Business Email Compromise: How a Lender Reads the Loss

The older protections against payment fraud mostly deal with the payment the customer did not make: a stolen card, a hijacked login. Business email compromise produces the opposite case. The business's own staff key the payment, its own approver releases it, and its bank carries out exactly what it was told. By the time anyone notices, the money has usually been moved on from the receiving account, often within hours, and what the receiving bank can freeze is whatever is still there.

The second cost is less obvious. A debt is paid by paying the creditor or someone the creditor authorised, and a criminal is neither, so in the ordinary case the invoice is still owed. A contract term, or the supplier's own conduct, can sometimes shift part of the loss, but that is a dispute, not a refund. A business that loses US$300,000 this way has to find US$300,000 again to settle the real account, which is why a lender reads the loss as cash out of working capital rather than as a line in the profit and loss account.

Reimbursement rules are narrower than many owners assume. The UK's mandatory scheme for authorised push payment scams, in force since 7 October 2024, covers individuals, micro-enterprises and small charities, up to a capped amount per claim. Australia's Scams Prevention Framework Act 2025 puts duties on banks towards individuals and small businesses (fewer than 100 employees and under a turnover threshold), most of them starting on 31 March 2027, with redress through an external dispute scheme rather than automatic refunds. For payments from 30 November 2025, New Zealand's banks compensate eligible customers who were consumers under the Consumer Guarantees Act, where a bank involved fell short of the industry's scam commitments. A mid-market company is outside all three.

The moving parts recur. The criminal gains access to a mailbox, or registers an address one character from the real one, and reads enough to know who pays whom and when. Then a message arrives at the right moment: a supplier announcing new bank details on genuine-looking letterhead, a director asking for an urgent transfer, or a staff member asking payroll to change their salary account.

Each route depends on the business accepting a change to where money goes through a channel that may be compromised, and the controls that work attack that point. A change of bank details is confirmed by calling the supplier on a number already on file. A second person approves any change to a payee record and the first payment to the new account. The payment run shows the approver which payees have changed, not only names and amounts. Discovery is usually late: the real supplier chases weeks after the first diverted payment.

A precast concrete maker, constructed for this page like every figure in it, turns over US$38m and earns EBITDA of US$4.2m. Its bank provides an overdraft with a US$3.0m limit, which peaks at about US$1.6m drawn each autumn. The mailbox of its cement supplier is taken over. An email on the supplier's letterhead announces new bank details; the payables clerk updates the supplier record; the finance manager approves two monthly payment runs that show the supplier's name and the usual amounts. In week six the real supplier asks where its money is.

The business has a cyber policy with a social-engineering extension limited to US$100,000. Until the recovery is virtually certain, usually once the insurer accepts the claim, IAS 37 and its New Zealand and Australian equivalents, and FRS 102 in the UK, treat it as a contingent asset that stays off the balance sheet, so the lender reads the loss as US$520,000 and the insurance as a possible US$100,000 later. EBITDA for the year falls to US$3.68m as reported. If the facility agreement lets the borrower add back one-off losses, the covenant figure may stay at US$4.2m, but the cash is gone either way, and more than a third of the peak headroom with it.

The nearest neighbour is the payment the customer did not make: a criminal logs into the business's online banking with stolen credentials and sends the money directly. That is an unauthorised transaction, and different rules apply; depending on the market, the customer's size, the account terms and the care the customer took, more of that loss can fall on the bank. In business email compromise the instruction came from the customer, so the loss starts with the customer.

It is also distinct from what Confirmation of Payee can catch. A name check flags a payment to an account whose holder's name does not match the payee, which is the classic diversion. It cannot help where the criminal's account is held in a name that matches the supplier's, and every result is a warning the payer can override, not a block. The UK has run the service for years; New Zealand banks began offering it on personal banking from late 2024, with business platforms following bank by bank, and Australian banks from July 2025.

DEFINED IN ONE PARAGRAPH → · CONFIRMATION OF PAYEE → · THE FOUR-EYES PRINCIPLE →

A loss of this kind rarely decides a file by its size alone. It decides it through three readings. Liquidity: whether the facility absorbs the cash at the worst point of the year, which is a liquidity headroom test rather than a leverage one. Earnings: whether the lender accepts the loss as a one-off add-back, which turns on whether the control has been fixed. Management: which control failed, whether the auditor's letter had already flagged it, and how fast the business told its bank.

The same fraud can reach the lender's own book. Where a bank finances receivables, a customer who pays a criminal instead of the borrower's collection account leaves an invoice unpaid and possibly disputed. And a bank emailed a request to pay a drawdown to a new account faces the same attack, which is why lenders call back on any change to where loan money goes.

THE BANK IN YOUR AUDIT FILE → · WORKING CAPITAL REQUESTS → · THE AML AND FINANCIAL CRIME PAPER →