San Joaquin Valley businesses are losing real money to a scam that skips malware and malicious links entirely. All it takes is a convincing email. Email impersonation scams trick employees into wiring funds or changing payment details by posing as an executive or a trusted vendor. This piece explains how these scams work, their current costs, and what steps to take in the first hour if one gets through.
What makes an email impersonation scam hard to spot
An email impersonation scam works by exploiting trust. Attackers compromise a real email account or register a lookalike domain close enough to pass a quick glance, then pose as a vendor or an executive. There’s no malware to trigger a security alert and no malicious attachment for a filter to catch.
The message usually lands during routine business, like an invoice due or a vendor update, so the request doesn’t feel out of place. Many phishing emails aim to steal credentials. Email impersonation scams can go directly after payments. The FBI’s Internet Crime Complaint Center classifies this pattern as business email compromise, where criminals gain control of a real account, or convincingly imitate one, then use that foothold to push through an unauthorized wire transfer. Because the message may contain no malware or malicious attachment, traditional filtering alone may not identify it as suspicious.
We covered the basics of email impersonation in an earlier post. This one goes further into what a successful attack costs and what to do in the critical first hour.
How invoice fraud and CEO email scams typically play out
These scams follow a few recognizable patterns, though attackers tailor the details to fit each target.
Invoice fraud is a common version. A vendor’s email account gets compromised or spoofed closely enough to pass a casual review, and the attacker sends an invoice with updated payment instructions. Accounts payable pays it without a second look because everything else about the invoice matches past ones.
CEO email scams follow similar logic. An email that looks like it came from a business owner or executive lands in an employee’s inbox, usually marked urgent, asking for a wire transfer or a gift card purchase before the end of the day. The urgency and the appearance of authority carry the entire attack, without any code to write or vulnerability to exploit.
Vendor impersonation and requests to change bank details work the same way from a different angle. The attacker poses as a supplier asking to redirect future payments to an account they control.
What business email compromise is costing businesses
The FBI’s Internet Crime Complaint Center logged 21,442 business email compromise (BEC) complaints in 2024, with reported losses of $2.77 billion, the second-costliest category of cybercrime the agency tracks, behind only investment fraud.
That figure has remained near $2.7 to $2.9 billion for three straight years, showing that the tactic continues to generate substantial losses. Complaints filed by people over 60 alone accounted for more than $385 million of last year’s total.
For a small or mid-size business, one fraudulent payment can have an outsized operational impact. A substantial wire transfer may affect payroll, supplier payments, or short-term cash flow, particularly when there is no dedicated fraud team reviewing every payment request.
Why phishing prevention works best as a layered defense
Email impersonation succeeds by exploiting how people work. That’s why antivirus alone is not enough to stop it. Effective phishing prevention combines several layers. No single control catches everything.
Filtering can catch obvious attempts before they reach an inbox, and monitoring flags unusual activity inside your cloud email platform, like an inbox rule forwarding messages to an outside address. Training covers what technology alone can’t. It helps staff build the habit of pausing before acting on urgent requests, especially with anything involving money or account details. CISA and federal partners have published joint guidance urging organizations to build these controls into their systems as a standard baseline, with staff training as an added layer on top.
For Valley businesses, including agricultural companies managing suppliers, seasonal operations, and time-sensitive payments, that layered protection can reduce the chance that one convincing email turns into a fraudulent transaction.
What to do in the first hour if a scam succeeds
Speed matters more than almost anything else once a fraudulent wire transfer has gone out. The FBI’s Recovery Asset Team reported a 66% success rate for Financial Fraud Kill Chain cases in 2024. The FBI also stresses that fraudulent wire transfers should be reported as quickly as possible, ideally within the first 72 hours.
Call your bank or payment provider immediately and ask them to attempt a recall or hold on the transaction. Then contact your IT support team so they can start securing the affected email account, forcing a password reset and revoking active sessions.
Check the account’s forwarding and inbox rules next. Attackers who gain access to a real mailbox often set up a rule that copies or redirects messages elsewhere, which lets them keep monitoring the mailbox even after the initial request goes through. Removing an unauthorized rule closes that window.
Finally, preserve the evidence. Save the original email with its full headers. Forwarding it on its own strips the technical details that show the true sending server. An IC3 report can help the FBI assess whether fund recovery action is possible.
Email impersonation scams work precisely because they don’t look like an attack. There’s no reason to wait until after a wire transfer goes out to learn whether your defenses would catch one.
If email could be the weak link in your defenses, ask Grapevine about the email protection built into your cyber security plan, from filtering and monitoring through to staff training and incident response.
FAQs
What is an email impersonation scam?
It is when an attacker pretends to be a trusted executive, employee, or vendor to convince someone to send money or change payment details.
How can businesses spot invoice fraud?
Unexpected bank detail changes, unusual urgency, and payment requests that do not match normal processes should always be verified separately.
Can spam filters stop email impersonation scams?
Not always. These scams often contain no malware or malicious links, so filtering should be backed up by monitoring and staff training.
What should I do if money has already been sent?
Contact your bank immediately, alert your IT provider, secure the affected email account, and report the incident to the FBI’s Internet Crime Complaint Center.
