The Wire Transfer That Looked Completely Normal

The Wire Transfer That Looked Completely Normal

In April 2025, a city government office in Oregon received an email from what looked like a familiar vendor. Nothing about it seemed unusual. It referenced an ongoing relationship, used a reasonable tone, and asked for a routine update to banking details ahead of an upcoming payment.

The office wired more than $6 million before anyone realized the vendor never sent that email. By the time the fraud was caught, the money was gone. The case became one of the examples cited in the FBI's 2025 Internet Crime Report.

That case is not an outlier. It is a fairly typical illustration of what happens when email spoofing succeeds. No network was breached. No malware was installed. Someone simply made an email look like it came from somewhere it didn't, and a normal business process did the rest.

This article explains what email spoofing actually is, why it's the mechanism behind most business email compromise (BEC) losses, and what genuinely stops it versus what only sounds like it does.

What Email Spoofing Actually Is

Email spoofing is the act of forging the "From" field of an email so it appears to come from a person or domain the recipient trusts, when it actually didn't. It is not the same as someone breaking into your inbox. Spoofing doesn't require access to any account at all.

The reason this works comes down to how email was originally built. The core protocol email still runs on, SMTP, was designed in the early 1980s with no built-in way to verify who actually sent a message. Anyone who can connect to a mail server can, technically, type whatever they want into the "From" line. It's roughly the same as writing someone else's return address on an envelope. The postal service delivers it anyway.

Modern email providers have layered protections on top of that original gap, which is why obvious spoofing attempts increasingly get caught. But those protections only work when they're configured correctly, and a large share of businesses still haven't set them up, or have set them up incompletely. That gap is where BEC lives.

How a Spoofed Email Turns Into a Six-Figure Loss

Email spoofing is the delivery mechanism. Business email compromise is what happens once the message lands. The FBI's 2025 Internet Crime Report recorded nearly 25,000 BEC complaints last year, with reported losses just above $3 billion, up from the year before. The average reported loss per complaint topped six figures, and the large majority of that money left through wire transfers or ACH payments, which is exactly why it's so hard to claw back once it's gone.

What makes BEC different from a generic phishing blast is precision. Attackers research a company before sending anything. They look at staff directories, press releases, LinkedIn profiles, and out-of-office replies to figure out who approves payments, who's traveling, and how the company's internal communication style actually sounds. Then they send one well-timed, well-written message instead of a thousand sloppy ones.

The most common versions small and mid-sized businesses run into are:

• Vendor impersonation: a spoofed email claiming to be a supplier, asking for an update to banking details ahead of an invoice payment. This is the pattern behind the Oregon case above.
• Executive impersonation: a spoofed email that appears to come from an owner or executive, asking someone in finance to process an urgent wire, often while the real executive is traveling or unreachable.
• Payroll diversion: a spoofed email posing as an employee, asking HR to redirect a paycheck to a new bank account.

None of these require breaking into anything. They rely on a spoofed sender address and a moment when someone acts on a request without a second look.

Why the Numbers Keep Climbing

A few things have combined to push BEC losses back above $3 billion after a brief dip the year before. Generative AI tools now let attackers draft a fluent, error-free, convincingly toned email in seconds, which used to be the easiest way to spot a scam. The FBI's 2025 report tied more than $30 million in BEC losses directly to AI-assisted tactics for the first time. We covered the broader shift toward AI-generated phishing and voice cloning in a separate deep dive on AI-powered phishing and deepfake fraud, since that's a distinct and fast-growing threat on its own.

The other factor is simpler: attackers have realized that spoofed vendor emails targeting real, ongoing business relationships work better than random cold outreach. A request that matches an existing invoice, an existing vendor name, and an existing payment schedule doesn't trigger the same skepticism a stranger's email would.

What Actually Stops Spoofing: SPF, DKIM, and DMARC

There are three DNS-based protocols that, together, close most of the technical gap that makes spoofing possible. They're worth understanding in plain terms, because vendors sometimes make them sound more complicated than they are.

Protocol	What it does
SPF (Sender Policy Framework)	Publishes a list of mail servers allowed to send email for your domain. Receiving servers check incoming mail against that list.
DKIM (DomainKeys Identified Mail)	Adds a cryptographic signature to outgoing mail, letting the receiving server confirm the message wasn't altered in transit.
DMARC (Domain-based Message Authentication, Reporting and Conformance)	Tells receiving servers what to do when a message fails SPF or DKIM: let it through, quarantine it, or reject it outright. It also sends you reports showing who's sending mail using your domain.

