Phishing, fake invoices and payroll changes

Many email scams aimed at public institutions are not after your computer. They are after a payment. The FBI calls it business email compromise: a criminal gets into an email conversation, or imitates one, and asks for money to go somewhere new.

In 2024, the FBI's Internet Crime Complaint Center (IC3) received 21,442 business email compromise complaints, with reported losses of $2.77 billion. Those are only the losses people reported.

The four versions you will see

Changed bank details. A vendor you pay every month emails to say their bank changed. The invoice looks right, the amount is right, and the email may come from the vendor's real address, because their mailbox was taken over.

Payroll diversion. An "employee" emails payroll or the clerk asking to move their direct deposit to a new account before the next pay date. The real employee finds out when their pay does not arrive.

The urgent official. A message that looks like it comes from the mayor, a board chair or the director asks for gift cards, a wire or a confidential favor, now, and asks you not to tell anyone.

The fake bill. An invoice for a domain renewal, a directory listing or a "compliance filing" the institution never ordered, often for an amount small enough to slip through.

The sender's address proves nothing

IC3's definition of the scam includes compromising real email accounts. When a vendor's mailbox is taken over, the criminal sends from the vendor's genuine address, inside a genuine thread, using details from past messages.

Other times the address is a near copy: one letter changed, or a different ending. On a phone, the display name is often all you see.

So the test is not "does this look real?" It is "does this change where money goes?"

The call-back rule

Any change to payment details, bank accounts or direct deposit is confirmed through a second channel before it takes effect:

1. Call the number already on file, from your vendor records or the employee directory. Never a number in the email or the invoice.
2. Ask a second person to approve the change. A two-person rule turns one tired moment into two chances to catch it.
3. Write the rule down as institutional policy, so nobody has to feel rude for following it.

The FBI's own advice is the same: use a secondary channel to verify requests to change account information.

Other warning signs

• Urgency: "today," "before the board meets," "the account will be closed."
• Secrecy: "keep this between us," "I'm in a meeting, just handle it."
• A reply going to a different address than the one it came from.
• A link to "view the invoice" that asks you to sign in.
• An attachment you were not expecting, even from someone you know.

If a message pushes you to skip a step, that is the reason to take it.

If you clicked, or money moved

If you entered a password on a strange page, change it now and tell your IT contact. Speed matters more than embarrassment, and reporting quickly is what a good employee does.

If money went out, call your bank immediately and ask it to recall the funds. Then file a complaint at ic3.gov. IC3 asks for reports regardless of the amount lost.

Its Recovery Asset Team works with banks to freeze funds; in 2024 it reported freezing $469.1 million in domestic cases. Freezing works best when the report comes in fast.