Building Easier AI

The Email That Changes a Vendor's Bank Account

Victims reported $3.05 billion in losses to business email compromise in 2025, across 24,768 complaints, in the FBI's 2025 Internet Crime Report. IC3, the bureau's Internet Crime Complaint Center, defines the scam in words that fit a builder's accounts payable: "a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments."

The version that reaches a builder's office looks like routine paperwork. Here is its shape, illustrative rather than any case we know of. Two days before your pay run, the accounts-receivable contact at your lumber yard emails: they've changed banks, letter attached, please update remittance before Friday's payment. The invoices the email mentions are real. The amounts match your POs. Your office updates the vendor record, the ACH goes out, and three weeks later the yard calls to ask where its money is.

You paid the right invoice to the wrong account, and the invoice is still open. The control against it costs one phone call, and it only works if you dial the right number.

Every check on the invoice passes

A bank-change email doesn't ask accounts payable to do anything unusual. It asks you to pay a bill you owe. The checks a careful office runs all sit on the invoice: is it genuine, does it match the PO, did the material arrive, is the amount right. All four pass, because the invoice is genuine. What changed is the vendor record, and the field nobody re-reads at pay time is the one that decides where the money goes.

The same shape fits a fabricator, a field-service shop or a remodeler: anyone who pays suppliers electronically, with a contact at each who emails the office. A builder has one more hinge, also illustrative: the draw. An email in a sub's name with new remittance details, the week a construction draw funds, asks for money that arrives on a known date, for work you have already approved.

We found no construction-specific figure for business email compromise, so the example above is illustrative and the national numbers below are the whole of the evidence.

The losses are large, steady and undercounted

Reported losses to business email compromise have not surged. IC3 puts them at $2.95 billion in 2023, $2.77 billion in 2024 and $3.05 billion in 2025, about 3% above 2023's on our arithmetic (IC3). The complaint count did rise: 24,768 in 2025 against 21,442 in 2024, up 15.5% (our arithmetic), which can mean more crime or more reporting, and IC3's counts can't tell the two apart. The dollars have stayed near three billion a year for three years, aimed at people who pay suppliers.

Divide 2025's $3,046,598,558 by its 24,768 complaints and the average is about $123,000 a complaint (our arithmetic). It is a mean, and a few very large losses can pull a mean far above the middle case, so it is not a typical loss and it is not an estimate of yours. And "reported" is doing work in every IC3 figure: a complaint center counts only the people who complained, which undercounts the crime and lets victims select themselves.

One survey figure needs its population attached. The 2026 AFP Payments Fraud and Control Survey says "Business email compromise affected 74% of organizations in 2025," which AFP calls "a significant increase from 2023 and 2024" (AFP via PR Newswire, April 14). The respondents are 465 treasury practitioners, surveyed in January 2026 at U.S. organizations "of varying sizes and industries," and the survey is underwritten by Truist, a bank. It is not 74% of businesses, and it says nothing direct about a twelve-person builder. On firm size, AFP's release offers a judgment rather than a number: smaller firms "face fraud less frequently," but "lack the recovery infrastructure of larger firms and are therefore much more likely to absorb the full financial loss of a successful fraud attack." The only size split it prints is by revenue: financial losses at 48% of organizations under $1 billion, and 66% above.

Two more figures matter from our side of the table, because this newsletter is about AI. IC3 says businesses reported "losses over $30 million to BEC scams involving AI," roughly 1% of the year's reported BEC losses (our arithmetic). The rest didn't need AI, or nobody reported that it did. And in the same treasury survey, AFP found that just 17% of organizations use AI to combat payments fraud. AFP calls that a lag, and 45% of the organizations using AI reported better detection of deepfakes. Neither figure changes the control below, and the control is not software.

The control is a call to a number you already had

Write the rule on one line: never change a vendor's payment details on the strength of an email. Confirm every change by calling the vendor on a number you had before the request arrived: from the vendor setup, the contract, the line you already call. Not the number in the email and not the one in its signature block. If the email is fake, so is that number, and whoever answers it will confirm anything you ask.

Three details decide whether the rule holds. First, capture the number before you need it: a number recorded during a change request is the requester's, so put a verified one on every electronically paid vendor's record now, while nobody is asking for anything. Second, call even when the email comes from the vendor's real address. Their own mailbox can be the one taken over, and a phone line is not automatically safe either: the same IC3 definition says these scams also work by compromising "other forms of communication such as phone numbers and virtual meeting applications." A call to a number you recorded before anyone asked raises the bar; it does not make a change safe on its own. Third, log who called, when, on which number and who confirmed, and have someone other than the person who received the request make the change.

The rule has a cost, and it lands on your honest vendors. Every genuine bank change now waits on a phone call, and some suppliers will be irritated at being doubted. We found no published count of how often real vendors change banks, so count your own requests from the past year and you will know what the call costs you. Tell your vendors the rule in writing before you need it, so the call reads as procedure, not suspicion.

What the rule doesn't cover matters as much as what it does. In AFP's treasury survey, paper checks, not wires, were the most-targeted payment method: cited by 58% of respondents, against 30% for ACH debits and 25% for wire transfers. A call-back rule for bank-detail changes does nothing for a check; ask your bank what it offers there. The rule also doesn't cover an email that appears to come from you, asking your bookkeeper to rush a payment. Treat that one the same way: a call back on a number already on file, before the money moves.

If the money has already gone

Once a payment has gone to a changed account, the clock matters more than the cause. IC3's guidance is blunt: "If you discover a fraudulent transfer, time is of the essence." Its Recovery Asset Team initiated 3,900 freeze cases in 2025, covering $1,163,919,846 in attempted theft, and froze $679,013,183, which IC3 reports as a "58% Success Rate" (IC3). Those 3,900 are not all this scam: IC3 says most of the team's cases used to be business email compromise, but 2025 brought a rise in tech-support and account-takeover cases. The 58% is of the money in the cases the team acted on, not of all losses, and frozen is not the same as returned.

IC3's guidance also sets the order of the calls: "Immediately, contact your financial institution and request a recall of the funds," then file a complaint with IC3, "Regardless of the amount lost." Filing the same day is our advice, not IC3's. Put the bank's fraud number on the same sheet as the vendor call-back rule. The day you need it is a bad day to start looking.

Count your own exposure this afternoon

The arithmetic for your own business needs a year of payment history and a pen. List every vendor you paid by ACH or wire in the past twelve months. Beside each, write two things: the largest single payment you made them in that time, and how their bank details could be changed in your office today. Wherever the honest answer is "someone emails the bookkeeper," put a mark.

Count the marks: that is how many vendors one email can redirect. Then find the largest payment beside a mark. That figure is what one convincing message, landing the week before a pay run, could send to a stranger's account. On a builder's list it may be the lumber yard or the framing sub; on a fabricator's, the steel service center; on a field-service owner's, the parts house. It is a better number to plan around than IC3's $123,000 average, because it is yours.

Then clear the marks before the next pay run: one call per vendor, on a number you trust, while nobody is asking you to change anything. The next "we've changed banks" email meets a rule instead of a judgment call.