Holiday Wire Fraud: How Business Email Compromise Works and How to Stop It

The email looks routine. A vendor you pay every month says their bank details have changed. Or your owner, writing from a phone on the way to a holiday party, asks you to send a wire today and keep it quiet. The name, the tone and the timing all look right.

That is business email compromise, often called BEC: a scam where criminals pose as someone you trust, usually by email, to redirect a payment or get sensitive information. It does not need malware or a hacked server. It needs one rushed person and one payment that nobody double-checks. Here is how it works, why the holidays make it easier, and what to do if money has already moved.

Why the holidays are a busy season for payment fraud

The scam itself does not change at year-end. The office around it does:

• More payments. Year-end invoices, bonuses, gift orders and vendor settlements all go out at once.
• Fewer people. Staff are on vacation, so the usual second approval may not be at their desk.
• Deadlines. "This has to go before the holiday" feels normal, which is exactly the pressure a scammer wants.
• Distraction. People check email on phones between events, where it is harder to see the full sender address.

How business email compromise works

Most cases follow a few common patterns:

1. The fake executive. A message that appears to come from the owner or CEO asks finance to send a wire or buy gift cards, urgently and confidentially.
2. The changed bank details. A "vendor" asks you to update their payment information. The next real invoice is paid into the criminal's account.
3. The hijacked thread. A criminal gets into a real mailbox, yours or a vendor's, reads the conversation, and replies in the middle of it with new payment instructions.
4. The lookalike address. The sender's domain is one letter off from the real one, which is easy to miss on a small screen.

Stolen funds are often moved quickly through other accounts, sometimes held by "money mules." In one matter we handled, a client learned that someone was posing as them to collect funds; a recorded call confirmed the false identity and the bank account details being used. See the impersonation and money-mule case study.

Warning signs to watch for

• A change to bank or payment details, especially by email alone.
• Urgency, secrecy, or a request to skip the normal process.
• A sender address or reply-to address that does not exactly match the real one.
• A signature or tone that is slightly different from the usual.
• A request to communicate only by email or text and not to call.

Simple controls that stop most attempts

None of these require a large budget:

• Call back to verify. Confirm any new or changed payment instructions by phone, using a number you already have on file, never one in the email.
• Require two people to approve wires and changes to vendor banking details, even during the holidays.
• Keep the external-sender warning on incoming email. We once advised an executive who was considering removing it; our written recommendation was to keep it and pair it with staff training. See the business email compromise advisory case study.
• Turn on multi-factor authentication for email and banking, so a stolen password alone is not enough.
• Train staff to slow down on payment requests. Our cybersecurity services include security awareness training and email protection.
• Filter and monitor email for lookalike domains, suspicious links and unusual sign-ins. Our inline threat management service inspects email and sign-ins as they happen and alerts our team around the clock.

If money has already moved

Speed matters. In the first hours:

1. Call your bank right away and ask them to try to stop or recall the transfer.
2. Report it to law enforcement, including the FBI's Internet Crime Complaint Center (IC3), and notify your insurance carrier if you have cyber coverage.
3. Do not delete anything. Keep the emails, attachments and phone records. Do not reset devices or wipe accounts; our article on preserving digital evidence before you reset a device explains why.
4. Secure the mailbox. Change passwords, review sign-in activity and check for rules that forward or hide messages.
5. Find out how it happened. Was a mailbox actually compromised, or was the email spoofed from outside? The answer affects your insurance claim, your legal position and your next steps.

That last step is where email forensics and digital forensics come in: tracing headers, reviewing account and sign-in records, and building a timeline in a written report. In one engagement, after an attacker used remote access to move funds, we preserved the evidence, reconstructed the activity and produced a report that supported the client's insurance claim. See the remote-access fraud case study. When the question is who is behind a scheme, our investigations team can help.

Recovery of funds is never guaranteed; acting quickly gives you the best chance.

Frequently asked questions

Can my bank reverse a wire? Sometimes, if it is reported quickly. The bank decides what is possible, so call them first.

How do I know if our email was actually hacked? Signs include forwarding rules you did not create, sign-ins from unfamiliar places, and sent messages you do not recognize. A forensic review can confirm it.

Talk to us before the next payment goes out

Whether you want to tighten payment and email controls before the holidays or need help now after a suspicious transfer, call us for a confidential conversation.

• New York: 631-982-4632
• Boca Raton, FL: 561-391-6057
• Hours: Monday–Friday, 9 AM–5 PM ET
• Request a confidential consultation

Executive Digital Group is a women-owned business founded by Tiffany Graziano and her husband, Michael Graziano. We provide digital forensics, OSINT, investigations, cybersecurity and managed IT, with remote support anywhere in the U.S. and worldwide.

Originally published on the Executive Digital Group website on November 2, 2026.

← Back to Resources