The Growing Threat of Email Takeover Scams—and How Businesses Can Stop Them

Email is essential to running a business—from vendor invoices to employee communications and payroll. Unfortunately, it’s also one of the most common ways fraudsters gain access to business funds. One of the fastest-growing threats facing businesses of all sizes is email takeover fraud, often referred to as Business Email Compromise (BEC) or payment redirection fraud.

These scams don’t just target vendor payments. Increasingly, they are targeting employee payroll, making them even more dangerous for teams handling accounts payable and payroll.

What Is an Email Takeover Scam?

In an email takeover scam, a fraudster gains access to a legitimate email account—such as a vendor, employee, business owner, or executive—and uses that access to send convincing messages that appear completely legitimate.

Common scenarios include:

• Fake vendor payment changes: A “vendor” requests updated ACH or wire instructions, directing payments to a fraudster-controlled account.
• Urgent executive payment requests: A compromised executive email instructs accounting to rush a payment outside normal procedures.
• Invoice interception: Real invoices are altered to include fraudulent routing or account numbers.
• Payroll direct deposit changes: An “employee” emails HR or payroll requesting new direct deposit information—sending future paychecks to a fraudster’s account.

Because these emails come from real, trusted addresses, they often bypass suspicion and normal safeguards.

Why These Scams Are So Effective

Email takeover scams succeed because they exploit everyday business routines and human trust. Fraudsters often:

• Monitor email conversations to understand your workflows
• Match the tone and style of real users
• Time requests to coincide with payroll runs or invoice due dates
• Create urgency to pressure staff into skipping verification

In small businesses, one person may handle vendors, payroll, and approvals—making segregation of duties harder. In mid-sized businesses, volume and speed can create opportunities for fraud to slip through.

Best Practices to Protect Vendor Payments and Payroll

Strong, consistent controls can dramatically reduce your risk—without slowing down your business.

1. Verify All Payment and Payroll Changes Out of Band

Never rely on email alone for:

• Vendor banking changes
• New vendor setup
• Employee direct deposit changes

Always confirm using a trusted method, such as calling a known phone number on file or using a secure HR/vendor portal.

2. Require Dual Controls and Approvals

Require a second person to review and approve:

• Vendor payment changes
• Payroll direct deposit updates
• One-time or urgent payments

Even for small businesses, owner review of changes can significantly reduce fraud risk.

3. Lock Down Email and Payroll Access

Email and payroll systems are prime targets. Protect them by:

• Enabling multi-factor authentication (MFA)
• Using strong, unique passwords
• Limiting admin access
• Promptly removing access for terminated employees

4. Learn to Recognize Red Flags

Red flags for both AP and payroll include:

• Urgent or last-minute change requests
• Requests to bypass standard processes
• Unusual grammar, tone, or timing
• Slight changes in email addresses
• Employees asking to change pay info just before payday

Learn to pause, verify, and escalate when something feels off.

5. Separate Duties Where Possible

Where feasible, separate:

• Who enters banking changes
• Who approves them
• Who releases payments or payroll

This is especially important for growing businesses where one role may have expanded informally over time.

6. Monitor and Review Changes Regularly

Run regular reports on:

• Vendor banking updates
• Payroll direct deposit changes
• New vendor setups

Reviewing changes helps catch fraud early and reinforces accountability.

What To Do If You Suspect Fraud

If you believe a fraudulent payment or payroll diversion has occurred:

1. Contact your credit union immediately. Time is critical.

2. Notify internal leadership, HR, and affected vendors or employees.

3. Preserve emails and records.

4. Secure compromised email and system accounts.

Fast action improves the chance of recovery and helps prevent additional losses.

Your Credit Union Is a Partner in Prevention

Your credit union can provide additional educational resources for your business and teams. Fraud prevention isn’t just about technology—it’s about strong processes and informed people.

Fraudsters rely on speed and trust. By slowing down, verifying changes, and building simple controls into your workflows, businesses of all sizes can dramatically reduce the risk of falling victim to email takeover scams—and keep their hard-earned money where it belongs.

Have questions about fraud prevention? We're here to help. Reach out to our team today.