The email that almost moved $1.2M, minute by minute

How to catch business email compromise before a wire goes out is usually taught as a list of red flags — a look-alike domain, an urgent tone, a changed account number. The list is right and still not quite the lesson, because on the morning this file crossed a funding specialist's desk, every flag on it was individually forgettable. The domain was one character off from the real one. The tone was urgent, the way a vendor chasing a late payment often is. The amount matched the invoice to the cent. None of that, by itself, proves fraud. What caught it was not noticing any one flag; it was a rule that nothing moves until someone calls the number already on file, applied without exception to a $1,207,523 wire that was otherwise ready to send.

The file below is a fictional sample package, run through Botminds' Equipment Finance Pre-Funding Review: Tamarack Earthworks LLC, financing two excavators, a wheel loader and a titled trailer from Basin Iron Equipment Co. The company, the people and the dollar figures are invented sample data; the fraud pattern they follow is real and published by federal regulators.

Monday morning: the next package in the queue

At the top of Tessa Morrow's queue that Monday was Tamarack Earthworks, deal EF-26-04417: sixteen of sixteen documents in since Friday at 4:40 pm, not yet checked. One row below it sat Granger Paving, a different lessee buying from the same vendor, already held for a reason the queue did not yet explain. Ten packages were waiting that morning, worth $4.62 million combined, ranked by risk and then by how long the vendor had been waiting to be paid. Nothing about Tamarack's position in the queue suggested urgency beyond the ordinary.

One click: four machines traced, three breaks found

Tessa pressed "Trace the serial numbers." Each of the four machines' serials started at its delivery plate photo and ran forward through the vendor invoice, the equipment schedule, the delivery and acceptance certificate, the title or certificate of origin, the insurance certificate and the UCC-1 — six documents a serial has to agree with, on top of the plate itself. Three threads snapped: a transposed digit on the equipment schedule, an insurance certificate scheduling the wrong trailer, and a UCC-1 filed in the wrong state. None of the three touched the vendor's payment instructions, and none of them was the reason this file is worth telling.

The email from basinironequip.co

The fourth break was in the vendor payment guard's queue, not the equipment matcher's. On 7 October, an email had arrived appearing to come from Basin Iron Equipment Co., the vendor on all four machines, asking that the invoice's remit-to account be updated before the wire went out — "immediately," the email said, because the old account "will be returned." The sender's domain was basinironequip.co. Basin Iron's real domain, the one on every prior invoice and on its signed vendor agreement, is basinironequipment.com.

Two details made the registration date decisive rather than merely suspicious. First, a domain registered eight days before it was used to request a seven-figure bank change has almost no legitimate history to explain why a real vendor would suddenly be emailing from it. Second, Basin Iron's account on file, ending 3197, had taken 41 payments since 2021 — a payment history long enough that a vendor genuinely changing banks would ordinarily say so by phone first, not by an urgent, one-line email the week before a large invoice was due.

What FinCEN calls "Scenario 3": the supplier-impersonation playbook

The pattern is not new, and it is not specific to equipment finance. The Financial Crimes Enforcement Network's 2016 advisory on business email compromise names it directly: "Scenario 3 – Criminal Impersonates a Supplier: A criminal impersonates one of Company C's suppliers to e-mail and inform Company C that future invoice payments should be sent to a new account number and location" (FinCEN Advisory FIN-2016-A003). That is, almost word for word, the email Basin Iron's name was attached to. The advisory's scenario does not describe a sophisticated technical attack; the lie is entirely in the email's content, which is exactly why it defeats people who are checking documents rather than checking domains.

The vendor screen: the account on file, the account in the email

41 payments since 2021: why payment history is the tell

A vendor's payment history is the quiet fact that turns a plausible email into an obvious one. A brand-new vendor with no payment history offers nothing to compare a bank-change request against — the "new" account is simply the account, and there is no pattern it contradicts. Basin Iron is the opposite case: forty-one payments to the same account over five years is a pattern specific enough that any deviation from it is itself evidence, regardless of how the request arrives. Equipment Finance Pre-Funding Review's vendor payment guard holds every package on any difference between the invoice's remit-to instructions and the account on file, the change history and the sender's domain — not only the ones that look, on a fast read, like fraud.

The call-back: three questions, one phone number already on file

The rule that actually stopped the wire has nothing to do with spotting the domain. It is simpler and does not depend on anyone noticing anything: a changed bank account clears only after a call-back to the number already on file — never a number in the email itself — with the answer recorded against the deal. Tessa called (208) 555-0143, the number on Basin Iron's signed vendor agreement, not (208) 555-0199, the number printed in the fraudulent email. Basin Iron's own accounts team answered and confirmed, in under two minutes, that no change had been requested and the email was not theirs.

The rule is deliberately indifferent to how convincing the email is. A funding specialist does not have to win an argument with a well-forged message; she only has to dial a number that was on file before the email arrived. That is what makes the rule durable against a better-written fraud attempt next time: its strength comes from where the phone number is stored, not from anyone's skill at reading tone.

Why the same fraud hit a second deal that same morning

Granger Paving's held package, sitting one row above Tamarack's in the queue, turned out to be the same story told twice. The same vendor, the same look-alike domain, and — because Basin Iron supplies more than one of the lender's borrowers — a second invoice that the fraud attempt could just as easily have redirected. A hold on one deal that traces to a vendor's identity, rather than to anything specific about the borrower, is worth checking against every other open package from the same vendor before either one is released; Equipment Finance Pre-Funding Review keeps Granger Paving's deal held on the same email until its own call-back is recorded, rather than treating the two packages as unrelated because they belong to different lessees.

