AGML Security
Resources

Before you pay an emailed invoice: a two minute check

Most small offices pay bills the same way. An invoice arrives by email, someone checks that it looks right, and the money goes out. Scammers know this, and they are good at making a fake bill look right.

What the scam looks like

An email arrives that seems to come from someone you know: a vendor, a contractor, your boss, even your town office. It might be a new invoice, or a note saying the company's bank details have changed. It asks you to pay soon, often by wire or ACH transfer. Both move money straight from your bank account to another one, and once it lands it is very hard to get back.

The industry name for this is business email compromise. It means a criminal pretends to be someone your business trusts so that you send them money. Sometimes they fake the sender's address. Sometimes they have broken into the real person's mailbox, so the email truly comes from them.

It is happening in Vermont

In 2025, Vermont businesses sent 176 scam reports to the Vermont Attorney General's Consumer Assistance Program. The largest group, 31 percent, came from scammers posing by email as employees or familiar business contacts. They often aim at bookkeepers and office managers, asking them to redirect a payment, change direct deposit details or write a check.

On October 14, 2026, the town of Waterbury warned people applying for permits about fake invoice emails. The messages looked very professional, used real project details and asked for a wire or ACH payment. One person applying for a shed permit got a bill for $3,750.

The two minute check

Before any money moves because of an email, ask five questions.

  1. Did I expect this? A surprise invoice or a surprise change of bank details is the biggest warning sign.
  2. Is someone rushing me? "Pay today", "your account will be closed" and "keep this between us" are pressure, not business.
  3. Is the way to pay unusual? A vendor that always took checks now wants a wire. An office that takes credit cards now wants ACH.
  4. Does the sender's address match exactly? Read the full address, including everything after the @ sign, not just the name shown. A small misspelling or an unfamiliar ending is a red flag. A hacked mailbox will pass this test, which is why question 5 matters most.
  5. Did I call to confirm? Call the person or office on a number you already have, or one from their official website. Never use a number from the email itself, because it may ring the scammer.

A call back catches the fake even when everything else looks perfect.

Make it a rule, not a judgment call

Write one sentence down and share it with everyone who pays bills: "We confirm every new bank detail and every unexpected invoice by phone, on a number we already have, before we pay." It takes two minutes and costs nothing. Nobody has to decide on the spot whether an email looks real, and nobody gets blamed for slowing a payment down.

The Vermont Attorney General gives businesses the same advice: confirm payment changes by calling a known number, teach all your staff about these scams, and check invoices carefully before you pay.

If money already went out

Call your bank right away and ask what it can do to stop or recall the payment. The sooner you call, the better. Then report it to the FBI at ic3.gov and to the Vermont Attorney General's Consumer Assistance Program at 800 649 2424.

Where we fit

Many fake invoices start with someone breaking into an email account. Two step sign in (a second check after your password, like a code from an app on your phone) and a password manager make that much harder, and both are part of our password management setup. If you would like to talk through how your office handles payments, call us at 802 399 7979. You talk to the person who does the work.

Sources