When an invoice shows up in your inbox, you look for reasons to trust it. The invoice number looks right. The amount matches what you expected. And underneath the message there is a whole email thread, a back-and-forth between your boss and the vendor, with a signature and a follow-up. That thread is the part that lets you relax.
It is also the part the scammer wrote.
A million of these in three days
In September, Microsoft's security team published research on a campaign that sent more than a million fraudulent emails in three days, from August 3 through August 5, 2026. Almost nine in ten of them, 87.7 percent, went to people in the United States. The messages claimed to come from the target company's own chief executive, and they told the accounts payable department (which, in a small company, is usually one person wearing four other hats) to release an ACH payment, a direct bank transfer, of nearly fifty thousand dollars.
The emails looked ordinary on purpose. A short approval line. A professional invoice, branded like a vendor you would recognize. Then, below the invoice, a forwarded conversation between two executives discussing the purchase, the implementation, and the payment. None of it happened. Every name and every reply was invented.
Microsoft said the messages carried signs of being drafted with AI. That is the shift worth understanding. A fake invoice used to be a badly spelled email from a stranger. Now it can be a specific, well-written message that knows your boss's name, your vendor's name, and roughly what you pay them.
The thread is not proof of anything
Your instinct is to treat a forwarded conversation as verification. It is not. When someone forwards an email, the earlier messages become plain text in the body of the new message. Anyone who can type can put a conversation there. It is not a record of anything. It is a story someone wrote to make a payment look routine.
That matters because the request is built to skip your normal process. The message does not ask whether you should pay. It assumes the decision is already made. The boss approved it. The vendor is waiting. Accounting needs it today. Nobody asked you a question, so there is nothing to push back on.
The rule that actually works
The FBI's Internet Crime Complaint Center is direct about this: use a secondary channel, or two-factor authentication, to verify any request to change account information. In plain terms, do not confirm a payment request inside the same email that delivered it.
If a message asks you to send money somewhere new, or to change where money goes, stop and pick up the phone. Call a number you already had on file. Not the number in the email. Not the number in the signature block. A number from a previous invoice, a signed contract, or your own records.
Then ask one question out loud: did you send me something about a payment? That call takes about ninety seconds. It is the difference between a normal afternoon and a very bad one.
The stakes are not small. In its 2025 Internet Crime Report, the FBI logged 24,768 business email compromise complaints and more than three billion dollars in reported losses, which put business email compromise second only to investment fraud among the categories IC3 tracks. Michigan ranked sixteenth among the states for reported losses that year.
What to do this week
Write the rule down, and make it cover everyone including the owner. No change to payment details by email alone. We call a known number first. A rule with exceptions is not a rule.
Give whoever pays the bills room to say no without getting in trouble. This scam depends on someone feeling that questioning the boss is riskier than releasing the money. Take that fear off the table before it matters.
If a payment does go out to the wrong account, move fast. Call your bank's fraud line immediately and ask about a recall, then file a report at ic3.gov. The FBI notes that requesting a recall as quickly as possible may reduce the loss.
You do not need to be a security expert to stop this one. You need one habit, used every time: when money is moving somewhere new, confirm it out loud on a channel the scammer does not control.