An email appears to come from your managing director. It says a payment must go out now. Or a supplier sends “new bank details” just before an invoice is due. Before anyone pays, pause: one independent phone call can stop the scam.

What is CEO fraud?

CEO fraud is a type of business email compromise (BEC). A criminal pretends to be someone you trust at work (often a boss, colleague or supplier) to persuade you to transfer money or change payment details.

The message may come from a lookalike email address. Or a criminal may have access to a genuine mailbox and use it to join an existing conversation. That can make an email thread, name and signature look familiar, but it still doesn’t prove the request is genuine.

The National Cyber Security Centre’s guidance on business payment fraud explains how criminals can impersonate a regular contact and ask for payment into a different account. You don’t need to know the technical details to protect your business. You do need a clear rule for checking payment requests.

Two common scams to watch for

1. “Our bank details have changed”

You receive an invoice from a supplier you work with regularly. The amount looks right. The timing makes sense. But there’s a note saying their bank details have changed, so the payment should go to a new account.

A convincing version may arrive in the middle of a real email exchange. Criminals can also alter an invoice or use a compromised supplier mailbox. Familiar wording and an ongoing email thread are not enough to confirm that new payment details are safe.

2. “Please pay this urgently”

A message that appears to come from your managing director asks you to make an urgent payment. It may mention a confidential deal, a deadline or a supplier who needs paying immediately. The sender may ask you not to call because they’re in a meeting.

That pressure is part of the trick. The aim is to get the payment made before anyone has time to check.

If you run a small business in Boston, Spalding, Skegness, Horncastle, Lincoln, Sleaford, Grantham, Stamford or a nearby village, the practical protection is the same: have a reliable way to verify unusual payment instructions before money moves.
 

Why can busy teams be caught out?

These scams take advantage of normal working habits, not a lack of intelligence. A small office may have one person handling invoices, calls, suppliers and customer queries at once. An urgent message can arrive at exactly the wrong moment.

The request may look routine, use the right names and refer to a real invoice. A staff member may be trying to help the business meet a deadline. That’s why the answer isn’t to blame someone for being busy. It’s to make verification a standard step that everyone can follow.

The one check that stops the payment

Before paying an unusual request or changing supplier bank details, verify it using a phone number you already trust.

Call the supplier or the person who supposedly sent the instruction. Use a number from your existing records or the supplier’s official website, not a number in the email, invoice or message. Ask them to confirm the change and the payment details.

That independent call is the crucial step. If the request is genuine, it can be confirmed. If it isn’t, you’ve stopped the scam before sending money.

For stronger protection, make the check part of your written payment process:

• Pause the payment, don’t make an urgent transfer or amend a supplier record until the request is verified.
• Use a known number: find it in your records or on the supplier’s official website, not in the message.
• Confirm the details: check the reason for payment, amount, account name and bank details.
• Get a second approval, ask another authorized person to review new payees and unusual payments.
• Record the check: note who confirmed the request, when and how.

The Action Fraud guidance on knowing your suppliers also encourages businesses to establish trusted supplier contacts and verify changes. Make the rule easy to remember and apply it even when a request sounds familiar.

What should you look for in a suspicious email?

Treat these as reasons to stop and check, not as a test you have to pass by spotting every clue:

• A sudden change to a supplier’s bank details.
• A demand for urgent, confidential or unusual payment.
• A request to keep the transaction secret or avoid normal approval steps.
• An email address that is slightly different from the one you usually see.
• A request that doesn’t match the supplier’s normal process.

A genuine-looking message can still be fraudulent, particularly if an account has been compromised. So don’t rely on appearance alone. Verify through a separate channel.

What if you’ve already paid?

Act quickly, and don’t panic. Contact your bank using the official number on its website or your bank card and explain that you may have made a fraudulent payment. Ask what action it can take. Tell your IT support provider or whoever looks after your business systems, and keep the email, invoice and payment details.

The NCSC advises organizations that suspect business payment fraud to contact their bank directly and alert their IT support. You can also report a cyber incident through GOV.UK. Be cautious of anyone who contacts you unexpectedly claiming they can recover your money for a fee.

A simple process helps your whole team

A good payment-checking process shouldn’t depend on one person remembering a security lecture. Keep it short, write it down and make sure everyone who handles invoices knows what to do.

For example: No supplier bank change or unusual urgent payment goes ahead until a second person has confirmed it using a trusted phone number.

Review the process when staff responsibilities change, and make it easy for someone to query a request without feeling they are holding things up. A genuine supplier or manager should understand why you’re checking.

For wider protection, keep business email accounts secured with two-step sign-in, use separate passwords, and make sure staff know how to report a suspicious message. These steps won’t replace the verification call, but they help make your day-to-day defences stronger.

Start with a free business IT health check

Not sure whether your business has clear payment checks, protected email accounts or a support plan for when something goes wrong? Start with EB IT Support’s free online IT health check. It takes around three minutes and gives you a plain-English snapshot with practical next steps. It’s a helpful starting point, not a formal security audit.

If you’d like a closer look at a particular risk or process, our problem-finding review is the next step: before it happens to you. We’ll help you understand where the gaps may be and what to priorities, without jargon or pressure.

For ongoing support, EB IT Support’s Managed IT Care Plan starts from £295 per month for the Essential plan. We also practice what we preach: we run these same kinds of checks on our own systems.

We’re a local team based in Boston, supporting organizations across Lincolnshire. EB IT Support is rated 4.8/5 on Trust-pilot from 132 reviews. If you’d like to talk through a concern, call 01205 627240 or email [email protected]. Our office phone line is available Monday to Friday, 9am to 5pm, and Saturdays, 10am to 1pm. All office visits must be pre-booked.

Checked against current guidance on 5 November 2026. Advice here is general; your business’s payment process should reflect its own needs.

EB IT Support (EBITUK): Trading as EB IT Support Ltd.