If the wire had already gone: the first 24 hours

The call-back worked because it came before the money moved. A desk should also know what it would have done if it had not. FinCEN's advisory is direct about the stakes: these transfers "are often irrevocable, which renders financial institutions and their customers unable to cancel payment or recall the funds". Recovery is possible but time-bound; FinCEN says it, the FBI and the Secret Service have recovered "hundreds of millions of dollars", and that it "has had greater success in recovering funds when victims or financial institutions report BEC-unauthorized wire transfers to law enforcement within 24 hours" (FinCEN Advisory FIN-2016-A003).

The advisory names the channels: a complaint to the FBI's Internet Crime Complaint Center at ic3.gov, or the nearest Secret Service field office, alongside an immediate call to the sending bank to attempt a recall. For a bank, it adds that "contacting law enforcement for fund recovery assistance does not relieve a financial institution from its Suspicious Activity Report (SAR) filing obligations". A funding desk's written procedure should therefore say who makes those calls, from which numbers, within the first hour, so the 24-hour window is not spent working out who is responsible.

The $3.1 billion backdrop this one email sits inside

One held wire is a success story at the scale of a single file; at the scale of the industry, it is a single save inside a much larger number. FinCEN's advisory puts the scope in dollars: "Since 2013, there have been approximately 22,000 reported cases of BEC and EAC fraud involving $3.1 billion" (FinCEN Advisory FIN-2016-A003), a figure the advisory takes from the FBI's Internet Crime Complaint Center, so it counts only the cases someone reported.

The number did not stand still. Three years later FinCEN reported that BEC reports to it had "climbed from averaging just under 500 reports per month (averaging $110 million monthly in total attempted BEC thefts) in 2016 to over 1,100 monthly reports (averaging over $300 million monthly in total attempted BEC thefts) in 2018," and it named the sector most often targeted: "manufacturing and construction (25% of reported BEC cases)" (FinCEN Advisory FIN-2019-A005). An earthworks contractor buying an excavator through a dealer sits inside that sector, and so does the dealer. The same advisory found that "fraudulent vendor and client invoices are generally affiliated with larger BEC transaction amounts than even the CEO fraud scheme" — the shape of this file, where the request rode on a real invoice for a real seven-figure amount.

The FBI's most recent annual count shows the plateau since. Its Internet Crime Complaint Center logged 21,442 business-email-compromise complaints in 2024 with $2,770,151,146 in reported losses, against $2,946,830,270 in 2023 and $2,742,354,049 in 2022 (FBI, 2024 Internet Crime Report). Roughly $2.8 billion a year, reported by victims alone, is the pool a single held wire is drawn from — and no public source isolates the equipment-finance share of it.

Set against a backdrop measured in billions, the file's own numbers look almost small — one email, one phone call, one wire that went to the right account instead of the wrong one. That is the honest shape of fraud prevention at the desk level: it rarely feels dramatic while it is working, because working means nothing happens. Tamarack Earthworks still had its UCC-1 to refile in the right state before its 20-day purchase-money window closed, a separate thread covered in where do you file the UCC-1, because the lessee was formed in Delaware and UCC §9-307(e) locates a registered organization in its state of organization.

The call-back rule, the look-alike-domain hold and the vendor payment guard's limits are all settings in Equipment Finance Pre-Funding Review, not hard-coded behavior — a funder can require a call-back on every change, as this one did, or loosen it, though the agents never change a vendor's bank account on their own regardless of the setting. How the other three exceptions on this file — the transposed serial, the mis-scheduled trailer and the wrong-state lien — were caught and fixed is told from the equipment side. To see the full desk and its four seats, start from the four people who carry a funding package.

Questions people ask

How do you catch business email compromise before a wire goes out?

By refusing to let a bank-change request, however it arrives, change where money goes without an independent check: a call to the phone number already on file, never a number supplied by the request itself, with the vendor's answer recorded. A look-alike domain or an urgent tone is a useful warning sign, but the call-back is what actually stops the wire, because it does not depend on recognizing the forgery.

What are the red flags of a look-alike domain in vendor fraud?

A domain that differs from the vendor's real one by a small, easy-to-miss change — a dropped letter, a swapped top-level domain, an added hyphen — registered recently relative to when it is used, and requesting an urgent change to payment instructions. Any one of these alone can have an innocent explanation; together, especially the recent registration date, they rarely do.

What should a company do if a vendor email asks to change payment information?

Treat the request as unverified until it is confirmed through a channel the request did not supply. Call the vendor at the number already on file before the email arrived, not any number printed in the email, and hold the payment until that call confirms the change.

How do funders verify a vendor's payment changes?

By comparing the new instructions against the account on file, the vendor's payment and change history, and the sender's domain, and by requiring a recorded call-back to a number already on file before the change is used. Equipment Finance Pre-Funding Review's vendor payment guard runs that comparison on every package and holds the deal on any mismatch, whether or not the request looks urgent.

What is business email compromise?

A fraud in which a criminal impersonates a trusted party by email — a vendor, an executive, an attorney — to redirect a legitimate payment to an account the fraudster controls. FinCEN's 2016 advisory cited roughly 22,000 reported cases totaling $3.1 billion from 2013, a figure from complaints to the FBI's Internet Crime Complaint Center rather than a full accounting of every incident.

Is business email compromise rising in equipment finance specifically?

No public government source counts it for equipment finance alone. The nearest figures: FinCEN's 2019 advisory found manufacturing and construction the most targeted sector, at 25% of reported cases, after monthly BEC reports more than doubled from 2016 to 2018. The FBI's count has since held between 21,400 and 21,900 complaints and $2.7 billion to $2.9 billion in reported losses a year from 2022 to 2024 — steady, not falling.