Why this matters
Business email compromise is when a criminal gets into, or imitates, a real email account and uses it to redirect a payment. It is one of the costliest kinds of cybercrime reported to the FBI.
Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report. These figures cover only incidents reported to the FBI, so the real total is likely higher.
The setup
A private equity firm is buying a regional services business. The deal team, the seller, two law firms and the seller's controller have been emailing each other for weeks. Closing is scheduled for Friday. The purchase price will be sent by wire.
Nobody on the deal is careless. Everyone is busy, the timeline is tight, and most of the people involved met for the first time on this deal. That is exactly the situation this scam is built for.
How it unfolds
Each step looks normal on its own. The green notes show where it could have been stopped.
- Three weeks out
A password is stolen
The seller's controller gets an email that looks like a shared-document notice and enters her email password on a fake login page. The criminal now has access to her inbox. Nothing looks different to her.
Could have stopped it: a second login step, such as a code on her phone, would have made the stolen password useless on its own.
- Weeks 2 to 3
Someone is quietly reading along
The criminal reads the deal emails without sending anything. They learn who the lawyers are, how people sign their emails, the closing date and the amount. They set up a rule that hides certain replies from the controller.
Could have stopped it: an alert for new inbox rules or logins from unusual places would have flagged this weeks before closing.
- Tuesday
The "updated" bank details arrive
Two days before closing, the buyer's team receives an email that appears to come from the seller's side, in the same thread, with the right names and tone. It says the receiving bank account has changed for "tax reasons" and attaches new wire instructions.
Could have stopped it: a standing rule that any change to payment details is confirmed by phone, using a number you already had, not one in the email.
- Friday
The wire goes out
Under closing-day pressure, the new instructions are passed along and the payment is sent. The email looked right, the thread was real, and nobody wanted to be the person who delayed closing.
Could have stopped it: a named approver for every payment and a short pause for any change made in the final week.
- Monday
The seller asks where the money is
The seller says the funds never arrived. Banks are called, lawyers are called, and everyone tries to work out what happened. Speed matters most here: the faster the bank and the FBI are told, the better the chance of freezing the money.
What it costs, beyond the wire
Even when part of the money is recovered, the deal pays for it.
A delayed or reopened closing
Funds have to be found, re-sent or replaced while everyone works out who is responsible.
Legal and forensic bills
Lawyers, investigators and insurers all get involved, often on both sides of the deal.
Damaged trust
Buyer and seller start the relationship arguing about whose email was the weak link.
Questions about the asset
If the seller's email was this exposed, what else is? That question tends to come back at renegotiation.
What deal teams put in place
None of this is expensive or complicated. It mostly comes down to doing three things before money starts moving.
A quick look at the target's email and accounts
Is a second login step turned on? Who has access to what? Have there been past incidents? A short, outside-in review answers these before you are committed, and tells you how exposed the deal's own communications will be.
One simple view of the risks
A one-page summary the whole deal team can read, written in plain business terms: what was found, how serious it is, and what it would cost to fix. It keeps the conversation on facts rather than surprises late in diligence.
Protection for the people who approve money
Partners, principals and anyone who can approve a payment are the people criminals imitate. Stronger email protection on their accounts, a phone check for any payment change, and a clear approval rule close the gap this scenario walked through.
Want to see how exposed your next deal would be?
We'll walk through this scenario against your own process and show you where it would or would not be caught. No cost, and you keep the findings. For the questions to ask at every stage, see our Cyber Due Diligence Checklist.
Secure a Strategic DebriefThis is an illustrative scenario built from patterns common to business email compromise. Names, amounts and timing are not drawn from any specific client or deal. If you think a payment has been redirected, contact your bank immediately and file a report at ic3.gov.