Business email compromise (BEC) is a scam in which an attacker uses a spoofed or hijacked email account to trick someone into sending money or sensitive data. The FBI calls it a sophisticated scam aimed at businesses and individuals who make legitimate transfer-of-funds requests. The core defense is a second channel check.
How does BEC work?
The FBI's Internet Crime Complaint Center (IC3) describes BEC, also called email account compromise, as a scam frequently carried out when someone compromises a legitimate business or personal email account through social engineering or computer intrusion, then uses it to cause unauthorized transfers of funds.
Two broad routes exist. In one, the attacker creates a lookalike domain or forges a sender name and writes as an executive or supplier. In the other, the attacker actually gets into a real mailbox, reads the threads, and replies inside an existing conversation at the right moment. The second is harder to spot, because the message comes from a real account and refers to a real invoice.
IC3 also notes that BEC variations often involve compromising business accounts and asking employees for personal data, which feeds other scams.
How big is the problem?
IC3 reports, for October 2013 to December 2023, 305,033 domestic and international incidents with exposed dollar loss of $55,499,915,582, drawn from reports to the FBI, law enforcement and filings with financial institutions. Between December 2022 and December 2023, IC3 saw a 9% increase in identified global exposed losses. "Exposed loss" means money at risk, not necessarily money lost for good, and the figures cover the reporting period stated by IC3.
What does an attempt look like?
A constructed example. An accounts payable clerk gets an email in an existing thread with a long-standing supplier: "We have changed banks, please use the details attached for the next payment." The tone is right, the invoice number is real. The attacker has been reading the mailbox for two weeks.
Nothing in the email is technically wrong. The reliable catch is procedural: a change of bank details triggers a call to a phone number already on file, not one in the email.
How to check or apply this
- Require a second channel check for any change of payment details and any urgent transfer. Use a number from your own records.
- Set approval limits so one person cannot release a large payment alone.
- Turn on multi-factor authentication for every mailbox, starting with finance, executives and administrators.
- Review mailbox rules and forwarding. Hidden forwarding or rules that move messages to obscure folders are common signs of a hijacked account.
- Publish SPF, DKIM and DMARC for your domains so others can reject forgeries of your name. This protects your partners, not just you.
- Train staff on the specific pattern: new bank details, urgency, secrecy, changed tone. Practice with a safe test.
- Know the recall path. If you discover a fraudulent transfer, contact your bank immediately, request a recall and file a complaint with IC3. IC3 says it may be able to help financial institutions and law enforcement freeze funds, and that time is of the essence.
Who is most at risk?
Finance and accounts payable staff, executive assistants, payroll and HR teams, and anyone who can change vendor records. IC3 notes the scam targets small local businesses and larger corporations alike, and personal transactions such as home purchases. Attackers pick whoever can move money or release data, not whoever is most senior.
New employees are an easy target because they do not know the usual patterns yet. Give them the payment callback rule on day one and tell them who may legitimately ask for a transfer.
What are the warning signs inside your own systems?
Look for logins from unusual places, new mail rules, messages marked read that the user did not open, and a sudden stream of outbound mail to one external address. Alert on these in your email platform's audit logs.
Lookalike domains deserve a watch. IC3 advises checking that the URL in emails matches the business it claims to be from and watching for misspellings of the real domain. Registering the obvious variants of your own domain is cheap.
Quick check
Does DMARC stop business email compromise?
It stops others from forging your exact domain, which blocks one route. It does not stop a lookalike domain or a hijacked real mailbox, so you still need payment verification and multi-factor authentication.
What should we do first if we sent money to a fraudster?
Call your bank at once and request a recall, then file a complaint at ic3.gov. Speed matters most.
Sources
- FBI IC3: Business Email Compromise, The $55 Billion Scam
- NIST SP 800-177 Rev. 1: Trustworthy Email
- RFC 7489: DMARC
Last reviewed: 18 October 2026.
