How to Trace a Business-Email-Compromise Scam

Business email compromise, or BEC, is fraud that moves your money by manipulating a normal-looking email instead of breaking anything technical. The core trick is payment diversion: a criminal arranges for a legitimate-seeming payment to be sent to an account they control. The most common form is the fake or altered invoice. A long-standing vendor appears to email new banking details “for this quarter,” or your accounts-payable team receives an invoice that matches a real, expected one in everything but the wire instructions. The money goes out the door looking entirely routine, and the loss is only discovered when the genuine supplier asks why they were not paid.

There are several flavors, but they share one engine. In vendor email compromise, the attacker has gotten into a supplier’s mailbox, watched real invoice threads, and then sent a payment-change request from inside an account everyone trusts. In CEO or executive fraud, an email that appears to come from a senior leader pressures a finance employee to push an urgent wire, often framed as confidential and time-sensitive so nobody calls to verify. In thread hijacking, the scammer slips into an existing email conversation and replies as if they belong there. The newest wrinkle is that generative AI has made these messages far cleaner and more convincing, removing the clumsy grammar that used to give them away. Whatever the variant, the goal is identical: change where the money lands, and stay invisible until it is too late to stop the transfer.

BEC funds do not sit still. They land in a mule account and are very often moved again within minutes, broken into smaller transfers, cashed out, or converted, which is exactly why recovery odds collapse as the clock runs. The single most useful thing you can do is trigger a recall before the money is layered away. File the federal complaint right away at the FBI Internet Crime Complaint Center; its Recovery Asset Team uses the Financial Fraud Kill Chain to ask the receiving bank to freeze a fraudulent domestic wire, and it works best when the report comes in fast. Do this in parallel with calling your own bank, not after.

The money trail. This is the bank-and-law-enforcement lane. When you report fast, your bank and the IC3 Recovery Asset Team work to identify the receiving account, ask the receiving bank to freeze it, and follow the funds if they have already hopped to a second or third account. Where a freeze succeeds, the held money becomes recoverable through the bank or a later seizure. This part runs on financial institutions, subpoenas, and the Financial Fraud Kill Chain, and it is exactly why speed and a precise destination-account number matter so much. Our role on this side is supportive: documenting and organizing the account numbers, wire references, domains, and timeline so your report is one an institution can actually act on.

The human trail. This is the lane almost no incident-response service works, and it is where People Locator Skip Tracing fits. Behind the fraudulent account and the spoofed email are real people with real footprints. There is the money mule whose name is on the receiving account, often a person recruited through a job or romance scam who can be identified and located. There is whoever registered the look-alike domain, sometimes traceable through registration and hosting records. There is the individual tied to a phone number, a reply-to email, or a name used in the thread. Those identifiers, even when the display name was fake, can be researched lawfully through public records and skip tracing to surface a real name, address, and associates, which is the same work behind our guides on finding someone who scammed you and on tracing a person from an email address. A named, located individual changes the case: it strengthens your IC3 report, gives a prosecutor or an attorney something concrete, and opens the door to a civil claim that a frozen-or-not bank trail alone cannot support. We never confront anyone and never encourage you to; our job ends at lawful identification so you and the authorities can act on it.

BEC succeeds because a payment change felt routine and nobody verified it out of band. The fix is a habit, not software. Make it policy that any change to vendor banking details, and any urgent or unusual wire, is confirmed by a phone call to a number you already have on file, never a number or link from the email itself. Treat “the CEO needs this wired right now, quietly” as a red flag by default, because real executives expect verification. Watch for look-alike domains by hovering over the actual sender address rather than the display name, and have IT review mailboxes for the hidden forwarding and auto-delete rules intruders leave behind. If you discovered a mailbox was compromised, assume the attacker read your vendor and invoicing history, and warn the customers or suppliers in those threads so the same fraud is not run against them next. The same discipline that protects a business inbox is closely related to how individuals can identify a scammer behind a phone number and verify who is really contacting them. None of this undoes the loss, but it removes the gap the next attempt will look for.

BEC frequently runs on the same rails as other frauds, so the people behind it surface through the same lawful research that powers our broader work on phone-scam caller investigation and full-spectrum skip tracing. Send us what you have, even if it feels like nothing: the destination account name, a phone number, an email or reply-to address, a look-alike domain, or the names used in the thread. We work strictly for lawful, permissible purposes, we never confront anyone on your behalf, we never promise a recovery we cannot control, and we tell you honestly what the records can and cannot show. For a legitimate matter, an initial locate typically comes back within 24 hours.