The $3 Billion Email: Protecting Your Small Business From Payment Scams and Ransomware

Picture a Tuesday afternoon. Your bookkeeper gets an email from your longtime supplier: "We've changed banks. Please send this month's payment to our new account." Same logo. Same signature. Same tone.

The money goes out. The supplier never sent that email.

That's business email compromise. And it's one of the most expensive crimes in America.

The numbers

The FBI's Internet Crime Complaint Center released its 2025 report, and the business threats are sobering (FBI IC3 2025 Annual Report):

• Business email compromise (BEC): 24,768 complaints and more than $3 billion in reported losses, second only to investment fraud (CyberScoop).
• Ransomware: 3,611 complaints with more than $32 million in reported losses, up from about $12 million in 2024 (The Record).
• Phishing was the most commonly reported cybercrime, with more than 191,000 reports (The Register).

That ransomware loss number looks small next to BEC, but the FBI is clear that it's artificially low: it doesn't include lost business, time, wages, files, equipment or recovery costs, and many victims don't report a loss at all (FBI IC3). For a small business, a week offline can be the whole year's margin.

And AI is part of it now. Businesses reported more than $30 million in BEC losses with a confirmed AI connection in 2025, per a summary of the report by McDonald Hopkins. AI makes scam emails sound more natural, and can clone voices for "it's me, the CEO, I need this wire today" calls.

How these attacks actually work

Here's what I want small business owners to understand: most of these attacks aren't sophisticated hacking. They're social engineering plus a stolen password.

Business email compromise usually goes like this:

1. A criminal gets into a real email account, often a vendor's or yours, through a phishing link or a reused password. Or they register a lookalike domain, like acme-supp1y.com instead of acme-supply.com.
2. They read your email quietly for days or weeks, learning who pays whom, when and how.
3. At the perfect moment, they send a payment change request that fits right into a real conversation.

Ransomware usually goes like this:

1. Someone gets in: a phishing email, a stolen password for remote access, or an unpatched system facing the internet.
2. They move around your network, find your important files and your backups.
3. They encrypt everything, and increasingly steal a copy too, then demand payment to unlock it and not leak it.

Notice what both have in common: a password and a person. That's good news, because it means simple habits work.

The five-habit checklist

This is the list I'd tape to every small office wall. None of it requires a big budget.

1. Turn on multi-factor authentication everywhere

Multi-factor authentication (MFA) means a password alone isn't enough to get in. Start with email, banking, payroll and anything with remote access. If an app offers passkeys, use them. Passkeys use cryptography tied to your device, so there's no password for a phishing page to steal. Text-message codes are better than nothing, but an authenticator app or passkey is stronger.

The federal cybersecurity agency CISA puts MFA among its core four steps for everyone in its Secure Our World program, along with strong passwords, updates and recognizing phishing.

2. Verify every payment change by phone

Make this a rule with no exceptions: any request to change bank details, or any unusual or urgent payment request, gets verified by calling a number you already have on file. Not the number in the email. Not a number from the signature. The one in your records.

Write it into your process. Tell your vendors you do it. Real vendors will appreciate it.

3. Update everything, automatically

Turn on automatic updates for computers, phones, browsers and your router. Many ransomware attacks exploit known weaknesses that already have fixes. Old equipment that no longer gets updates should be replaced or disconnected.

4. Back up the right way

Use the 3-2-1 rule: three copies of important data, on two different kinds of storage, with one copy offline or offsite where ransomware can't reach it. A backup that's always connected to your network can get encrypted along with everything else.

Then, and this is the step everyone skips, test a restore. Once a quarter, pick a file and bring it back from backup. A backup you've never restored is a hope, not a plan.

5. Have a one-page incident plan

Write down, on paper:

• Who to call first: your bank, your IT help, your insurance carrier.
• How to disconnect affected computers from the network.
• Where your backups are and who can restore them.
• To report to the FBI at ic3.gov.

If money was sent by wire, call your bank immediately. Speed matters for any chance of stopping the transfer.

Train people like adults, not suspects

The weakest link isn't your people. It's the lack of a process that makes it safe to pause. Teach your team three red flags:

• Urgency: "This must go out today."
• Secrecy or authority: "Don't loop anyone in, I'm in a meeting."
• Change: new bank, new email address, new process.

And make it clear that nobody gets in trouble for stopping to verify. Ever.

Don't forget the data you don't need

Every customer file you keep is something to protect. If you don't need it, delete it. The smaller your data footprint, the smaller your blast radius. That's part of getting your data house in order, which I wrote about in Get Your Data House in Order Before You Buy AI. And if your team uses AI tools, put guardrails on what data goes into them with a one-page AI policy.

Pour me another: Has your business ever gotten a fake payment request? How did you catch it? Tell me through the contact form.

Sip slow, stay curious.D