AI is making some social-engineering messages more polished, personalized, easier to translate, and faster to produce. That can strengthen familiar business email compromise (BEC) scams, including fake vendor payment changes and executive transfer requests. But BEC is not synonymous with AI phishing: many scams rely on impersonation or compromised accounts without AI. The most reliable defense against a payment-change request remains independent verification through a trusted channel.
How AI changes social-engineering scams
Social engineering persuades someone to take an action—such as sending money, sharing credentials, or revealing sensitive information. Generative AI can help criminals draft fluent, tailored messages, translate them, and produce more of them. It can also create plausible images used in impersonation. These capabilities can make some common warning signs less obvious, but they do not make every scam technically new.
As an Amazon Associate I earn from qualifying purchases.
The FBI has described criminals using AI-generated text to appear believable in social engineering, spear phishing, and financial fraud, and to overcome common indicators of fraud. The same FBI announcement discusses generated images used in impersonation and other schemes: FBI IC3, “Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud”.
Recommended Free Tools
What business email compromise is—and where AI fits
The FBI defines BEC, also called email account compromise (EAC), as a sophisticated scam targeting businesses and individuals who make legitimate funds transfers. A criminal may compromise a real email account through social engineering or computer intrusion, or impersonate a trusted party to induce a transfer. AI can assist with the deception, but it is not required for a BEC scam.
Common scenarios include a vendor invoice with changed payment details, an executive asking for gift cards or a transfer, and fraudulent real-estate wire instructions. These are based on real victim scenarios described by the FBI: FBI, “Business Email Compromise”.
What the reported figures do—and do not—show
In its 2025 annual report, the FBI Internet Crime Complaint Center (IC3) said businesses reported more than $30 million in 2025 losses to BEC scams involving AI. This is a reported AI-involving BEC figure for that year—not an estimate of all BEC losses or the share of BEC scams that use AI. The report also emphasizes that BEC uses multiple tactics and is not always AI-enabled: FBI IC3, 2025 IC3 Annual Report.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
Separately, IC3 reported $55,499,915,582 in exposed BEC losses from October 2013 through December 2023, drawing on reports to IC3, law enforcement, and financial institutions. That broad historical figure is not AI-specific, and “exposed losses” should not be read as a measure of final unrecovered losses. The different periods and measures cannot be used to calculate what proportion of BEC involves AI: FBI IC3, 2023 Internet Crime Report.
How to assess a suspicious email or payment request
A polished message, familiar logo, or plausible sender name does not prove a message is genuine. The FTC warns that phishing messages can imitate a familiar person or vendor, request a link click or sensitive information, and create urgency; logos and email addresses can also be spoofed: FTC, “Cybersecurity for Small Business”.
- Treat a new or changed bank account, urgent wire, gift-card request, or request for credentials as a reason to verify independently.
- Do not rely on the phone number, reply address, or other contact details included in the message you are checking.
- Be especially cautious when a message asks you to bypass normal approval steps or keep a transaction secret.
How to verify changed bank details and wire requests
- Pause the transaction. Do not update a vendor record or send funds based only on an email or message.
- Contact the requester through a separate, trusted channel. Use a phone number or contact method already on file—not one supplied in the suspicious message. Confirm the change directly with the vendor or person using an established procedure.
- Follow your organization’s approval process. Use the normal checks for new beneficiaries, bank-detail changes, and high-value transfers, even if the request appears to come from a senior colleague.
- Document and report the request. If it is suspicious, alert the appropriate IT, security, finance, or management contact so others can check for related messages or account activity.
IC3 specifically recommends verifying account-information changes through a secondary channel. A separate-channel confirmation is intended to catch fraudulent changes before money is sent; simply replying to the email does not provide that independent check.
Which safeguards help, and what each one covers
| Safeguard | What it helps address | What it does not establish |
|---|---|---|
| Independent confirmation of payment changes | Can stop a fraudulent account change or transfer before funds leave. | Does not prove every other email or transaction is safe. |
| Unique passwords and two-factor authentication | Reduce the risk that an attacker can take over an account using a stolen or reused password. | Do not authenticate every payment request or replace transaction verification. |
| Email authentication technology and reporting processes | Can reduce spoofing opportunities and give staff a clear route to report suspected phishing. | Do not guarantee that every message reaching an inbox is genuine. |
| Staff education and phishing examples | Help employees, including help-desk and support staff, recognize current approaches and report suspicious messages promptly. | Should reinforce security controls, not stand in for them. |
The FBI recommends unique passwords, two-factor authentication, staff education, and immediate reporting protocols; it also advises training help-desk and support staff with current phishing examples. The FTC recommends email authentication technology and clear procedures for reporting suspected phishing. These are complementary measures: authentication helps protect accounts, while a separate verification step checks whether a particular financial request is legitimate.
Rank #4
What to do after a fraudulent transfer
- Contact the sending financial institution immediately. Explain that the transfer was fraudulent and request assistance with a recall.
- Report the incident to IC3. Provide the transaction and communication details requested in its complaint process.
- Alert your organization’s response contacts. Notify the relevant finance, IT, security, and management teams so they can investigate affected accounts and transactions.
- Preserve relevant records. Keep the suspicious message, payment instructions, transaction details, and related correspondence available for the bank and investigators.
The FBI’s BEC guidance urges victims to contact their financial institution promptly to request a recall and to file a report with IC3. Acting quickly matters after funds have been sent.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
