You approved the PDF. Nobody verified the bank account

Business email compromise (BEC) does not look like the fraud stories that make the news. There is no ransomware note. There is no dramatic breach. There is a routine email, often from a vendor a company has paid for years, asking finance to update the bank details on file. The finance team updates them. The next invoice is paid on time. The money lands in an account the attacker controls.

The FBI Internet Crime Complaint Center has tracked BEC as the single most expensive category of reported cybercrime for most of the last decade. The losses are not concentrated at Fortune 500 companies. They are spread across law firms, real estate brokerages, small manufacturers, non-profits, and municipal governments, anyone who pays a vendor by wire or ACH.

Why the current process is exploitable

The mechanism that BEC exploits is not technical. It is procedural. In most companies, bank details for a new or existing vendor travel through email in one of three ways: a PDF attachment, a screenshot, or plain text pasted into the body of a message. None of these formats carry any signal about who created them or whether they have been altered.

• PDFs of voided checks are trivially editable in any modern PDF tool.
• Screenshots of bank portals can be reconstructed pixel-for-pixel with a template.
• Plain-text account and routing numbers are simply strings, no provenance, no signature, no verification.
• The recipient has no reliable way to confirm the sender is who they claim to be, or that the file has not been modified in transit.

The playbook attackers use

A typical BEC targeting an accounts-payable team follows a predictable arc. The attacker identifies a real vendor relationship, often from a LinkedIn post, a press release, or a leaked email thread. They register a look-alike domain, or they compromise the vendor actual mailbox and reply from the real thread. They wait for a real invoice to be issued, then follow up with an urgent request to redirect payment due to a banking change.

The moment bank details travel through email as an attachment, the receiving company has already lost the ability to prove what it received, when, and from whom.

Coffr research

What actually reduces BEC risk

Callback verification, calling the vendor at a known number, not the number in the email signature, remains the single most effective control. It also does not scale. Companies paying dozens of vendors a week cannot make a phone call for every wire, and the callback itself can be intercepted if the vendor phone system is compromised.

The structural fix is to remove bank details from email entirely. If the routing and account number never travel through an inbox, the attachment cannot be edited and the message cannot be spoofed. That requires a shared, verifiable channel with cryptographic proof of who sent what, when, the piece the current stack does not have.