Business Email Compromise Still Targets Payment Cycles

What we are seeing

Business email compromise cases commonly involve a message that appears to come from a supplier or executive, timed to an upcoming payment. The request is often to change bank details.

Why it matters

Because the message references real projects, it can pass casual checks. Secrecy and urgency are used to discourage verification.

Defensive takeaway

• Require two people to approve any bank detail change.
• Verify changes by calling a number already on file.
• Use multi-factor authentication on business email.
• Give staff a clear way to report suspected fraud.