1. In 2025, what did business email compromise cost US victims, according to the FBI?
Answer: About USD 3 billion. The FBI’s IC3 recorded USD 3.05 billion in BEC losses for 2025, from 24,768 complaints — the second-costliest crime type after investment fraud.
2. A supplier you’ve paid for years emails: “our bank details have changed.” The safest step:
Answer: Call them on a number you already have on file. If the supplier’s mailbox is hacked, the reply goes to the attacker. A call to a known number reaches the real company.
3. True or myth: if the email comes from the supplier’s real address, it must be genuine.
Answer: Myth. In vendor email compromise the attacker is inside the real mailbox. One accountant’s client lost USD 130k after the attacker answered a live payment thread with new bank details.
4. Between 2013 and 2015 one man tricked two of the world’s largest tech companies out of over USD 100M. How?
Answer: He posed as their real hardware supplier. Evaldas Rimašauskas registered a company with the same name as a real Asian supplier and sent forged invoices and contracts (DOJ SDNY).
5. In 2024 a fraudster changed a city vendor’s bank details using a supplier contact form with a personal email. What stopped it?
Answer: Nothing — the city lost about USD 803k. Baltimore approved the fake contact without a phone check. USD 1.52M was diverted; USD 803,384 was never recovered (Baltimore OIG).
6. A new vendor contact uses a Gmail or Outlook address instead of the company domain. That is:
Answer: A red flag worth checking. Free-mail contacts on a vendor record are a known signal of a fake contact — exactly how the Baltimore fraud started.
7. An invoice arrives with the right logo, layout and amount, but from CompanyCo.uk instead of Company.co.uk. Most likely:
Answer: An intercepted invoice re-sent from a lookalike domain. Attackers copy a real invoice, change only the bank details and resend it from a near-identical domain.
8. How do most supplier-payment frauds get discovered?
Answer: The real supplier asks why they haven’t been paid. In case after case — Singapore 2026, Hamilton in Canada, Baltimore — the fraud surfaced only when the genuine supplier chased an overdue invoice.
9. Asked to split one payment across several new accounts, you should:
Answer: Treat it as a strong warning sign. Splitting transfers across new accounts is a typical way to move stolen money through mule accounts quickly.
10. The strongest company control against these scams:
Answer: A call-back rule for any bank-detail change. Phone verification on a known number for every change of bank details. Baltimore had lost money the same way in 2019 and 2022.