Business email compromise needs no malware. The loss is yours by law.

The most expensive email your company receives this year will probably carry no malicious link, no booby-trapped attachment and no malware. It will ask for something ordinary — a payment, or a change of bank details — in the voice of someone your team already trusts.

Victims reported $3.05 billion in business email compromise losses to the FBI’s Internet Crime Complaint Center in 2025, across 24,768 complaints. Europe publishes no single equivalent figure, but it publishes something more useful to a board: who ends up paying. Across the European Economic Area, customers bore around 85% of credit-transfer fraud losses in 2024, according to the joint EBA and ECB report on payment fraud. Not banks. Customers. And the trend is up: in France, credit-transfer fraud rose 37% in 2025, to €485 million, according to the Banque de France.

Business email compromise is not a hacking problem you can buy your way out of. It is a payment-process problem — and EU payment law has already decided that the process, and the loss, are yours.

An email about new bank details

Take an illustrative case — a composite, not a client. A 120-person distributor’s accounts-payable clerk receives a reply in a long-running thread with a packaging supplier. Same thread, same signature, correct invoice numbers. Attached is a letter on the supplier’s letterhead: they have changed banks, please update the details before the next payment run.

The clerk updates the supplier record. Friday’s run pays three open invoices, €184,000, into the new account. Nobody notices for 26 days, until the real supplier chases for payment. By then the money has passed through two further accounts.

Nothing was hacked at the distributor. The supplier’s mailbox had been taken over weeks earlier. The attacker read the correspondence, waited for invoices to fall due, and wrote in the supplier’s own words, from the supplier’s own account.

One changed IBAN, six steps, no malware — and four points where a rule stops it, or gives you a chance to get the money back.

Why no tool saw it

Email authentication — SPF, DKIM, DMARC — confirms that a message came from the domain it claims. This one did. There was no payload to scan and no link to detonate. Every security control worked as designed, because none of them is designed to judge whether a request is honest.

The fake-president variant works the same way from the other end: an urgent, confidential instruction that appears to come from the top. In March 2018 the Dutch subsidiary of the cinema group Pathé transferred €19.2 million in a series of payments over less than three weeks, to fund a strictly confidential acquisition in Dubai that its Paris head office had never ordered. Its chief executive and finance director both lost their jobs. The next step, a follow-up call in a cloned voice, deserves an article of its own.

What all the variants attack is not a system. It is two moments in a payment process: when a bank detail changes, and when someone senior asks for the normal approval to be skipped.

Europe’s new payee check, and its three gaps

Since 9 October 2025, payment providers in the euro area have had to offer Verification of Payee on every euro credit transfer, instant or not (in Bulgaria, which joined the euro in January 2026, by 1 January 2027 at the latest). Before you authorise, your bank compares the payee name you entered with the name on the IBAN and tells you whether it matches, nearly matches, or does not (Article 5c of the SEPA Regulation, inserted by the Instant Payments Regulation, (EU) 2024/886). It is free, and in our composite it would probably have flagged the new account. It is a genuine improvement, with three gaps.

It can be switched off for batch payments. Article 5c(6) lets a business that submits payment orders as a package opt out — which is exactly how most accounts-payable teams pay. If your payment runs go through a treasury file, ask your bank whether yours are verified.

It covers euro transfers within the EU only. A wire to Asia or the Gulf, in euros or in dollars, is not verified. EU banks outside the euro area must comply by 9 July 2027.

A warning is only a warning. The payer can proceed. And Article 5c(8) is explicit: a bank that ran the check correctly is not liable for a transfer to the wrong payee. The same paragraph cuts the other way only when the bank failed to run the check — then it must refund you without delay.

Who pays: almost always you

EU refund rights under the second Payment Services Directive protect you against unauthorised transactions — and on a business account, your bank contract can narrow even some of those protections. A transfer your own staff approved, however well they were deceived, is authorised. The new Payment Services Regulation, agreed by the Council and Parliament in November 2025 and still awaiting formal adoption as of September 2026, adds a refund for impersonation fraud — but only for consumers deceived by someone posing as their own bank. A company paying a fake supplier is outside it.

That leaves insurance. Deception losses tend to sit in fraud or crime cover rather than in a standard cyber policy, so check which of your policies names social-engineering fraud, and at what sub-limit. In France, only 30% of companies surveyed by Allianz Trade in 2026 held fraud insurance — 27% among the very smallest. We set out the wider pattern in what cyber insurers don’t tell you about coverage gaps.

And there is the board. In January 2016 the Austrian aerospace supplier FACC disclosed that it had lost about €50 million to emails impersonating its chief executive. Its supervisory board dismissed him, saying he had “severely violated his duties”; the finance director had already gone.

When the mailbox is yours, it is also a breach

In our composite, the compromised mailbox belonged to the supplier. When it is one of yours — a finance or executive account taken over with a phished password — the fraud is also an incident. A mailbox is full of personal data, so GDPR Article 33 is likely to start a 72-hour clock to the data protection authority. Where NIS2 applies, Article 23(3) counts financial loss among the tests for a significant incident. How those clocks interlock is the subject of one incident, three regulators.

Five rules that cost nothing

The payment-change rule: five lines a finance director can sign this week. None of them is a purchase.

1. Call back on every bank-detail change — on a number already on file, never one from the email or the letter.
2. Two people for any new or changed beneficiary, and for the first payment to it.
3. Keep the payee check on for every file, batch runs included, and treat “no match” as a stop.
4. Multi-factor authentication and new-login alerts on every finance and executive mailbox.
5. No exception for urgency or secrecy. The chief executive tells the finance team, in person, that no request from them will ever skip rules one to four.

Rule one is the cheapest control there is, and fewer than half of companies apply it: in Allianz Trade’s 2026 survey of French companies, 41% call the supplier back when bank details change. Rule five matters most, because it is the one attackers are built to break. Our training and awareness programmes rehearse that phone call with finance teams until declining feels routine, and our Virtual CISO service puts the rule under someone’s name and reviews it. It is the same lesson as the Friday-evening invoice email that opens our anatomy of a ransomware attack: the outcome was decided by a process, weeks before anyone clicked.