What are the red flags?

An email from a vendor you already pay saying its bank or payment details have changed; A request to switch how you pay, such as from a paper check to a wire transfer; Contact details for confirming the change that appear only in the email itself; A large payment that only one person needs to approve.

What should I do if I clicked, paid, or replied?

Verify every payment change by calling the vendor at a number you already have on file, never one in the email; Require more than one approval for large payments, and train staff on your approval process; Turn on multi-factor authentication for email accounts; If it happens, call your bank right away and ask it to recall the funds; File a complaint at IC3.gov, report it to local police, and report it to BBB Scam Tracker.

← Back to search

Business impersonationEmail

Emails asking you to change where you send a vendor payment (business email compromise)

Q: What does the Emails asking you to change where you send a vendor payment (business email compromise) scam look like?

The BBB of Central and South Alabama warns that unverified emailed requests to change where you send a vendor payment are how business email compromise scams work, the same type of scam that cost the City of Mobile $14.7 million. According to the BBB of Central and South Alabama, criminals pose as someone a business already trusts, like a vendor or a company leader, to get a payment sent to an account they control. The BBB says this business email compromise (BEC) scam doesn't need a virus, a bad link, or ransomware, just research, patience, enough details to convince one person, and a payment change that never gets verified. NBC 15 reports the BBB says scammers can impersonate trusted vendors by hacking into email accounts, and in some cases ask businesses to switch payment methods, such as from a paper check to a wire transfer. The BBB issued its warning after the City of Mobile lost $14.7 million to this type of scam and another local business nearly lost more than $750,000. Citing the FBI's Internet Crime Complaint Center, the BBB says BEC was the second-costliest scam reported in 2025, with 24,768 complaints and more than $3 billion in losses.

Last updated Oct 31, 2026

Also known as: Business email compromise (BEC) scam, Vendor bank account change email scam, "New banking information" invoice email, Fake vendor payment change request, City of Mobile $14.7 million email scam

The Scam

According to the BBB of Central and South Alabama, criminals pose as someone a business already trusts, like a vendor or a company leader, to get a payment sent to an account they control. The BBB says this business email compromise (BEC) scam doesn't need a virus, a bad link, or ransomware, just research, patience, enough details to convince one person, and a payment change that never gets verified. NBC 15 reports the BBB says scammers can impersonate trusted vendors by hacking into email accounts, and in some cases ask businesses to switch payment methods, such as from a paper check to a wire transfer. The BBB issued its warning after the City of Mobile lost $14.7 million to this type of scam and another local business nearly lost more than $750,000. Citing the FBI's Internet Crime Complaint Center, the BBB says BEC was the second-costliest scam reported in 2025, with 24,768 complaints and more than $3 billion in losses.

The Targets

Businesses and municipalities that pay vendors and invoices, according to the BBB.

Red flags

An email from a vendor you already pay saying its bank or payment details have changed
A request to switch how you pay, such as from a paper check to a wire transfer
Contact details for confirming the change that appear only in the email itself
A large payment that only one person needs to approve

Your Move

Verify every payment change by calling the vendor at a number you already have on file, never one in the email
Require more than one approval for large payments, and train staff on your approval process
Turn on multi-factor authentication for email accounts
If it happens, call your bank right away and ask it to recall the funds
File a complaint at IC3.gov, report it to local police, and report it to BBB Scam Tracker

More steps for any scam link: I clicked a scam link. What now?

Still circulating?

The BBB said on Oct. 28, 2026 that several Alabama businesses have been targeted.

Primary source: BBB of Central and South Alabama · 2026-10-28

Related sources

NBC 15: Email scam that cost City of Mobile $14.7M also targeting Alabama businesses

Similar scams

Fake angry guest complaint emails with malware 'photos' Malware / business email
Fake farm equipment sellers Business impersonation / fake sales
Norwegian Cruise Line booking phishing emails Travel / brand impersonation
Fake Evite and Paperless Post party invitations that ask for your email password Phishing / account takeover

Educational summary only. Verify details on the source page. Report fraud at ReportFraud.ftc.gov or ic3.gov.