The $100,000 Email: How Invoice and Wire Fraud Actually Happens to Small Businesses
It starts with an ordinary email.
A vendor your company has worked with for years sends an invoice. The amount looks right. The project is real. The sender's name is familiar.
There's just one change:
“Please note our banking information has been updated. Use the attached instructions for payment.”
Accounting sends the $100,000 wire.
A few weeks later, the real vendor asks why the invoice hasn't been paid.
The money didn't go to the vendor. It went to a criminal.
This type of attack is called Business Email Compromise, or BEC, and it has become one of the most financially damaging forms of cybercrime affecting businesses.
According to the FBI's 2025 Internet Crime Report, victims reported 24,768 Business Email Compromise incidents and more than $3 billion in losses in 2025 alone.
And these attacks aren't limited to Fortune 500 companies.
They are particularly dangerous for the type of organization most people still describe as a "small business": a 15-, 30- or 75-person company with an accounting department, outside vendors, payroll, executives, project managers and hundreds of legitimate emails moving through Microsoft 365 or Google Workspace every day.
What Is Business Email Compromise?
Business Email Compromise is different from the obvious phishing emails most employees have learned to recognize.
There may be no misspelled words, strange attachments, or Nigerian princes involved.
Instead, the attacker tries to become part of a legitimate business transaction.
The FBI describes BEC as a sophisticated scam in which criminals compromise or impersonate legitimate business email accounts to cause an unauthorized transfer of funds.
That distinction matters.
The attacker doesn't necessarily need to hack your accounting software or bank account.
They just need your employee to believe an email.
How Invoice Fraud Actually Happens
Consider a company with 25 employees.
The business has an owner, office administrator, accounting manager, several project managers and dozens of vendors.
One of those vendors regularly sends invoices for $20,000, $50,000 or $100,000.
An attacker gains access to either the company's email account or the vendor's account.
Then they wait.
They may quietly watch conversations between the project manager, vendor and accounting department. They learn:
One of those vendors regularly sends invoices for $20,000, $50,000 or $100,000.
An attacker gains access to either the company's email account or the vendor's account.
Then they wait.
They may quietly watch conversations between the project manager, vendor and accounting department. They learn:
who approves invoices;
which vendors are used;
how invoices are formatted;
when large payments are expected;
how executives communicate; and
who in accounting is authorized to send money.
Eventually a legitimate invoice arrives.
The attacker inserts themselves into the transaction and sends new payment instructions.
The email may appear inside an existing conversation:
“Everything else on the invoice remains the same. We recently changed banks. Please use the updated ACH information attached.”
Nothing about the request seems particularly unusual.
That's the point.
The FBI has warned that criminals may compromise legitimate email conversations involving invoices and billing specifically so their fraudulent payment instructions do not raise suspicion.
Sometimes Your Company Isn't the One That Was Hacked
This is one of the most important misconceptions about invoice fraud.
Your Microsoft 365 environment may be secure.
Your employee may have done nothing wrong.
The vendor may be the compromised party.
If criminals gain access to the email account of your contractor, architect, attorney, supplier, benefits company or other vendor, they can send an email from the vendor's actual account.
The email address is correct.
The email signature is correct.
The previous conversation is real.
Even hovering over the sender doesn't expose the attack.
From your employee's perspective, it really is the vendor emailing them.
That's why email security alone cannot completely solve payment fraud.
Businesses also need procedures for verifying financial changes outside of email.
Another Version: The CEO Needs a Wire
Vendor impersonation isn't the only scenario.
An accounting employee might receive a message appearing to come from the owner:
I'm tied up in a meeting. We need this payment sent today for the acquisition. Please handle it confidentially and send me confirmation when it's complete.
The employee is trying to be helpful.
The request appears to come from the boss.
And the attacker deliberately creates urgency so the employee doesn't stop to verify it.
Criminals can spoof an executive's email address, compromise the executive's actual mailbox or create a nearly identical domain.
And increasingly, email may not be the only communication involved.
The FBI reported more than $30 million in 2025 losses from BEC complaints that specifically reported an AI connection, including the potential use of AI-generated messages and voice cloning.
An unexpected phone call that sounds like the owner is no longer necessarily enough verification by itself.
