One changed account number can cost a small business everything.
Wire fraud rarely involves hacking a bank. It involves a hacked or spoofed email, a convincing request, and a payment that is hard to pull back. Here is how it works, and what the latest numbers show.
Losses are growing every year.
Business email compromise (BEC) is the type of fraud aimed at companies that pay by wire or ACH. It is one of the costliest categories the FBI tracks.
Sources: FBI Internet Crime Complaint Center (IC3) 2025 report, as summarized by SpyCloud and HIPAA Journal; Association for Financial Professionals (AFP) 2025 Payments Fraud and Control Survey, which covers 2024.
How a wire fraud attack works, step by step.
Get in
A phishing email or fake login page steals an email password, or a look-alike domain is set up to copy a real contact.
Watch
The criminal reads real threads, learning who pays whom, which invoices are due and how people write.
Strike
At the right moment a message arrives: “our bank details have changed,” with an edited invoice or PDF.
Get paid
The customer wires the money to the criminal’s account. Everything looks routine until the real payee asks where it is.
Vanish
Funds are often moved onward quickly, which makes recovery hard. Speed is the criminal’s advantage.
Wires are the favorite target.
Losses keep climbing
2024All crime
2025Email fraud
2024Email fraud
2025
Which payments BEC targets
Few get the money back
How the scammers pose
Survey percentages are the share of responding organizations. Figures are rounded. In 2024 the FBI’s Recovery Asset Team helped freeze more than $561 million in fraudulent transfers, which shows how much speed matters.
Every attack above depends on bank details sitting in an inbox.
Veiled Wire takes them out. You enter the instructions once, and your customer gets a secure link instead of an account number. They see the details only after confirming a code texted to their phone, so a hacked inbox has nothing to change.
Start your free 7-day trial