Wire fraud and fake invoices at wineries: how to stop payment-change scams

How the scam usually works

1. An attacker gets into a vendor's email, or yours, often through a phishing link or a reused password. Sometimes they simply register a look-alike domain one letter off.
2. They read along quietly until a real invoice or payment is due.
3. A message arrives that looks routine: "Our bank has changed, please use the new account for this and future payments." The invoice amount and details are correct, because they copied a real one.
4. The payment goes out, and the real vendor calls weeks later asking why they were not paid.

The FBI's Internet Crime Complaint Center reports business email compromise as one of the most costly kinds of cybercrime year after year.

Why wineries are a good target

• Many vendors and irregular, large payments during harvest and bottling.
• Small teams where the person approving payments is also running the tasting room.
• Shared or old email logins, sometimes without multi-factor authentication.
• Public information: who your distributor is, when you harvest, who runs your books.

The call-back rule

Write this down and give it to everyone who can move money:

• Any request to change bank or payment details gets a phone call to the vendor on a number you already had on file, not one from the email or invoice.
• Two people agree before a first payment to a new account.
• No exceptions for urgency. Urgency is the tell.

It costs a few minutes and stops the most common version of the scam.

Tighten the accounts behind the money

• Multi-factor authentication on email, banking, payroll, the wine club platform and the online store.
• Remove old staff and seasonal workers' access when they leave.
• Check email for forwarding rules you did not create; attackers add them to read along.
• Ask your bank about payment alerts and positive pay or similar controls.

See business email compromise prevention and the cybersecurity guide for wineries and ag.

If money already went out

1. Call your bank's fraud line immediately and ask them to recall the transfer. Speed matters a great deal.
2. File a report at ic3.gov with the transaction details.
3. Change the email password, turn on multi-factor authentication, and check for forwarding rules.
4. Tell the real vendor, and talk to your insurer and attorney about any notification duties.

This is general information, not legal or financial advice.