On October 8, 2026, a federal judge in Houston sentenced a 35-year-old man to 30 months in prison. His part in the scheme was moving the money. The scheme itself was an email.
A small utility trailer company in Mississippi received messages that appeared to come from its trailer supplier. The U.S. Attorney’s Office for the Southern District of Texas says the fraudsters “sent spoofed emails that appeared to come from known suppliers and creditors,” and the company paid the accounts it was told to pay. The wires totaled $927,080. About $359,000 of that passed through the defendant’s luxury car company as cashier’s checks before moving on. A co-defendant was sentenced to 32 months in March. The release does not mention the trailer company getting anything back.
How the email gets paid
Nothing was hacked at the trailer company. The email looked right because it usually does: it comes from the supplier’s real mailbox, taken over weeks earlier, or from a domain one letter away from the real one. It says what a real message would say. Here is the invoice. We have changed banks. Please update the details before the next payment. The person paying has no reason to doubt it and every reason to get it done.
Then the money moves through accounts opened for the purpose, and by the time anyone compares notes with the supplier it has left the country. Microsoft’s 2026 Digital Defense Report, published October 1, 2026, counted more than 46 million business contact impersonation attacks between July 2025 and June 2026. The number is not the point. The trailer company only needed one.
Two rules that cost nothing
A callback rule with no exceptions. Any change to where money goes, and any payment outside the usual pattern, is confirmed by phone to a number you held before the email arrived. Not the number in the signature. Not a reply. A call, to a person, every time, including when the request appears to come from the owner. The no-exceptions part is what makes it work; the scam depends on the one time it felt rude to check. Write it down, give it to whoever pays invoices, and tell your suppliers you do this so they expect the call. The same rule handles the phone version of the scam, which our guide to AI voice scams covers.
Email authentication on your own domain. The trailer company was the victim this time. Next time the supplier whose name is used could be you, with your clients wiring money to a stranger and your name on the fraud. SPF, DKIM, and DMARC are three DNS records that tell other mail servers to refuse mail pretending to come from your domain. Our guide to SPF, DKIM, and DMARC explains them, and our free external check shows in seconds whether your domain publishes them.
Neither rule involves buying anything.
What a well-run accounts payable process looks like
- A written callback rule for bank-detail changes and unusual payments, on a number held before the request, with no exception for seniority or urgency.
- A second approver on any payment above a threshold you set.
- Email authentication published on your domain, with DMARC enforcing rather than monitoring.
- Finance mailboxes behind phishing-resistant MFA, since the attacker’s first step is often reading your email for weeks. Our passkeys guide covers which kind holds up.
The question for this week
If an email arrived tomorrow saying a supplier had changed banks, what would the person who pays your invoices do before paying, and is that written anywhere?
If the honest answer is “probably pay it,” the fix is a rule and a phone call, not a product. The verification procedures and the email records are part of what we set up under our cybersecurity service, and a 30-minute call will tell you where your company stands.