Business Email Compromise: Lessons From a $14.7M Loss

By Tech Team Bravo | 11/03/2026

A business email compromise scam just cost the City of Mobile, Alabama, $14.7 million when a payment meant for its arena contractor went to a criminal’s bank account instead. If your office pays vendors by wire or ACH, this week is a good time to set one simple rule: any change to payment details gets confirmed by phone, using a number you already have on file.

Scams like this rarely need special tools. They usually rely on a believable email and a payment change nobody double checks. The same scam targets small offices everywhere, including here on Long Island, and even a small fraction of that loss would hurt a 10 or 20 person business badly.

What happened in Mobile

According to the Associated Press, Mobile’s mayor confirmed the loss came from this type of email scam and said the diverted payment was intended for ongoing construction work on the city’s new arena. Local reporting from FOX10 says the city sent the money to what it believed was the arena contractor’s bank account. The city fired one employee and placed two others on leave, and the mayor said there was no evidence it was an inside job.

The same week, the Better Business Bureau described a near miss nearby. A contractor received an email that appeared to come from a construction company on the same project, asking for a $785,000 electronic payment. The BBB said the sender’s name matched a real employee and the email domain matched exactly. The payment was only stopped because the contractor had just mailed a paper check.

“Emails alone cannot be trusted,” the BBB’s Evey Owen told FOX10.

What business email compromise means for a small office

Business email compromise, or BEC, is when a criminal pretends to be someone you already pay or work with, usually a vendor, a contractor or your own boss, and asks you to send money somewhere new. Often they have broken into a real email account, so the message comes from a real address and may even reply inside an existing thread.

NBC 15 notes that BEC does not need a suspicious link or a virus. The criminal studies who you pay and when, then sends a polite, normal looking request. Common versions include “we changed banks,” “please switch from checks to wire,” or “can you pay this invoice today.”

The numbers are large. In its 2025 annual report, the FBI’s Internet Crime Complaint Center (IC3) counted 24,768 BEC complaints and more than $3.04 billion in reported losses. In a small office, one person often handles payments with no second check, which is exactly the gap this scam uses.

What to do this week

  1. Write down a call-back rule. Any request to change bank details, payment method or where to send money gets confirmed by phone. Use the number in your vendor file or on an old invoice, never the number in the email or on a new invoice.
  2. Require two people for risky payments. New payees, bank detail changes and payments above a set amount need a second person to approve. Ask your bank to turn on dual approval for wires and new payees in online banking.
  3. Turn on multi-factor sign-in for every email account. This is the extra code or app prompt at login. It makes it much harder for a criminal to take over a real mailbox and send fake requests from it. Ask your IT provider to also check mailboxes for hidden forwarding rules.
  4. Put two numbers on a card at the payments desk. Your bank’s fraud line and the IC3 website, ic3.gov. If money goes to the wrong place, nobody should be searching for these.
  5. Spend 10 minutes with whoever pays the bills. Walk through the Mobile story. Tell them clearly that they will never be in trouble for slowing down a payment to verify it.
  6. Consider a verification code with key vendors. Mobile’s mayor told FOX10 the city has tightened its verification process and mentioned an FBI suggested idea: a code sheet vendors use to confirm who they are.

If you would like help setting these up, our IT and cybersecurity services for small businesses include email security, multi-factor sign-in and staff training.

Common mistakes

  • Replying to the email to confirm. If the account is compromised, the criminal answers.
  • Trusting a matching address. The Montgomery near miss shows the name and domain can match exactly.
  • Calling the number in the message. It rings the scammer. Use the number you already had.
  • Switching payment methods because someone asked. A sudden request to move from checks to wires is a known warning sign.
  • Waiting to report. Embarrassment costs time, and time is what decides whether money can be frozen.

When to call for help

If you think a payment went to the wrong account, call your bank’s fraud line first and ask them to recall or hold the payment. Then file a complaint at ic3.gov the same day. The IC3 report says “time is of the essence” and advises filing regardless of the amount lost. After that, call your IT provider to check whether an email account was taken over, and call your cyber insurance claim line.

Call your IT team right away if you see emails you did not send, replies going missing, or vendors saying they got odd messages from you. Those can be signs someone is inside a mailbox. We support businesses across Suffolk County and Nassau County, and we can check a mailbox and lock it down the same day.

Common questions

Can money sent to a scammer be recovered?

Sometimes. The FBI’s Recovery Asset Team works with banks to freeze funds. In 2025 it froze about $679 million out of $1.16 billion in attempted theft, a 58% success rate, but speed matters.

What if the email really came from the vendor’s address?

That does not make it safe. In the Montgomery case, the BBB said the name and email domain matched exactly. Only a phone call to a number you already have confirms the request.

Should we report a small loss?

Yes. The FBI’s IC3 advises filing a complaint at ic3.gov regardless of the amount lost.

Would your team catch a fake payment change?

Book a free 15-minute IT Risk Check. No sales pitch, and you get a one-page summary of what to fix first.

Book your free IT Risk Check | Get our free playbooks

Sources

Posted in Small Business IT