The three most common email scams hackers use, plus tips to spot them and ideas to help protect your business

We’re spending more time online and doing more business via email than ever before. That has government agencies warning consumers and businesses to be aware of potential email scams. In particular, business owners should be alert to business email compromise (BEC) scams, especially if you or your employees are working remotely.

Fraudsters use email as a key method to try to gain access to your business information and funds. To help you and your employees spot and avoid these scams, we’ve listed the most common designed to harm your business.

1. The invoice scam

In this scenario, someone at your business receives an email that appears to be from a supplier requesting payment. However, the email is actually from a scammer. When you send payment, the money goes to a scam account instead of the supplier’s account.

What to look for
Double check the email addresses from anyone requesting a payment. The sender’s email address might be off by a single letter or come from a “.net” site instead of “.com.” If the sender is providing a new bank account to send the payment to, this may be a red flag as well.

How to avoid it
Instruct your employees to call and verify payment requests using the trusted phone numbers you have on file instead of anything provided in the email. You can also automate your vendor payments. For instance, after confirmation of the correct payment information, you might set up recurring payments via Wells Fargo Business Bill Pay. If you do this, you can trust payments are being sent each month to the right suppliers and vendors, and it may be easier to spot a suspicious invoice.

You can also set up a system that requires a valid purchase order and approvals from a manager and a finance officer to spend money. Then, question any emailed payment requests that don’t include the proper information.

2. Executive imposter scam

With this type of fraud, someone emails your accountant (internal or external) or another employee at your company impersonating you or another high-level executive at your company, such as a co-founder or president. In reality, the sender is an imposter. Usually, these emails request a money transfer to a specified account.

What to look for
As with invoice scams, it’s important to double check the details of the sender’s email address. In addition, if the sender is providing a new bank account or address that differs from what you have on record, this may be a red flag.

How avoid it
Institute a verification process at your company. If an employee thinks the request might really be from you, they may not want to question it. A preset process may empower them to speak up.

For instance, inform employees you will never send an email about a payment without copying a fellow employee. That way, if an employee receives an email claiming to be from you without another employee copied, they’ll immediately be alerted that something suspicious may be going on. Alternatively, your process could require that any fund transfer requests, even urgent ones, be verified by phone. Finally, always be alert for any requests for secrecy, which could be a red flag.

3. Attorney impersonation

If you get an email that looks like it’s from your lawyer requesting personal details or a transfer of funds, particularly if it includes bank account details or is marked urgent, it may be from an imposter.

What to look for
These emails are often sent at the end of the day, which, when paired with an “urgent” label, may tempt some employees into transferring the funds without taking time to verify the request is legitimate. Look for spelling errors or any change in tone from how your lawyer normally writes to you.

How avoid it
When in doubt, don’t send funds until you can independently verify the request with your attorney. It is always better to confirm the request and details of payment separately from an urgent email requesting payment. Remember, email is never a secure way to send financial information.

More email concerns
In addition to BEC scams, hackers may use email to try to steal data — like Social Security numbers, passwords, or credit card information — which can then be used in a variety of ways by criminals.

Advise your employees not to click on any suspicious-looking links, as they may contain malware. And establish company best practices around cybersecurity, including what employees should do if they receive a suspicious email or start noticing suspicious charges.

Criminals may also hack your email account to gain access to your contact list. The scammers then email your contacts pretending to be you, requesting payment. These payments go to the criminals’ accounts, rather than yours.

Suspicious signs that should make you question if your email has been hacked include strange messages from anyone in your contact list or if customers who normally pay on time are late. And consider using accounting software like Xero®1 or QuickBooks® Online2 to set up automated invoices, which can make it easier for customers to spot a fake invoice since it will look different. You can also automate payment receipt; if your partners have your (real) account information saved, they may ignore the account details in a fraudulent email and send payment to you directly instead. This may help you spot and fix a compromised account.

It can take time to change your habits to diligently search for and help protect yourself and your company against potential scams. The scams and tips provided here are a good place to start. If you suspect fraud, it’s important to address it immediately by knowing what to do:

What to do if you suspect fraud

Sources: Federal Bureau of Investigation, Federal Bureau of Investigation, Coalition, Deloitte, Federal Bureau of Investigation, Federal Trade Commission, U.S. Small Business Administration, Federal Bureau of Investigation, Google Search.


1. Xero accounting software is offered by Xero Limited. Wells Fargo doesn’t own or operate the Xero website. Xero is solely responsible for its content, product offerings, privacy, and security. Please refer to Xero’s terms of use and privacy policy, which are located on Xero’s website and are administered by Xero. For more help, visit Xero support.

2. QuickBooks is offered by Intuit, Inc. Wells Fargo doesn’t own or operate QuickBooks. Intuit is solely responsible for its content, product offerings, privacy, and security. Please refer to Intuit’s terms of use and privacy policy, which are located on Intuit’s website and are administered by Intuit.

QuickBooks and Quicken are trademarks of Intuit Inc. registered in the United States and other countries.

Xero is a trademark of Xero Limited.