Business Email Compromise (BEC): How It Works and How to Prevent It

Hero Summary

Business email compromise (BEC) is a fraud in which an attacker uses a spoofed, lookalike, or compromised email account to impersonate a trusted person — an executive, a vendor, or a colleague — and trick an employee into sending money or sensitive data. It usually contains no malware, which is why technical filters miss it. In 2025, the FBI's Internet Crime Complaint Center (IC3) received 24,768 BEC complaints with reported losses of $3,046,598,558, making BEC the second-largest loss category in its report after investment fraud.

Executive Summary

BEC succeeds by exploiting trust and process, not software. A convincing request that arrives at the right moment — a change of bank details, an urgent wire from the "CEO," an invoice from a known supplier — only needs one employee to act. This guide explains how BEC attacks work, the common variants, the warning signs, and the layered defenses that reduce the risk: payment-verification procedures, multi-factor authentication, email authentication, lookalike-domain monitoring, and awareness training with simulation. It also covers what to do in the first hours after a suspected BEC payment.

What is business email compromise? {#what-is-bec}

Business email compromise is a scam that targets businesses, or individuals working with suppliers and businesses that regularly make wire transfers. The attacker either takes over a real mailbox or convincingly impersonates one, then uses that trusted identity to request a payment, a change of payment details, or sensitive information. Because the messages are plain text from a seemingly legitimate source, there is often no malicious link or attachment for a security tool to catch.

How big is the problem? {#scale}

The FBI IC3's 2025 Internet Crime Report lists business email compromise at 24,768 complaints and $3,046,598,558 in reported losses. By loss, only investment fraud ($8,648,617,756) was larger. Those are reported losses: many incidents go unreported, and the figures count complaints made to IC3, not every incident worldwide. The report's headline is that total reported losses surpassed $20 billion in 2025.

How BEC attacks work {#how-it-works}

A typical BEC attack follows a pattern:

1. Reconnaissance. The attacker learns who approves payments, who the suppliers are, and how the organization communicates, using public information, social media, and sometimes a previously compromised mailbox.
2. Gaining a trusted identity. The attacker either compromises a real mailbox (often by phishing credentials), spoofs the sender's domain, or registers a lookalike domain that differs by a character from the real one.
3. The request. A message arrives with urgency and plausible context — a pending acquisition, a late invoice, a change of banking details — often timed for when the genuine person is traveling or unavailable.
4. The payment or disclosure. If the employee acts on it, funds move to an account controlled by the attacker, often quickly layered through other accounts.

A compromised mailbox is especially dangerous because the attacker can read real conversations and reply inside existing threads, and may create inbox rules that hide replies from the genuine account owner.

Common BEC variants {#variants}

Variant	What happens
CEO / executive impersonation	A message appearing to come from a senior executive asks finance staff for an urgent, confidential payment
Vendor or invoice fraud	A supplier's account is compromised or impersonated, and the "new" bank details on an otherwise real invoice belong to the attacker
Payroll diversion	An employee's account is impersonated to ask HR to change the destination of their salary
Data theft	A request for W-2s, employee records, or customer data rather than money
Real-estate and legal payment scams	Wire instructions in a closing or settlement email are replaced with fraudulent ones

Warning signs {#warning-signs}

• A change in payment details, especially one delivered only by email.
• Urgency and secrecy — "do this now, don't discuss it" — from someone who does not normally write that way.
• A sender address or reply-to that is slightly different from the genuine one.
• A request to bypass the normal approval process or split a payment to stay under a limit.
• An executive who is supposedly unreachable by phone and asks that all communication stay on email.
• Unexpected tone or phrasing for the supposed sender, or a message that arrives outside their normal working pattern.

How to prevent BEC {#prevention}

Because BEC is a process attack, process controls are the most reliable defense, supported by technical and human layers.

Process controls

• Verify any change of bank details or any urgent payment request through a second channel — a call to a number you already hold, not one in the message.
• Require dual approval for payments above a set threshold or to new beneficiaries.
• Keep a verified vendor list and treat changes to it as a controlled procedure, not an email request.

Technical controls

• Multi-factor authentication on all email accounts, preferably phishing-resistant, so that stolen passwords do not hand over a mailbox. See Email Account Security Beyond Passwords.
• SPF, DKIM, and DMARC enforcement on your own domain, so attackers cannot easily spoof it against your customers and partners. See DMARC, SPF & DKIM Explained.
• Monitoring for lookalike domains that impersonate your brand or your suppliers.
• Alerting on suspicious mailbox rules and forwarding, which attackers commonly use to hide their activity.

Human controls

• Awareness training and simulation that includes finance, HR, and executive assistants — the roles BEC targets — and rehearses the verification procedure, not just spotting the message. See Phishing Attacks: Types, Warning Signs & Prevention.

What to do if a BEC payment has been made {#response}

Speed matters because stolen funds are usually moved on quickly.

1. Contact your bank immediately and ask them to attempt a recall or freeze of the transfer.
2. Report the incident to law enforcement — in the United States, to the FBI's Internet Crime Complaint Center (ic3.gov); in India, to the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the 1930 helpline.
3. Secure the affected accounts — reset credentials, revoke sessions, enable MFA, and check for unauthorized inbox rules and forwarding.
4. Preserve evidence — keep the original emails with full headers and the payment records.
5. Review and notify — assess whether any data was exposed and whether regulators or customers must be informed.

How Threat ResQ's products fit {#threat-resq-fit}

• TRISA and TRAP address the human layer. TRISA is Threat ResQ's AI security awareness and human risk intelligence platform; TRAP is its phishing simulation capability, covering phishing, smishing, and vishing simulation that feeds TRISA's readiness scoring.
• DomainShield IQ addresses the lookalike-domain and email-authentication layer. It monitors DNS records, includes a DMARC analyzer that tracks SPF and DKIM alignment, and monitors brand and typosquat domains across 300+ variations of a brand.

These products reduce exposure to BEC; they do not replace payment-verification procedures, which remain the primary control.

FAQ {#faq}

What is business email compromise? BEC is a fraud in which an attacker impersonates or takes over a trusted email identity — an executive, vendor, or colleague — to trick an employee into sending money or sensitive data. It typically involves no malware.

How is BEC different from phishing? Phishing is usually a broad attempt to steal credentials or deliver malware. BEC is a targeted fraud aimed at a specific payment or disclosure, often after reconnaissance or a mailbox compromise, and it commonly uses plain-text messages with no link or attachment.

What is the best defense against BEC? Process controls: independently verifying any change of payment details or urgent payment request through a second channel, and requiring dual approval for significant or new payments. Technical controls such as multi-factor authentication and email authentication, and regular awareness training, support those procedures.

Can email authentication stop BEC? DMARC enforcement stops attackers from spoofing your exact domain, but it does not stop lookalike domains, compromised real mailboxes, or compromised suppliers. It is one layer, not a complete defense.

What should I do if I have sent money to a BEC scammer? Contact your bank immediately to request a recall or freeze, report to law enforcement (the FBI IC3 in the US, or the National Cyber Crime Reporting Portal in India), secure the affected accounts, and preserve the evidence. Speed improves the chance of recovery.