The same type of business email scam that cost the City of Mobile $14.7 million earlier this month is now targeting businesses and municipalities across Alabama, prompting the Better Business Bureau to urge organizations to review their payment procedures.

The BBB of Central and South Alabama issued the warning Oct. 28 in a news release after another local business nearly lost more than $750,000 in a business email compromise scam. With multiple Alabama businesses now targeted, the organization is urging businesses and municipalities to take steps to protect their finances and verify payment requests.

Business email compromise, or BEC, occurs when criminals impersonate someone a business already trusts, such as a vendor or company executive, to convince an employee to send money to an account controlled by the scammers.

Unlike many cyberattacks, the scheme does not require a virus, malicious link or ransomware, the release said. Instead, criminals rely on research, patience and enough convincing details to deceive an employee. Often, the scam involves changing payment information without anyone independently verifying the request.

The FBI's Internet Crime Complaint Center reported that BEC was the second-costliest scam reported in 2025, generating 24,768 complaints and more than $3 billion in losses.

“Our goal is simple: we don’t want another Alabama business to be next,” Evey Owen, vice president at the BBB of Central and South Alabama, said in the release. “Before you pay any invoice that comes with payment changes, you should stop, pick up the phone and call the vendor at a number you already know. That one phone call can stop this scam in its tracks.”

The BBB recommends several precautions businesses can take to reduce their risk of becoming victims:

• Verify payment changes by phone. Call vendors using a phone number already on file rather than a number included in an email requesting payment changes.
• Establish a culture of verification. Regularly train employees on payment approval procedures and emerging scams.
• Require multiple approvals. Implement a process that requires more than one person to authorize large payments.

The first step is to contact the bank and request that the funds be recalled. Because time is critical, businesses should make the call as soon as they discover the fraud.

Victims should also file a complaint with the FBI through its Internet Crime Complaint Center at www.IC3.gov, regardless of the amount lost. Reports should include complete transaction details.

The BBB also recommends reporting the incident to local police, particularly when money has been lost, as a police report may be needed by the bank.

Finally, businesses should report the incident through the BBB Scam Tracker to help the organization alert others about potential threats.