What Is Business Email Compromise (BEC)?
Types, Examples, and Prevention Guide

What Is Business Email Compromise and Why Is It So Dangerous?

Business email compromise is a type of attack where criminals use email to pose as a trusted person. They trick employees into sending money, sharing login details, or handing over sensitive data. In fact, the FBI calls business email compromise bec one of the most costly forms of cybercrime in the world. Unlike mass spam, BEC is targeted. Attackers study their victims, learn how the company works, and then strike when the moment is right.

Moreover, what makes business email compromise so dangerous is that it skips past most tech defenses. There are no bad links to click. There are no malware files to scan. Instead, bec attacks rely on trust and urgency. The email looks real. The request sounds normal. However, the money or data goes straight to the attacker. As a result, even firms with strong firewalls and antivirus tools fall victim to this type of attack. In short, business email compromise targets people, not software. And people are much harder to patch than code.

The Scale of the Problem

The numbers behind business email compromise are staggering. According to FBI data, BEC losses have topped $55 billion over the past decade. In a single recent year, reported losses reached over $16 billion, with more than 250,000 complaints filed. Also, the average loss per incident sits around $129,000. That is far more than the average cost of a ransomware attack. So, business email compromise is not a niche threat. It is the single most expensive form of cybercrime by reported dollar losses. And because many victims never report the crime, the true total is likely much higher.

How Business Email Compromise Works

Business email compromise follows a clear pattern. Attackers do not rush in. They plan, research, and wait for the right moment. Here is how a typical BEC attack unfolds step by step.

Step 1 — Research the Target

First, attackers gather facts about the company and its people. They check LinkedIn, the company website, and social media. They look for names of executives, finance staff, and vendors. Also, they study how the company talks in emails, what projects are active, and when big payments are due. This research phase can last days or weeks. As a result, when the attack email arrives, it looks and sounds like a real message from a real person. In short, business email compromise starts long before the email is sent. The attacker does homework that most spam senders never bother with.

Step 2 — Set Up the Attack

Next, attackers set up the tools they need. They may spoof a domain name so the email looks like it comes from the company. For instance, they might register a domain that is one letter off from the real one. Or they may use social engineering techniques to steal real login details and take over an actual email account. A compromised email account is even more dangerous because it passes all security checks. In fact, emails from a taken-over account are almost impossible to spot with standard filters. So, the attacker now has a trusted channel to send fake requests. Also, they may set up email forwarding rules to hide replies from the real account owner.

Step 3 — Send the Fake Request

Then, the attacker sends the BEC email. It might ask for a wire transfer to a new bank account. It might request payments to a fake vendor. Or it might ask a staff member to buy gift card codes and send them over. The email uses urgency and authority to push the target to act fast. For instance, it might say the CEO needs this done before a meeting. Or it might claim a deal will fall through if the money is not sent right now. As a result, the target acts without checking. Also, the email often says the matter is private and should not be discussed with anyone, which stops the target from asking a colleague for a second opinion.

Step 4 — Extract and Vanish

Once the money or data is sent, the attacker moves fast. Funds go through a chain of bank accounts, often in other countries, and are pulled out as cash. If the attacker stole data, they may use it for more attacks or sell it on the dark web. Also, the attacker deletes traces from the compromised email account, removing sent messages and forwarding rules. So, by the time the company spots the fraud, the money or data is gone. In short, business email compromise is a fast, clean crime that is very hard to reverse. The FBI says that once funds leave the first bank account, the odds of recovery drop sharply.

Types of Business Email Compromise

The FBI defines five main types of bec scams. Each uses a different angle to trick employees. Understanding these types of business email compromise helps firms train staff and set up the right defenses.

CEO Fraud

In ceo fraud, the attacker pretends to be the CEO or another high level executive. They send an email to someone in finance or accounting with an urgent request. For instance, they might ask for a large wire transfer to close a deal. The email often says the matter is private and should not be discussed with anyone else. As a result, the target feels pressure to act fast and skip normal checks. Also, because the request seems to come from the top, level employees rarely push back. CEO fraud is one of the most common and costly types of bec scams.

False Invoice Scams

In a false invoice scam, attackers pretend to be a real vendor that the company works with. They send an invoice that looks just like the real thing. However, the bank details on the invoice point to an account the attacker controls. So, when the company pays the invoice, the money goes to the wrong place. These scams are attacks targeting firms with many vendors and high payment volumes. Also, the attackers often time the fake invoice to match a real payment cycle, which makes it harder to spot. In short, false invoice scams are a common type of attack that costs firms millions each year.

Account Takeover

In an account takeover, the attacker gains access to a real email account inside the company. They may steal the password through phishing attacks or buy leaked credentials on the dark web. Once inside, the attacker watches email threads for weeks. They learn who pays whom, how much, and when. Then they jump into a real conversation and change the payment details.

