Business Email Compromise vs Invoice Fraud: Related, Not the Same

When a company loses money to a fake payment request, the post-mortem usually files it under "business email compromise" or "invoice fraud" — often interchangeably. The two overlap, and one frequently rides on the other, but they're different attacks on different weaknesses. Defending against one doesn't automatically defend against the other.

The distinction that matters

Business email compromise (BEC) is an attack on identity and trust in communication. Someone convinces your staff they're the CEO, a vendor, or a lawyer — via a compromised mailbox or a lookalike domain — and instructs a payment. The channel is the weapon; there may be no forged document at all, just a persuasive email.

Invoice fraud is an attack on your payables process. A fraudulent or altered invoice enters the pipeline and gets paid like a real one. The document is the weapon; email is merely how it usually arrives.

They meet in the middle constantly — the most damaging pattern in B2B payments is a BEC-compromised vendor mailbox sending a real-looking invoice with changed bank details. Identity attack delivers document attack.

Side by side

	Business email compromise	Invoice fraud
Attacks	Trust in who's talking	Trust in what arrived
Weapon	Compromised or spoofed email	Forged or altered document
Classic move	"Urgent wire, confidential — CEO"	Familiar invoice, new bank account
Primary defense	Email security + out-of-band verification	Document forensics + payables controls
Tell-tale	Domain a letter off; tone/urgency shifts	Edited PDF; font swaps; broken math
Backstop that works	Call-back on known number	Verify banking changes independently

Why the distinction changes your defenses

Teams that file everything under "email problem" buy email security and stop. That's half a defense. A forged invoice doesn't care how good your spam filter is if it arrives from a genuinely compromised vendor mailbox — the email is authentic; the attachment is the lie. Filters pass it; only examining the document itself catches the edited banking block, the substituted font, the modification timestamp two hours before sending.

Teams that only check documents miss the inverse: a pure BEC wire request with no attachment at all sails past document controls. That one dies to process — out-of-band confirmation of any new payment instruction, on a channel the attacker doesn't control.

The defenses compose cleanly precisely because the attacks differ:

1. Email layer — authentication (SPF/DKIM/DMARC), lookalike-domain monitoring, and a culture where urgency triggers suspicion rather than speed.
2. Document layer — every incoming invoice scanned for editing traces, metadata contradictions and arithmetic breaks; automatic routing to review when an invoice carries a banking change or crosses a threshold.
3. Process layer — banking changes verified via previously-known contacts, dual approval above limits, no exceptions for urgency. This layer backstops both attacks, which is why it's the one fraudsters work hardest to rush you past.

The uncomfortable takeaway

Both attacks succeed by being ordinary. The email reads like every other email; the invoice looks like every other invoice. Human vigilance fades exactly where these attacks live — the routine middle of a busy day. That's the argument for making the checks structural: machines don't get busy, and a scanner that inspects every payables document treats the five-hundredth invoice with the same suspicion as the first.

Frequently asked questions

Is invoice fraud a type of BEC?

They intersect rather than nest. Plenty of invoice fraud arrives without any email compromise (mailed, uploaded to portals, from fake vendors), and plenty of BEC involves no invoice. The overlap — compromised vendor email delivering an altered invoice — is simply the most costly combination.

What's the single best defense against both?

Out-of-band verification of payment instructions: any new or changed banking detail gets confirmed through a channel you already had. It's low-tech, it's unglamorous, and it defeats the end-game of both attacks.

Can email filters catch invoice fraud?

They catch spoofed senders and known-bad infrastructure. They do not inspect whether an attached PDF was edited — an authentic mailbox sending a doctored invoice passes every email check. Document-level scanning covers that gap.

What should we do first with a small team?

Two moves, one afternoon: write down the call-back rule for banking changes and make it absolute; put automated document scanning on your invoice intake. Together they close the two doors these attacks actually use.