Business email compromise (BEC) is fraud in which an attacker uses a hijacked or impersonated email account to trick someone into a payment or data transfer. Common patterns are executive impersonation, vendor invoice changes, compromised employee accounts, impersonated lawyers and payroll or data requests. The defense is a verification step that does not rely on email.
What does the FBI's Internet Crime Complaint Center say BEC is?
The IC3 describes BEC as a sophisticated scam that targets businesses and individuals who perform legitimate transfers of funds. It is frequently carried out by compromising legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers. It also notes that variations involve compromising business accounts and requesting employees' personal information in order to compromise other accounts.
Its public service announcement from September 2024 reports 305,033 incidents between October 2013 and December 2023, with total exposed loss of 55.5 billion US dollars. It says global exposed losses rose 9 percent from December 2022 to December 2023, and that funds increasingly go to accounts at financial institutions holding custodial accounts for third-party or peer-to-peer payment processors and cryptocurrency exchanges.
What are the common patterns?
The IC3 announcement does not enumerate formal categories, and different organizations name them differently, so treat this list as a practical grouping of how the fraud usually shows up.
Executive impersonation. A message that appears to come from a senior leader asks a finance employee for an urgent, confidential transfer. The sender address may be a lookalike domain or a spoofed display name.
Vendor or invoice fraud. A supplier "changes bank details" before the next payment, or a genuine invoice is altered. This is hard to spot because the relationship and the amount are real.
Compromised internal account. An attacker who has taken over a real employee mailbox writes from the real address, often replying within existing threads and sometimes adding forwarding rules to watch the conversation.
Impersonated advisor. A message claiming to come from a lawyer or other outside adviser asks for a payment tied to a sensitive deal.
Data requests. Payroll or tax records are requested "for an audit," which feeds later fraud, as the IC3 describes in its note on requests for personal information.
Payment redirection to consumers. Individuals making large transactions, such as a house purchase, receive altered wire instructions. The IC3 says BEC targets personal transactions as well as businesses.
How does it unfold?
A constructed example. A finance clerk receives an email in an existing thread with a trusted supplier. The tone matches, and the supplier asks that the next payment go to a new account because of a banking change.
The email came from the supplier's real mailbox, which the attacker took over weeks earlier. A mail rule hides the clerk's replies from the supplier. A call to the number in the email would have reached the attacker's contact. A call to the number in the company's own vendor records would have exposed the fraud.
What does the IC3 recommend?
Its recommendations include: act quickly after a fraudulent transfer and contact your financial institution to request a recall of funds, file an IC3 complaint regardless of the amount, verify account-change or payment requests through a secondary channel, use unique passwords for each service, check that sender addresses and URLs match and watch for misspelled domains, avoid sending credentials or personal information by email, enable full email address display, and review financial accounts regularly.
How to check or apply this
- Require a call-back to a number from your own records before any change to payment details, no matter who asks.
- Require two people to approve payments over a threshold you set.
- Turn on multi-factor authentication for all email accounts, and prefer phishing-resistant methods for finance and executives.
- Alert on new mailbox forwarding and inbox rules, and review them on a schedule.
- Show full sender addresses and mark external email clearly.
- Write down who to call at your bank and when. A recall request works best when it is fast.
- Run a drill with a fake invoice change and see where the checks held.
Quick check
Is BEC a hacking attack or a social engineering attack?
Both. The IC3 says it is carried out through social engineering or computer intrusion, often as a mix: a stolen mailbox lets the attacker write convincingly.
What should we do first after sending money to a fraudster?
Contact your financial institution immediately to request a recall, and file a complaint with the IC3. The announcement stresses that time is of the essence.
Sources
Last reviewed: 18 October 2026.
