The Invoice Looks Right. The Bank Account Doesn’t: How Portland Businesses Can Stop Payment Fraud

The email comes from a vendor you’ve paid for years. It has the right logo, the right signature, and the same contact who always sends your invoices. There’s one small change: “We’ve switched banks. Please send this payment and all future ones to the account below.”

Your bookkeeper updates the vendor record and pays the invoice. Two weeks later, the real vendor calls to ask where their money is.

That’s business email compromise (BEC), and it’s one of the most expensive scams small businesses run into. There’s no malware to catch and usually no suspicious link. It’s simply a convincing request to move money. The good news for Portland small businesses: a short, consistent verification process stops most of these attempts.

What Business Email Compromise Actually Looks Like

BEC is phishing aimed at your money instead of your password. The FBI tracks it as one of the costliest categories of cybercrime reported by businesses. The scam usually takes one of a few forms:

• Vendor bank-change requests. A “vendor” asks you to update their payment details before the next invoice.
• Fake or altered invoices. A real-looking invoice arrives, sometimes a genuine invoice with only the account number changed.
• Executive impersonation. A message that looks like it’s from the owner asks for an urgent wire, gift cards, or a quiet payment “before end of day.”
• Payroll diversion. An “employee” asks HR to send their direct deposit to a new account.
• Closing and escrow fraud. Common in real estate and law: wiring instructions change right before a closing or settlement.

Why These Emails Are So Convincing

Many BEC emails don’t come from a stranger. They come from a real mailbox that was taken over, either yours or your vendor’s. Attackers phish a password, sign in quietly, and read email for weeks. They learn who pays whom, when invoices go out, and how people write. Then they step into an existing thread at exactly the right moment.

When the mailbox isn’t compromised, they use lookalike domains: acme-supply.co instead of acmesupply.com, or a single swapped letter that’s easy to miss on a phone. Often they also set a mailbox rule that hides replies, so the real account owner never sees the conversation.

That’s why “it came from their real email address” isn’t proof of anything. We covered the credential-theft side in the FBI’s warning about Microsoft 365 phishing platforms. BEC is what attackers do once they’re in.

Red Flags Your Team Should Know

• Any request to change bank, wire or ACH details, no matter who it seems to come from.
• Urgency or secrecy: “Needs to go out today,” “I’m in a meeting, just handle it,” “Don’t mention this to anyone yet.”
• A new account in a different name or a different state or country than the vendor’s.
• Small differences in the sender’s address, or a reply-to address that doesn’t match the sender.
• Requests for gift cards. No legitimate vendor or executive needs them for business.
• A message that breaks your normal process, such as skipping approval “just this once.”

Voice and video are part of this now too. Attackers can clone a voice from a short clip, which we wrote about in AI voice scams targeting Portland small businesses.

A Simple Payment Verification Process for Portland SMBs

You don’t need expensive software to stop most invoice fraud. You need a few rules that everyone follows every time, especially when someone is in a hurry.

1. Verify every bank change by phone, using a number you already have

Call the vendor using the number on file from an earlier contract, invoice or their known website. Never use the number in the email asking for the change. Ask a question only the real contact would know the answer to.

2. Use two people for payment changes and large payments

One person enters the change and a second person approves it. Pick a dollar threshold that fits your business and write it down.

3. Add a cooling-off period for new bank details

Make new payment details effective only after verification and a short waiting period. Urgency is the attacker’s main tool, and a written rule takes that pressure away.

4. Confirm executive requests out of band

If “the owner” emails asking for a wire or gift cards, confirm by phone call, text to a known number, or in person. Owners: tell your team you want them to check, and that you’ll never be annoyed when they do.

5. Know what to do if money already left

Call your bank immediately and ask them to recall the transfer. Speed matters. Then file a report at IC3.gov, change the passwords on any affected mailbox, and check it for forwarding rules. The FTC’s cybersecurity guidance for small business is a good next read.

The Technical Controls That Back Up Your Process

Process stops most of these scams. Technology makes the remaining ones harder to pull off:

• Multi-factor authentication on every mailbox, so a stolen password alone isn’t enough to sign in.
• Email authentication (SPF, DKIM and DMARC) on your domain, so it’s harder to spoof your company to your customers and vendors.
• Advanced email filtering that flags lookalike domains, first-time senders and impersonation attempts.
• Alerts on suspicious sign-ins and new forwarding rules in Microsoft 365 or Google Workspace.
• Security awareness training with realistic phishing simulations, so staff recognize the pattern under pressure.

For a broader starting point, our deep dive into phishing scams covers the other common lures.

Who Gets Targeted Most

Any business that pays invoices is a target. In the Portland area we pay closest attention to law firms and title-adjacent work that wires funds, CPAs and financial advisors who move client money, construction companies with many subcontractor payments, and medical and dental practices that pay a steady stream of suppliers.

How PDX IT Helps

PDX IT is a managed IT provider based in Tualatin, serving small businesses across Portland Metro and Southwest Washington since 2020. Our managed cybersecurity services include MFA rollout, email authentication, email and phishing protection, sign-in monitoring and staff security training. We also help you write a payment-verification policy your team will actually follow.

Everything is managed services on a monthly per-user plan: no break-fix, no hourly billing, no project fees. Gold starts at $100 and Platinum starts at $180 per user per month, with a 90-day opt-out. Learn more about IT support in Portland.

Not sure your email and payment process would catch a fake invoice? Book a free IT assessment and we’ll walk through it with you. You can also call us at 971-331-4871.