Because the email comes from a real, trusted account, the target has no reason to doubt it. Also, the attacker may set up inbox rules to hide their tracks and redirect replies to a folder the real user never checks. As a result, account takeover is one of the hardest types of business email compromise to detect. It can go on for weeks before anyone notices. The best defense is to enforce MFA on every account and monitor for unusual login patterns like new devices or new locations.

Attorney Impersonation

In attorney impersonation, the attacker poses as a lawyer or legal rep. They contact low level employees and claim to be handling a private legal matter. The email often says the issue is urgent and must stay secret. As a result, the target does not check with a manager. Also, the attacker uses legal jargon to make the request sound real. This trick works because most staff do not know how to verify a legal request. Attorney impersonation is less common than ceo fraud but can be just as costly.

Data Theft

Not all business email compromise attacks aim for money. Some target data theft instead. In this type of attack, the attacker sends an email to HR, payroll, or finance asking for employee records, tax forms, or other sensitive data. The stolen data can be used for identity fraud, tax scams, or to plan future attacks. Also, data theft BEC is harder to detect because no money moves at the time of the attack. As a result, the breach may not come to light until the stolen data is misused weeks or months later.

Social Engineering Techniques Behind BEC

Business email compromise bec is, at its core, a social engineering attack. It works because it targets human trust, not technical flaws. Here are the social engineering techniques that BEC attackers use most.

Urgency and Time Pressure

The most common trick is urgency. The email says the request must be done now. Maybe the CEO is about to board a plane. Or a deal closes in an hour. Perhaps the vendor will cut service if the bill is not paid today. As a result, the target acts fast and skips the usual checks. Also, urgency stops the target from calling the sender to verify. So, time pressure is the attacker’s best tool to trick employees into acting without thinking.

Authority and Fear

BEC emails often come from someone with power: the CEO, the CFO, or a senior partner. Targets feel they cannot say no or slow down a request from a high level boss. Also, the email may warn of bad results if the request is not done. For instance, it might say the company will lose a client or face a lawsuit. As a result, the target acts out of fear and obedience, not out of judgment. This use of authority is why business email compromise is so effective against level employees who do not feel they can push back.

Trust and Familiarity

BEC attackers go to great lengths to look familiar. They copy the sender’s writing style, use the right greeting, and mention real projects. Also, they may reply inside an existing email thread so the message sits in a chain of real emails. As a result, the target sees the email as part of a normal workflow. However, one small detail is different: the bank account, the link, or the request itself. In short, bec attacks rely on trust built over time and break it in a single message.

Who Is Targeted by Business Email Compromise?

BEC attackers do not pick targets at random. They choose people based on their role, their access, and how likely they are to follow a request without question.

Finance and Accounting Staff

The top targets are people who can move money. This includes accounts payable clerks, controllers, and finance managers. These staff handle wire transfers, pay vendors, and process invoices every day. So, a request payments email does not seem odd to them. Also, they may handle dozens of payments a day, which makes it easy for one fake request to slip through. As a result, finance teams need the strongest BEC defenses and the most training.

HR and Payroll Teams

HR staff hold employee records, tax forms, and payroll data. A BEC email that asks for a copy of all W-2 forms or a payroll file can lead to mass data theft. Also, payroll diversion scams trick HR into changing an employee’s direct deposit to an account the attacker controls. So, HR and payroll teams are prime targets for the data theft variant of business email compromise.

Executives and Their Assistants

Executives are both targets and bait. Attackers may target an executive to take over their email account. Or they may pose as an executive to trick others. Also, executive assistants often have the power to act on behalf of the boss. So, a BEC email to an assistant can be just as effective as one to the boss. In short, business email compromise is attacks targeting everyone in the chain of trust, from the top to the front line.

How to Protect Against Business Email Compromise

Train Staff to Spot BEC

The first line of defense is employee training. Staff should know what business email compromise looks like and how to respond. For instance, they should learn to question any email that asks for money, gift card codes, or sensitive data, even if it seems to come from the boss. Also, run mock BEC tests to see who falls for them. Then give extra training to those who do. As a result, the human layer gets stronger with each round. Training is not a one-time event. It must happen at least every quarter to stay effective. In addition, training should cover all types of bec scams, not just ceo fraud. Invoice scams, payroll tricks, and data theft BEC all need their own training module.

Set Up Payment Verification Rules

No wire transfer or change to bank accounts should go through on the strength of one email. Instead, set up a rule that every payment above a set amount needs a phone call or in-person check with the requester. Also, use a second approval for any change to vendor bank details. As a result, even if a BEC email gets through, the fake request hits a wall before money moves. This simple process step stops more BEC fraud than any software tool. Moreover, log every payment verification call so the firm has an audit trail. If a BEC attack ever reaches court, that log is proof that the firm took the right steps.

