The most expensive cyber fraud most businesses face isn't a sophisticated hack. It's a message, from what looks like a genuine email address or a familiar WhatsApp contact, saying a bank account has changed and payment should go to the new one instead. No malware, no breach, just a convincing message and a moment where nobody double-checked.
This is Business Email Compromise, or BEC, and Nigeria has an unusually direct relationship with it, both as a place where businesses get targeted and, historically, as a documented origin point for the actors running these schemes.
Why this specific scam works so well
BEC doesn't need to break into anything. It works by exploiting a completely normal business behaviour: when a supplier, client, or partner says their bank details have changed, most people update their records and move on, because that's genuinely how business sometimes works. The scam simply inserts itself into that exact, ordinary moment.
Security researchers have specifically tracked Nigeria-linked BEC activity for years, at one point identifying a Nigerian actor group's attempted attacks against business targets climbing into the tens of thousands per month. This isn't a hypothetical risk from somewhere else. It's a documented, active fraud pattern with a real footprint in Nigeria's own business environment.
The pattern, almost every time
- A message arrives claiming to be from someone you already do business with, a supplier, a client, sometimes even someone inside your own company impersonating a director or finance lead.
- It creates urgency. "The transfer needs to go out today," "I'm travelling and can't call," "This is time-sensitive." Urgency is doing the work that a careful second look would otherwise catch.
- It asks for a payment, or a change to payment details, that deviates from the normal process, a new account number, a request to use WhatsApp instead of the usual channel, an unusual amount.
- Once the money moves, it's gone. Bank transfers in Nigeria, like most places, are difficult or impossible to reverse once received and withdrawn, which is exactly why this scam targets the payment step rather than trying to steal from an account directly.
Nobody falls for this because they're careless. They fall for it because the message looks exactly like the ordinary, slightly-annoying admin request they get several times a month, and one of those requests, eventually, isn't real.
The one habit that stops almost all of it
Verify any change to payment details through a second, independent channel, before you pay, every single time, with no exceptions for urgency.
That means: if an email says the bank account changed, call the person on a number you already had before the email arrived, not a number provided in the message itself. If a WhatsApp message from "your supplier" asks for a different account, call them or message through a separate, previously-established channel to confirm. The scam depends entirely on you not doing this one extra step, and it collapses completely the moment you do.
Specific to how you deal with us
We handle registrations and filings that involve real payments, and we send bank details, ours and, at points, government fee information, over WhatsApp and email as a normal part of how we work. That means our own clients are a plausible target for someone impersonating us to redirect a payment.
If anything about a payment instruction from "Awal Global Consults" ever looks even slightly different from what you'd expect, a different account name, an unfamiliar number, unusual urgency, contact us directly on a number or channel you already trust, not one provided in the suspicious message, before you send anything.
Building this into how your business actually operates
- Set a standing internal rule: no payment detail change is acted on without a phone call to a previously known number, regardless of who's asking or how urgent it sounds.
- Be specifically suspicious of urgency paired with a channel switch, for example, a request that suddenly wants to move from email to WhatsApp, or from a landline call to a message. Legitimate changes rarely need to happen this way.
- Brief anyone in your business who can authorise a payment, not just your finance person, since these scams often target whoever they can reach, including junior staff with less context to spot something off.
Can a bank reverse a transfer once it's discovered to be fraudulent?
Sometimes, if reported extremely quickly and the funds haven't been withdrawn yet, but this is far from guaranteed and depends heavily on timing. Prevention before the transfer is far more reliable than recovery after it.
What if the request comes from what looks exactly like a colleague's real email address?
Email addresses can be spoofed or a colleague's actual account can be compromised. A message looking authentic, including matching a real address, isn't proof of authenticity on its own, which is exactly why independent verification through a different channel matters even then.
Should we report an attempted BEC scam even if we didn't pay?
Yes. Reporting attempted fraud, whether or not money moved, helps build the pattern data that flags repeat offenders and protects other businesses being targeted with the same approach.
The habit is the whole defence
There's no software that fully protects a business from this, because the vulnerability isn't technical. It's the moment someone acts on a convincing message without confirming it independently. That one habit, verify before you pay, costs nothing and stops nearly every version of this scam that exists.
Need help with this?
Awal Global Consults never asks you to change payment details over a forwarded message — always confirm ours directly if anything about a payment instruction looks even slightly different.