The part that trips most companies up is DMARC enforcement. Publishing a DMARC record in monitoring mode (p=none) is a reasonable first step, but it doesn't block anything on its own, it just collects reports. Businesses that stay in monitoring mode for years, which is common, are still fully exposed to spoofing the whole time. Moving to an enforced policy takes a deliberate, staged rollout, or you risk blocking your own legitimate marketing tools and services along with the spoofers.

CISA's email authentication guidance is a solid, vendor-neutral reference if you want the technical detail. And if you want the fuller walkthrough of how we approach SPF, DKIM, and DMARC rollouts, including the specific configuration mistakes we see most often, we wrote a separate guide on getting DMARC setup right.

One important limitation worth knowing: DMARC protects your own domain from being spoofed by others. It does not protect you from a spoofed vendor domain landing in your inbox, unless that vendor has also enforced DMARC. That's why authentication alone isn't a complete answer, and why the human and process layer below still matters even after your DNS records are perfect.

Beyond DNS Records: The Human Layer That Actually Catches BEC

Email authentication reduces how much spoofed mail reaches an inbox in the first place. It does not eliminate the risk from a compromised vendor account, a lookalike domain, or a well-crafted message that authenticates cleanly because it's coming from a real, hijacked account somewhere else. That's why the FTC's guidance for small businesses pairs technical controls with process controls, and why both matter.

What to put in place, starting now

• Verify any request to change banking or payment details through a second channel, a phone call to a known number, not a reply to the email itself.
• Separate who can initiate a payment from who can approve it, so no single spoofed email can move money on its own.
• Publish SPF and DKIM records for every service that sends mail on your domain's behalf, then move DMARC from monitoring to enforcement in stages.
• Enable multi-factor authentication on every email account, which closes the door on the account-takeover version of this attack.
• Train staff, especially anyone who touches payments, invoices, or payroll, to expect that a legitimate-looking email is not the same as a verified one.
• Build urgency into your suspicion, not out of it. Messages that push for speed and discretion are a hallmark of BEC, not a coincidence.

If You Think You've Already Received a Spoofed Email

Don't click anything in the message and don't reply to it. Forward it to your IT team or provider using a fresh email, not a reply, and let them verify the sender before anyone acts on it.

If a payment has already gone out and you suspect it went to a fraudulent account, contact your bank immediately and ask them to initiate a recall. Then file a report with the FBI's Internet Crime Complaint Center (IC3) as soon as possible. Speed genuinely matters here: IC3's data shows recovery is far more likely when a report is filed within the first 24 to 72 hours, before the funds move again.

Frequently Asked Questions

What is email spoofing in simple terms?

It's when someone forges the sender field on an email so it looks like it came from a trusted person or domain, even though it didn't. It doesn't require hacking into any account.

Is email spoofing the same as my account being hacked?

No. Spoofing forges the sender address on a message sent from somewhere else entirely. Account compromise means someone actually logged into a real inbox. Both can lead to BEC, but they require different fixes.

How does a spoofed email turn into a financial loss?

The spoofed message is just the delivery step. It becomes a loss when someone acts on it, typically by wiring money, changing payment details, or handing over sensitive information based on a request that looked legitimate.

Can SPF, DKIM, and DMARC completely stop spoofing?

They stop most attempts to spoof your own domain when DMARC is fully enforced. They don't protect against a spoofed or compromised vendor domain that hasn't set up the same protections, which is why process controls still matter.

How do I know if someone is spoofing my company's domain right now?

A DMARC record set to monitoring mode will send you reports showing every server sending mail using your domain, including ones you never authorized. Without a DMARC record in place, you typically only find out after a customer or partner reports a suspicious email.

What should I do if I receive an unexpected request to change payment or banking details?

Stop and verify it through a separate channel, ideally a phone call to a number you already have on file, not one listed in the email. Legitimate vendors and executives expect this kind of check now.

Where do I report a spoofed email or a suspected BEC attempt?

Report it to the FBI's Internet Crime Complaint Center and, if it involves a fraudulent wire, contact your bank immediately to request a recall. The FTC also accepts reports at ReportFraud.ftc.gov.