Use Email Security Tools

While no tool stops all BEC, the right email security stack helps catch many attempts. Use DMARC, DKIM, and SPF to verify sender domains. Also, deploy AI-based email filters that analyze tone, sender behavior, and request patterns. These tools can flag emails that look like they come from a known sender but actually come from a spoofed or lookalike domain. In addition, turn on multi-factor authentication (MFA) for every email account. MFA makes it much harder for attackers to take over an account, which cuts the risk of the account takeover type of business email compromise. Furthermore, review your MFA settings to make sure they use app-based tokens, not SMS, since SMS codes can be intercepted.

Monitor and Respond Fast

Even with training and tools, some BEC emails will get through. So, set up a fast response plan. If a staff member reports a suspicious email, the security team should act within minutes, not hours. Also, monitor email logs for signs of account takeover, such as login from a new location or new forwarding rules. Feed this data into your SIEM and SOC so the team can connect BEC signals with other threat data. In short, a fast response can stop a business email compromise in progress and recover funds before they leave the banking system.

Business Email Compromise vs Phishing

Business email compromise and phishing are related but not the same. Understanding the difference helps firms deploy the right defenses for each.

In short, phishing casts a wide net. Business email compromise uses a spear. BEC is harder to catch because it looks like a normal email. As a result, firms need AI-based detection tools and strong process controls to stop BEC, on top of the standard anti-phishing layers they already run.

Where Business Email Compromise Fits in Your Security Stack

Business email compromise is not a standalone risk. It ties into the broader cybersecurity stack. Here is how BEC defense connects with other controls.

Email Security and Threat Intelligence

BEC defense starts with strong email security. DMARC, SPF, and DKIM block domain spoofing. AI filters catch tone and behavior clues. Also, threat intelligence feeds can flag known BEC domains and IP addresses before an email reaches the inbox. As a result, the email layer acts as the first gate. However, because BEC often passes these checks, the next layers matter just as much. Also, make sure your email security tools share alerts with your SIEM so the SOC team can spot patterns across many BEC attempts. A single BEC email might look harmless. But five from the same domain in a week is a red flag.

Endpoint and Data Protection

If an attacker takes over an email account, endpoint detection and response tools can catch the signs. For instance, a login from a new country or a new device should trigger an alert. Also, data loss prevention tools can block the sending of large data files or employee records that a BEC attacker might try to extract. In short, endpoint and data controls add a safety net that catches what email filters miss.

SOC and Incident Response

When a BEC attack is spotted, the SOC must act fast. The response plan should include steps to freeze the wire transfer, lock the compromised account, and alert the bank. Also, the team should check for forwarding rules, mailbox delegates, and other signs that the attacker is still inside. Feed all findings into your cybersecurity services workflow so the firm learns from each incident and closes the gaps that let it happen.

Related GuideCybersecurity: The Complete Enterprise Guide

Real-World Business Email Compromise Examples

Business email compromise is not a theory. It happens every day. Here are real cases that show how these attacks play out and how much they cost.

Toyota — $37 Million Lost

A third-party attacker posed as a business partner of a Toyota subsidiary. They sent emails to finance staff asking for a large fund transfer. The emails looked real and used the right tone and details. As a result, the finance team approved the transfer, and $37 million went to the attacker’s account. This case shows how even large, well-run firms can fall victim to business email compromise when process controls are weak.

Ubiquiti — $46.7 Million Lost

Networking firm Ubiquiti lost $46.7 million to a BEC attack. Attackers posed as vendors and sent fake payment requests to the finance team. The requests looked normal and matched real vendor patterns. So, the team approved the transfers. By the time the fraud was spotted, most of the money had moved to overseas bank accounts.

Lessons From Real BEC Cases

These cases teach a clear lesson. No firm is too big or too smart to fall for business email compromise. Also, the attacks that cost the most money all share the same traits: a trusted name, an urgent tone, and a request that skips normal checks. So, the fix is not more tech. It is better process. Every payment change needs a phone call. Every rush request needs a pause. In short, slowing down is always the best defense against business email compromise.

Business Email Compromise Trends

Business email compromise keeps changing. Attackers adapt to new tools, new defenses, and new ways of working. Here are the trends that security teams should watch.

AI-Powered BEC Emails

Attackers now use AI to write BEC emails that sound just like the person they are pretending to be. The AI copies the sender’s tone, word choice, and greeting style. As a result, the fake email is harder to spot than ever. Also, AI lets attackers scale up. They can craft custom emails for dozens of targets in minutes. So, AI is making business email compromise faster, cheaper, and more convincing for criminals.

Gift Card and Payroll Scams on the Rise

Not all BEC aims for big wire transfers. Gift card scams are a growing type of attack. The attacker poses as a boss and asks a staff member to buy gift card codes for a client or team event. The amounts are small enough to skip most approval rules. Also, payroll diversion scams are on the rise. In these, the attacker poses as an employee and asks HR to change their direct deposit details. As a result, the next paycheck goes to the attacker’s bank account. Both of these trends show that business email compromise is getting more creative and harder to catch.

BEC Targeting Remote Workers

The shift to remote work has made business email compromise easier. Remote workers rely on email more than office staff do. They cannot walk to a colleague’s desk to check a request. Also, remote workers may use personal devices and home networks that lack the same defenses as the office. So, BEC attackers now focus on remote staff as a softer target. As a result, firms with hybrid or remote teams need extra training and stricter process controls to stop BEC attacks.

Building a Business Email Compromise Defense Program

Stopping business email compromise takes more than one tool or one training session. It takes a program that ties people, process, and technology into one defense. Here is how to build that program.

Set a BEC Policy

Write a clear policy that covers how the firm handles payment requests, data sharing, and changes to bank accounts or payroll details. The policy should state that no wire transfer, no vendor change, and no gift card purchase can happen based on email alone. Also, make sure every employee signs the policy and knows the rules. As a result, when a BEC email arrives, staff have a clear playbook to follow instead of making a judgment call under pressure.

Run BEC Drills

Mock BEC tests are one of the best ways to find weak spots. Send fake BEC emails to staff and see who falls for them. Then give extra training to those who do. Also, vary the types of bec scams you test: CEO fraud one month, invoice fraud the next, data theft the month after that. As a result, staff stay sharp against all forms of business email compromise, not just the one they trained on last quarter.

Review and Improve After Every Incident

Every BEC attempt, whether it succeeds or fails, is a chance to learn. After each incident, the security team should run a review. What worked? What failed? Did the staff follow the policy? Did the tools catch the email? Also, share the lessons with the whole company. As a result, the defense gets stronger with each round. In short, treating every BEC attempt as a learning event turns a threat into a training tool.

Business Email Compromise by Industry

Business email compromise hits every industry. But some sectors face higher risk than others. Here is how BEC maps across the most targeted fields.

Finance and Banking

Banks and financial firms are prime targets. They move large sums every day. Also, they deal with many vendors, clients, and partners via email. So, a fake wire request blends in with real ones. As a result, finance firms need the tightest BEC controls: dual approval on all transfers, strict DMARC enforcement, and AI-based email filters that flag unusual request patterns. In short, the speed and volume of money in finance makes business email compromise a top-tier threat for this sector.

Real Estate

Real estate is one of the hardest-hit fields. BEC attackers insert themselves into closing deals and redirect the down payment to a fake account. The sums are large, often hundreds of thousands of dollars, and the process relies heavily on email. Also, buyers and agents are under time pressure to close fast, which plays right into the attacker’s hands. As a result, real estate firms must verify all wire instructions by phone before sending any closing funds. Moreover, title companies and escrow agents should include a warning on every email that says wire instructions will never change by email alone. This small step can stop a large share of real estate BEC losses.

Health Care and Education

Health care firms hold patient data and move insurance payments. Both make them targets for business email compromise. Also, many health care workers are not trained on BEC risks, which raises the chance of a successful attack. In the same way, schools and universities handle payroll, student data, and vendor payments, all of which BEC attackers can target. As a result, both sectors need regular BEC training, strict payment verification rules, and strong email security tools.

Small and Mid-Size Businesses

Small firms often lack the security teams and tools that large firms have. So, they are easier targets for business email compromise. Also, a single BEC loss can be fatal for a small firm. A loss of $100,000 or more can wipe out months of revenue. As a result, small and mid-size firms must treat BEC defense as a top priority, even with limited budgets. The good news is that the most effective BEC defenses, like phone verification and dual approval, cost little to nothing to set up.

Conclusion

Business email compromise is the most costly form of cybercrime. It works because it targets people, not systems. The attacks are simple: a fake email, a trusted name, and an urgent request. But the damage is real and growing, running into billions each year across all industries and all firm sizes.

The defense is just as clear. Train staff to spot the signs. Set up rules that require out-of-band checks for any payment or data request. Use email security tools like DMARC and AI filters to catch spoofed and suspicious messages. Also, connect BEC defense to your broader security stack so that signals from email, endpoints, and threat feeds all flow into one view. Run BEC drills every quarter. Review every incident. Track your metrics over time. The firms that treat business email compromise as a people, process, and technology problem, not just a tech problem, will stop the most attacks and lose the least money. Start building that program today. Every step you take now makes the next attack much harder to pull off.

References:

• FBI Internet Crime Complaint Center (IC3) – https://www.ic3.gov/
• CISA, Business Email Compromise – https://www.cisa.gov/topics/cyber-threats-and-advisories
• NIST, Phishing and Social Engineering – https://csrc.nist.gov/