Why 10- to 100-Person Businesses Can Be Ideal Targets
Very small companies sometimes have a simple advantage: the owner is sitting ten feet from whoever pays the bills.
Large corporations may have treasury departments, formal vendor-management programs and multiple levels of approval.
Businesses in the middle often have neither.
A growing professional office may process millions of dollars every year while still relying on informal procedures such as:
“If Jim emails you, go ahead and pay it.”
That creates an attractive environment for payment fraud.
The risk can be especially significant for organizations that routinely move large amounts of money, including:
architecture and engineering firms;
law firms;
healthcare organizations;
construction and property-management companies;
accounting and professional-services firms;
manufacturers and distributors;
nonprofit organizations;
government contractors; and
growing companies with centralized accounting departments.
The company doesn't have to be enormous for a fraudulent payment to be enormous.
MFA Helps. It Doesn't Solve the Entire Problem.
Multifactor authentication is one of the most important protections a business can put around Microsoft 365 and other cloud accounts.
But businesses shouldn't assume:
“We have MFA, so this can't happen to us.”
MFA primarily helps protect accounts from being compromised.
It does not stop an employee from voluntarily sending money after receiving a convincing fraudulent request.
And it doesn't protect your company when the compromised account belongs to someone outside your organization.
Preventing Business Email Compromise requires both technical cybersecurity controls and financial processes.
The Most Important Rule: Never Change Banking Information Based on Email Alone
A surprisingly simple procedure can prevent many six-figure losses:
Any request to change vendor banking or payment information should require independent verification.
Not a reply to the email.
Not a phone number contained in the email.
And not the contact information on the newly attached invoice.
Instead, someone should call the vendor using a previously established phone number or independently verified contact.
For significant transfers, businesses should also consider requiring approval from a second employee.
The FBI similarly recommends using a secondary channel to verify requests involving changes to account information.
The interruption may add two minutes to the accounts-payable process.
It can also prevent a $100,000 mistake.
Technology Should Still Be Doing Its Part
Strong payment procedures aren't a substitute for cybersecurity either.
For a modern office, the underlying protections should generally include:
Multifactor authentication. Email accounts should not rely on passwords alone.
Modern email security. Suspicious messages, impersonation attempts and malicious links should be identified before they reach employees whenever possible.
Account monitoring. Unusual logins, mailbox forwarding rules and suspicious activity should be investigated.
Secure Microsoft 365 or Google Workspace configuration. Default settings are not necessarily the same thing as an appropriately secured environment.
Endpoint protection. A compromised computer can provide attackers with credentials and access to business communications.
Employee security training. Accounting employees, executives and administrative staff should understand that modern phishing may look completely legitimate.
Documented payment procedures. Technology cannot determine whether your accounting department intended to send $86,000 to a new bank account.
What Should You Do If a Fraudulent Wire Has Already Been Sent?
Speed matters.
If your company discovers a fraudulent ACH or wire transfer, contact your financial institution immediately and ask it to attempt to stop or recall the transfer.
The FBI also recommends reporting Business Email Compromise incidents through its Internet Crime Complaint Center at IC3.gov.
Do not spend the first several hours simply investigating internally.
Financial institutions and law enforcement may have a limited opportunity to intercept funds before criminals move them elsewhere.
Your IT provider should simultaneously determine whether any company email accounts were compromised and preserve relevant evidence.
The Bigger Lesson Isn't "Don't Trust Email"
Email is how businesses operate.
The answer isn't asking employees to become forensic investigators every time an invoice arrives.
Instead, build your processes around one assumption:
Email alone should never be enough authorization to redirect a significant amount of money.
For a business with 20, 40 or 80 employees, cybersecurity is no longer just antivirus and backups. It includes understanding how technology intersects with accounting, vendors and the people authorized to move money.
A sophisticated attacker may never try to encrypt your server.
They may simply send one convincing email.
And sometimes, that email is worth $100,000.
Could Your Business Catch This Before the Money Moves?
SNH Technologies helps businesses evaluate the security behind Microsoft 365, email, employee accounts and the systems employees rely on every day.
If your company has grown beyond a handful of employees but your security and payment processes haven't grown with it, it may be time for a closer look.
Review your current cybersecurity environment and identify the gaps an attacker could use before a fraudulent invoice reaches accounting.