Tips to help spot and avoid a scam: what business owners should know
October 1, 2026 | 2 minute read
While scams take many forms, one of the most common and costly threats facing businesses today is business email compromise (BEC). These attacks are designed to look like routine business communications, which makes them difficult to spot. It’s important to understand how these attacks work and the red flags to watch for.
BEC occurs when a cybercriminal uses email to impersonate someone you trust, such as a vendor, customer, employee, executive or financial institution. Cybercriminals will try to convince you to send money, change payment information or share sensitive data. These threats often look legitimate and may arrive at a time when the request seems routine. Artificial intelligence (AI) is enabling cybercriminals to create more convincing emails, documents and messages that closely resemble legitimate business communications, but the goal remains the same: to get you to act before verifying the request.
Tactics that cybercriminals use
Malicious links and attachments
Cybercriminals may send an email that appears to come from a trusted source and ask you to click a link, open an attachment or sign in to an account. While the email may look legitimate, the link or attachment can install malware, steal login credentials or give cybercriminals access to your business systems and information.
Vendor email compromise
Cybercriminals may impersonate one of your vendors and send an invoice or request to update payment instructions. The email may reference an existing project, invoice or business relationship, making the request appear legitimate.
Customer or client impersonation
Cybercriminals may pose as a customer and request a refund, payment adjustment or account update. These requests can resemble normal business communications.
Executive impersonation
Cybercriminals may pretend to be a business owner, executive or manager and send urgent requests for payment or sensitive information. These messages often emphasize urgency, confidentiality or an exception to normal protocols.
Payroll diversion
Cybercriminals may impersonate an employee and request a change in direct deposit account information, rerouting the real employee’s paycheck to an account of their choice.
Legal, financial or data requests
By observing how your business normally operates, cybercriminals can time a fraudulent payment request to coincide with an expected transaction. When the request looks familiar, it can be easier to mistake it for legitimate business communication.
Red flags that signal a scam
While the details of a business email compromise attack may vary, the red flags are often consistent. Taking a moment to recognize these warning signs can help you identify suspicious requests before responding.
- Impersonation
- Emotion
- False sense of urgency
- Rewards or threats
- Deception
- Unusual payment methods
- Unexpected changes to payment instructions
Help protect against BEC
- Know your company’s cybersecurity plan and how to report any suspicious emails.
- Confirm all requests involving payments, account changes, or sensitive information through a trusted, independently verified channel, such as a known phone number or established approval process.
- Establish dual approval or secondary review procedures for payment requests, changes to payment instructions, and payroll account updates.
- Consider investing in antivirus software and other cybersecurity software that can flag suspicious emails and websites.
- Exercise caution when communicating with unfamiliar individuals and independently verify requests involving money, credentials, or sensitive information.
- Don’t reply to emails from people you don’t know.
- Wait, if you are at all unsure.
The bottom line
By staying vigilant and familiarizing yourself with the red flags, you can help protect yourself and your business from business email compromise. Trust your instincts and verify unsolicited offers or requests before taking action. Doing so can help you avoid financial loss and emotional distress.
Take your security to the next level
Check your security level and take action to help protect your accounts against fraud. See it in the Mobile Banking app or Online Banking.
Fraud prevention checklist
Here are some things you can do today to increase your security – and help protect yourself and your business against fraud and scams.
Important Disclosures and Information
Neither Bank of America nor its affiliates provide information security or information technology (IT) consulting services. This material is provided “as is,” with no guarantee of completeness, accuracy, timeliness or of the results obtained from the use of this material, and without warranty of any kind, express or implied, including, but not limited to warranties of performance, quality and fitness for a particular purpose. This material should be regarded as general information on information security and IT considerations and is not intended to provide specific information security or IT advice nor is it any substitute for your own independent investigations. If you have questions regarding your particular IT system or information security concerns, please contact your IT or information security advisor.
Bank of America, Merrill, their affiliates and advisors do not provide legal, tax or accounting advice. Consult your own legal and/or tax advisors before making any financial decisions. Any informational materials provided are for your discussion or review purposes only. The content on the Center for Business Empowerment (including, without limitations, third party and any Bank of America content) is provided “as is” and carries no express or implied warranties, or promise or guaranty of success. Bank of America does not warrant or guarantee the accuracy, reliability, completeness, usefulness, non-infringement of intellectual property rights, or quality of any content, regardless of who originates that content, and disclaims the same to the extent allowable by law. All third party trademarks, service marks, trade names and logos referenced in this material are the property of their respective owners. Bank of America does not deliver and is not responsible for the products, services or performance of any third party.
Not all materials on the Center for Business Empowerment will be available in Spanish.
Certain links may direct you away from Bank of America to unaffiliated sites. Bank of America has not been involved in the preparation of the content supplied at unaffiliated sites and does not guarantee or assume any responsibility for their content. When you visit these sites, you are agreeing to all of their terms of use, including their privacy and security policies.
Credit cards, credit lines and loans are subject to credit approval and creditworthiness. Some restrictions may apply.
Merrill Lynch, Pierce, Fenner & Smith Incorporated (also referred to as “MLPF&S" or “Merrill") makes available certain investment products sponsored, managed, distributed or provided by companies that are affiliates of Bank of America Corporation (“BofA Corp."). MLPF&S is a registered broker-dealer, registered investment adviser, Member SIPC, and a wholly owned subsidiary of BofA Corp.
Banking products are provided by Bank of America, N.A., and affiliated banks, Members FDIC, and wholly owned subsidiaries of BofA Corp.
“Bank of America” and “BofA Securities” are the marketing names used by the Global Banking and Global Markets division of Bank of America Corporation. Lending, derivatives, other commercial banking activities, and trading in certain financial instruments are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., Member FDIC. Trading in securities and financial instruments, and strategic advisory, and other investment banking activities, are performed globally by investment banking affiliates of Bank of America Corporation (“Investment Banking Affiliates”), including, in the United States, BofA Securities, Inc., which is a registered broker-dealer and Member of SIPC, and, in other jurisdictions, by locally registered entities. BofA Securities, Inc. is a registered futures commission merchant with the CFTC and a member of the NFA.
Investment products: