The dangerous invoice is often not the obviously fake one.
It is the invoice that arrives in the middle of a real business relationship and changes one small thing.
New bank details.
Business email compromise, or BEC, works because the attacker borrows an existing relationship between a company and a supplier, executive, employee, customer, or contractor. The message may refer to real work, real names, and a payment the recipient genuinely expects to make.
The fraud appears in the instruction telling the recipient where the money should go.
The FBI specifically warns businesses to verify changes in account numbers or payment procedures and to confirm transfer requests through another channel.
See the FBI’s Business Email Compromise guidance.
Familiar context does not authenticate a new bank account
A fraudulent message does not have to invent the entire transaction.
An attacker who has compromised an email account, studied public information, or learned the normal rhythm of a business can wait for the moment when a payment is expected. The request then feels routine because most of it is routine.
That is why a sudden change in payment instructions deserves its own verification step even when everything else in the message looks correct.
The FBI recommends verifying payment and purchase requests in person when possible, or by calling the person through a known number. Its older BEC guidance makes the same point: confirm vendor payment-location changes and use previously established contact information rather than whatever number appears in the suspicious message.
See the FBI’s earlier BEC prevention guidance.
Verify the change outside the message that requested it
If a supplier says its bank account changed, do not verify the change by replying to the same email thread.
Use a phone number already on file, an established vendor portal, a known contact, or another trusted channel. For larger transfers, a second employee approval can make one compromised inbox much less useful to an attacker.
Urgency is another warning sign. An attacker benefits when the normal verification procedure suddenly feels too slow for this one special payment.
The key distinction is simple.
A real invoice proves that money is owed.
It does not prove that a newly supplied destination account belongs to the company that earned it.
The relationship may be genuine.
The last line of the payment instructions may not be.