The email looked real. The domain wasn't

Your supplier is acmesupply.com. The scammer registers acmesupp1y.com, or acme-supply.com, or acmesupply.co. It costs them about ten dollars. They set up email on it, copy a real invoice they got from a previous victim, change the bank details, and send it to your bookkeeper from a name she recognizes.

On a phone, the sender shows as a name, not an address. On a desktop, the address is there but the eye reads what it expects. That is the whole trick. It is not technical. It is a reading test under time pressure.

Tap or hover on the sender name until the full address shows. Read the part after the @ sign letter by letter. Compare it to the last real email from that person, not to memory.

If the email changes bank details, asks for gift cards, or says the usual contact is unavailable, stop. Call the vendor on the number you already have, not a number in the email. Every real vendor would rather take that call than find out you paid someone else.

The same check works for the email that looks like it is from the owner asking for a quick wire while traveling. Owners who are traveling do not switch to a new email address to ask for money.

The other half of this problem is someone sending email that claims to be from your domain, to your customers. Three records on your domain tell the world's mail servers which systems are allowed to send as you. In plain words: SPF lists your senders, DKIM signs your messages so they cannot be altered, and DMARC tells receiving servers what to do with a message that fails the first two.

Most small-business domains have SPF set up by whoever installed email, DKIM maybe, and DMARC not at all. Without DMARC, a forged message from your domain is delivered like any other. With it set to reject, that message dies at the door. It is a one-afternoon setup and it is the single most effective thing you can do to stop being impersonated.

If a scammer gets a password, two-factor is what keeps them out anyway. Email first, then banking, then the accounting software, then social accounts. Use an authenticator app or a security key over text messages where the service allows it.

The objection is always that it is annoying. It is a few seconds a day. Reconstructing a business after an email account is used to redirect a month of customer payments is not a few seconds.

Any change to where money goes gets confirmed by phone on a known number. No exceptions for the owner, no exceptions for the biggest vendor, no exceptions because it is Friday at four. Write it down, tell everyone who touches payments, and make it the easy default rather than a judgment call.

The businesses that lose money to this are not careless. They are busy, and the email arrived at the exact moment it was plausible. A written rule is what works when nobody has time to think.

The person this email targets is not the owner. It is whoever opens the invoices and pays them, usually the most organized person in the building, usually busy, usually trusting the names they see every week. They need to know this scam exists, what it looks like, and that stopping to call is the right move even when the email says urgent.

Show them a real example. Pull up a legitimate invoice email and a lookalike side by side. Point at the domain. Then tell them the rule and tell them nobody will ever be in trouble for taking an extra ten minutes to confirm a bank change. That last part matters more than any software.

Repeat it twice a year. The scams change costumes, the check stays the same.

Call your bank immediately and ask for a recall on the wire. Speed matters more than anything else in the first hours. Change the email password and check for forwarding rules the attacker may have added. Then report it to the FBI's Internet Crime Complaint Center, which helps banks move faster on a recall.

Then get someone to look at how the message got through and what would have stopped it. That review is a normal part of the security work we do for small businesses, and it is a lot cheaper before the wire than after.