimitA sublimit is a smaller cap within a policy’s overall limit that applies to one specific type of loss or coverage, and it doesn’t add to the overall limit.Read the definition well below the main limit. The best protection is a payment process that a convincing email can’t get past.

What it looks like from your inbox

Say a contractor gets an email from the lumber yard, sitting in the same thread as last month’s invoices, saying the yard has changed banks, and the next payment goes to the new account, which the yard never set up. Nothing about the message looks unusual, and that’s why the scam works, but it falls apart the moment someone picks up the phone and calls the yard on the number they already had before the email arrived.

The IC3 describes BEC as a scam aimed at businesses that work with suppliers or regularly pay by wire, carried out by compromising email accounts, and sometimes phone numbers or video meeting apps, through social engineering or by breaking into systems. The Federal Trade Commission adds a simpler trick called spoofing, where a scammer mimics a recognizable email address so a message seems to come from someone you know. In a small business, the variations tend to look like this:

• The supplier’s “new bank account.” Payment details change by email, just before a large invoice is due.
• The boss in a hurry. An office manager gets a message in the owner’s name asking for a same-day payment to close a deal, with a request not to call because the owner is in meetings.
• The landlord’s updated details. A lease notice arrives with new payment instructions right before rent is due.
• The client who pays someone else. You send an invoice, and a scammer watching the inbox sends your client a follow-up with different bank details, so the client pays the scammer and still owes you.

The IC3’s 2025 report says chat tools can now write official-sounding emails that mimic a company’s CEO, and that voice cloning can be used to request wire payments. A familiar voice on a call you didn’t place isn’t much of a test anymore.

That $3 billion figure needs context

The IC3’s 2025 report lists 24,768 BEC complaints against about $3.05 billion in reported losses. Divide one by the other and the average complaint works out to roughly $123,000, which is far more than most small businesses could absorb, though an average like that can be dragged up by a few very large losses, so a typical loss may well be smaller.

Even so, the figure counts only what victims chose to report, so the real total is higher, and the problem isn’t new: an IC3 public service announcement put worldwide exposed losses at more than $55 billion between October 2013 and December 2023.

The newest piece is the smallest. Businesses reported more than $30 million in BEC losses involving AI in 2025, according to the same report, which is about one dollar in every hundred of the BEC total. That’s a rounding error today. But it’s the piece that makes the old warning signs, like clumsy grammar or an odd tone, much less reliable.

Why your property and liability policies won’t pay

A wire you sent yourself is your own financial loss, with no physical damage and nobody suing you, so it misses the usual policies; first-party vs. third-party coverage explains why. Some businesses buy crime insurance, a separate kind of policy for theft of money that can include some kinds of fraud, but Corgi doesn’t offer crime insurance, so if you want to compare it, ask an agent who sells it.

Where cyber coverage may help, and its catches

The FTC’s guide to cyber insurance lists cyber extortion and fraud among the costs first-party cyber coverage commonly includes, alongside forensic investigation and lost income from business interruption. That’s encouraging. But whether a specific scam is covered comes down to the wording, and the wording is the part of a cyber quote that’s easiest to skim.

Here’s what to look for, in the order we’d check it:

• The sublimit. Fraud coverage often has its own limit, far below the policy’s main limit, so a large headline limit can mean a small payment for a wire scam. Find the number and compare it to the largest payment you make in a normal month.
• What the coverage is called. Insurers use names like social engineering fraudSocial engineering fraudSocial engineering fraud is a scam where criminals pose as someone you trust, such as a supplier or coworker, to trick you into sending money or sensitive information.Read the definition, funds transfer fraud, invoice manipulation and computer fraud, and they can cover different things. Being tricked into sending money yourself is often handled differently from a hacker moving money out of your account, because many crime and cyber forms exclude what they call voluntary parting, where your own staff authorized the transfer, unless a social engineering coverage adds it back. Invoice manipulation usually refers to the reverse case, where your client pays a scammer posing as you.
• Conditions. Some policies pay only if you followed a verification step, like calling the requester at a known number before changing payment details, and if your process skipped it, the claim may be reduced or denied.
• Your client’s losses. If a scammer impersonates your business and your client pays them, ask whether the policy covers your own unpaid invoice, and whether anything responds if the client blames you.
• The costs around the scam. Investigating how your email was compromised, and notifying people if data was exposed, may fall under the policy’s breach response coverage instead.

The blunt advice: if your business pays suppliers by wire or ACH, don’t buy a cyber policy without reading the fraud section and writing down its sublimit, because that one line decides whether the loss this coverage exists for is covered. Everything is subject to the policy’s terms, limits and exclusions.

The first hour after a bad wire

Speed beats everything here. The IC3 says plainly that once you find a fraudulent transfer, time is of the essence.

1. Call your bank immediately. Ask it to start a wire recall or ACH reversal, contact the receiving bank, and sign any indemnification form it asks for; the IC3 notes that policies vary by institution.
2. File a complaint at ic3.gov, whatever the amount. Include the full transaction details, so the IC3’s Recovery Asset Team can work with the banks to try to freeze the funds.
3. Tell your insurer. Report it as soon as you can and follow the claim instructions, since late notice can hurt a claim.
4. Secure the account. Change the compromised email password, turn on multi-factor authentication and check for forwarding rules a scammer may have added.
5. Keep the evidence. Save the emails with their full headers, the invoices and the bank records, and delete nothing.
6. Warn the people who might be next. The FTC suggests telling customers quickly if scammers are impersonating your business, and reporting it to the FTC at ReportFraud.ftc.gov and to the IC3.

Why the rush? In 2025 the Recovery Asset Team reported freezing about $679 million against roughly $1.16 billion in attempted theft. Put plainly, a little more than half the money in the cases the team worked on was stopped, and the rest wasn’t frozen in time, which is better than nothing, and still a coin flip you don’t want to be part of.

Prevention a two-person office can run

You don’t need an IT department to make this scam much harder, and most of what works costs nothing but a habit. The habit that matters most is the call-back: before anyone changes where a payment goes, they call the person asking for it on a phone number already in your records, never one from the email, which is the second-channel check the IC3 recommends. If your business is big enough to have two people, add a second rule, that any large or unusual payment needs a quick “can you confirm this?” from someone else, because a scammer’s whole method depends on urgency and a second person breaks it.

Everything else supports those two habits. Guidance from the IC3, the FTC and CISA comes down to a short list:

• Lock the accounts. Turn on multi-factor authentication for email and banking, and use a unique password for each.
• Read the real address. Set email to show the sender’s full address, especially on phones, where a display name can hide a lookalike domain, and ask your email provider about email authentication so other servers can spot fakes sent in your name.
• Train whoever pays the bills. Three warning signs cover most of it: urgency, secrecy and a new bank account.

That last point cuts both ways. The same verification habit that stops the scam is often the condition a cyber policy’s fraud coverage depends on, so a business that skips the call-back can lose the money and the claim in one afternoon. If an attack goes further and exposes customer data, what to do after a data breach covers the next steps.