Business email compromise (BEC) is a scam where criminals impersonate a boss, supplier or colleague by email to trick staff into sending money or sensitive data. The FBI’s Internet Crime Complaint Center recorded about $2.9 billion in reported BEC losses in 2023, more than any other online crime it tracks. This guide shows how BEC works, the warning signs, and the simple controls that stop it.
Key takeaways
- BEC usually involves no malware, just a convincing email and a request to pay or change bank details.
- The strongest control is a rule that every payment change is confirmed by phone on a known number.
- Email authentication (SPF, DKIM and DMARC) makes it harder to spoof your domain.
- If you pay a fraudster, contact your bank immediately: speed improves the chance of recovery.
What is business email compromise?
Business email compromise is a type of fraud in which an attacker sends or hijacks business email to redirect payments or steal information. The attacker either spoofs a trusted address, registers a look-alike domain, or takes over a real mailbox with a stolen password.
The FBI IC3 2023 Internet Crime Report lists BEC losses of about $2.9 billion from more than 21,000 complaints. Many cases are never reported.
What are the main types of BEC scams?
The five most common business email compromise scams are fake invoices, CEO fraud, account takeover, payroll diversion and data theft. Each one has a specific control that stops it.
| BEC type | What happens | Control that stops it |
|---|---|---|
| Fake invoice | A “supplier” sends new bank details | Call the supplier on a known number before changing details |
| CEO fraud | The “CEO” asks for an urgent transfer or gift cards | Two-person approval for payments; no exceptions for urgency |
| Account takeover | A real staff mailbox is hacked and used to request payments | MFA on all email accounts; alerts on new forwarding rules |
| Payroll diversion | An “employee” asks HR to change their bank account | Verify changes in person or through the HR system |
| Data theft | A request for staff tax forms or customer data | Confirm any bulk data request verbally |
How can you spot a business email compromise attempt?
You can spot most BEC attempts by four signs: a change of bank details, unusual urgency or secrecy, a sender address that is slightly different, and a request that skips the normal approval process.
- Look-alike domains, such as rn in place of m, or an extra word in the domain.
- Requests sent late on a Friday or while the boss is travelling.
- Instructions not to call or tell anyone.
- Reply-to addresses that differ from the sender.
Criminals now add AI-generated voice and video to these scams. The $25 million deepfake CFO case shows how far BEC has evolved.
How do you stop business email compromise?
You stop business email compromise with a payment-verification rule, multifactor authentication on email, email authentication on your domain, and staff training. The verification rule matters most because it works even when the email looks perfect.
Payment-verification policy you can copy:
- Any new payee or change of bank details is confirmed by a phone call to a number already on file, never one from the email.
- Payments above an agreed amount need approval from two people.
- Urgent or confidential payment requests are always verified, whoever they appear to come from.
- Staff are thanked, never blamed, for checking.
Then set up social engineering awareness training and the email authentication records covered in our DMARC guide.
What should you do if you paid a BEC scammer?
If you paid a business email compromise scammer, call your bank immediately and ask it to recall or freeze the payment, then report the crime. Banks can sometimes stop transfers if they act within hours.
In the US, report to the FBI Internet Crime Complaint Center. Then secure the mailbox that may have been compromised, check for forwarding rules, and follow your incident response plan.
Frequently asked questions
Is business email compromise the same as phishing?
BEC is a type of phishing focused on money or business data. Classic phishing often tries to steal passwords with a link, while BEC usually contains no link or attachment, just a believable request from someone the victim trusts.
Does cyber insurance cover BEC losses?
Some policies cover social engineering fraud, often with a lower limit and conditions such as verifying payment changes. Check the policy wording, because many insurers exclude losses where staff skipped required verification steps.
Can small businesses be targeted by BEC?
Yes. Small businesses are frequent targets because they often lack payment approval processes. Criminals research suppliers and staff on LinkedIn and company websites to make the emails convincing.
How quickly should I report a BEC payment?
Immediately. Call your bank first, then report to the police or the FBI IC3. The FBI’s Recovery Asset Team can sometimes freeze funds, but only if the report arrives quickly.
Next steps
Business email compromise succeeds because a single believable email can move real money. A phone-verification rule for payment changes stops most attempts, and MFA plus email authentication stop the rest. Put the policy above in writing this week, and check your other defences with the free Cybersecurity Readiness Assessment.
