Spot fake invoice and gift-card scams

Business email compromise ([[bec]]) is the quiet giant of cybercrime:

no malware, no links, just a convincing email asking finance to pay a

"supplier," update bank details, or grab gift cards for the boss.

It works because it looks like Tuesday.

The three costumes

1. The changed bank details. A "supplier" emails: new account

number for the attached (real-looking) invoice. Often sent from a

lookalike domain one letter off — or from the supplier's actually

compromised mailbox, making the email itself genuine-looking.

1. The executive in a hurry. "It's [CEO]. I'm in meetings — need

you to handle something discreetly. Are you at your desk?" Then:

wire transfer or gift cards, photos of the codes, urgency and

secrecy throughout.

1. The invoice for nothing. A payable for services never

ordered, hoping accounts-payable volume carries it through.

The one habit that defeats all three

Verify payment changes and unusual requests out-of-band — by

phone, using a number you already had (from your records or the

supplier's real website), never a number or reply-to from the email

itself. Rule of thumb: *the channel that made the request cannot be

the channel that verifies it.* Thirty seconds of phone call versus

an unrecoverable transfer.

And the cultural half: no legitimate executive buys gift cards by

email, and "keep this confidential" plus "urgent" is the scam's

signature, not how real business works. Your organization should

never punish someone for verifying — slow-and-checked is the correct

speed for money.

If one lands (or nearly lands)

Don't reply, don't call the email's number. Report it the same way

as any phish (the ten-second checks: KB-0021) — and if money already

moved, escalate immediately: the first hours matter for recalling

transfers.