Business Email Compromise: How It Works and How to Stop It
Business email compromise is the fraud that arrives with no malware, no link and no obvious lie: a real invoice from a real supplier, with the bank details changed. It is the second most expensive crime reported to the FBI.
The email that costs a company the most money is almost never the one with the suspicious attachment. It is a plain message from a supplier the company really does use, about an invoice it really is expecting, saying the bank details have changed. There is no link to hover over, no file to scan and no malware to find. The sender address is either genuine, because the attacker is sitting inside the supplier's mailbox, or one character away from genuine. Every automated defense a company owns is designed to find something bad in the message, and there is nothing bad in the message. The only false thing in it is the account number.
What Is Business Email Compromise?
Business email compromise, abbreviated BEC, is a scam that targets businesses and individuals who make transfers of funds. The FBI's Internet Crime Complaint Center defines it as fraudsters compromising email accounts and other forms of communication, including phone numbers and virtual meeting applications, through social engineering or computer intrusion, in order to conduct an unauthorized transfer of funds. The definition appears in Appendix B of the 2025 IC3 Annual Report, and the two halves of it matter equally: the access, and the transfer.
The word doing the work is compromise. In the version that succeeds most often, the attacker is not imitating anyone from outside. They are logged into a real mailbox, at the supplier or at the customer or at the law firm handling the closing, reading real conversations and replying inside real threads. The message the finance team receives is a genuine email from a genuine address, sent by the wrong person. That is why it survives filtering, and why the tells people are trained to look for, misspellings and odd greetings and mismatched domains, are absent.
The scale is not a vendor estimate. IC3 counted $3,046,598,558 in losses across 24,768 BEC complaints in 2025, placing it second among all reported crime types behind investment fraud at $8.6 billion, in a year when total reported losses passed $20 billion. Over the longer run, the FBI's public service announcement Business Email Compromise: The $55 Billion Scam put global exposed losses at $55,499,915,582 across 305,033 incidents between October 2013 and December 2023, reported in all fifty states and 186 countries.
BEC is a species of social engineering rather than a technical exploit. Nothing is broken. A person is persuaded, and the persuasion works because everything around the request is true.
How a Business Email Compromise Attack Works
The attack has four stages, and the striking thing about it is how little of the sequence involves anything a security product can object to. Stage one is selection: the attacker picks a company that pays invoices, and finds out who signs them off. Stage two is access, usually a credential phish or a stolen password that gets them into one mailbox belonging to somebody in the payment chain. Stage three is patience, which is the stage nobody expects. The attacker reads. They learn the vendors, the amounts, the approval habits, the tone of the person whose mailbox they are in, and the dates that payments run. Stage four is one email.
- Mailbox accessA phished or reused password gets the attacker into a supplier finance mailbox
- Silent observationWeeks of reading real threads: which customers pay, how much, and when
- Rules set quietlyMail rules move replies out of the inbox so the real owner never sees them
- The invoice goes outA real invoice for a real amount, in a real thread, with new bank details
- Payment approvedFinance recognizes the vendor, the amount and the thread, and pays
- Funds moved onThe receiving account is drained within hours, often across borders
- Callback breaks itOne phone call to a number already on file, before payment, ends the whole chain
Notice which step of the diagram the money is lost at. Not step one, where the mailbox was taken, and not step four, where the false instruction was sent. It is lost at step five, when a person with legitimate authority approves a legitimate-looking payment. That is why BEC is treated as a process failure rather than a malware problem, and why the fix lives in the payment procedure rather than in the email gateway.
What Is an Example of a Business Email Compromise?
The textbook example is the vendor invoice above. Two other shapes are worth naming beside it, and they help because they show that BEC is not only about wire transfers to a fake supplier.
Payroll diversion
Instead of a large one-off payment, the attacker takes an employee's salary. The FBI documented the pattern in a public service announcement on payroll diversion: employees are phished for their login credentials, the attacker signs into the payroll or self-service portal, changes the direct deposit account, and adds a rule so the employee never sees the notification that the details changed. The money goes to a prepaid card. The FBI named education, healthcare and commercial airway transportation as the sectors most affected.
- Credential phishA message that looks like the HR or payroll portal asks the employee to sign in
- Portal accessThe attacker uses the credentials on the real self-service system
- Alert suppressedA rule hides the confirmation so the employee sees no change notice
- Deposit account changedSalary is redirected, usually to a prepaid card
- PaydayThe salary lands in the attacker account and is withdrawn
- Change confirmed out of bandA payroll team that calls the employee on file catches it before payday
The scheme has widened since. In April 2025 the FBI warned that criminals were impersonating employee self-service websites through search engine advertisements, moving beyond small business bank accounts into payroll, unemployment programs and health savings accounts, obtaining multi-factor authentication codes by social engineering and then burying the compromise notices under thousands of spam emails so the victim never reads them.
Goods rather than money
BEC does not always end in a bank transfer. The FBI, the FDA Office of Criminal Investigations and the US Department of Agriculture published a joint advisory on BEC used to steal food, describing criminals spoofing emails and domains to impersonate legitimate employees, ordering shipments of food products and ingredients worth hundreds of thousands of dollars, never paying, and reselling the goods without the labeling that tells a buyer about ingredients, allergens and expiry. The mechanism is identical to invoice fraud. The payload is a truckload of powdered milk.
Executive impersonation
The oldest form, and the one people picture first. A message from the chief executive to somebody in finance, sent while the executive is genuinely traveling, asking for an urgent transfer to close a confidential deal and asking that it not be discussed with anyone until it is done. The confidentiality is the mechanism: it removes the second opinion that would have killed it. Voice cloning, which the 2025 IC3 report lists among the AI techniques used to request a wire payment, has made the follow-up call that used to disprove this attack into something that can now support it, which is why the number you call back on has to be one you already had.
What Is the Difference Between BEC and Phishing?
Business email compromise is a subset of phishing in the loose sense that both are fraudulent messages, but treating them as the same problem leads companies to buy the wrong defense. The differences are practical.
| Phishing | Business email compromise | |
|---|---|---|
| Typical goal | A password, a click, a device | A payment, a payroll change, a shipment |
| Payload | Link or attachment | Text only, in most cases |
| Recipients | Thousands to millions | One to a handful |
| Sender | Spoofed brand or look-alike domain | Often the genuine account of a real person |
| Research beforehand | Little to none | Weeks inside a mailbox |
| What catches it | Filters, MFA, link inspection | A phone call to a known number |
| Per-incident loss | Small | Large: 24,768 complaints produced $3.05 billion of losses in 2025 |
The last row is where the two diverge hardest. Phishing and spoofing was the most reported crime type of 2025 with 191,561 complaints, but those complaints totaled $215.8 million in losses. BEC produced a small fraction of the complaints and about fourteen times the losses. Volume and cost are inverted, and a security program built only around the volume problem will be undefended against the cost one.
The overlap is real, though, and it runs in one direction: phishing is how the attacker gets the mailbox that makes the BEC possible. Stopping phishing is a prerequisite for stopping BEC. It is not a substitute.
Types of Business Email Compromise
The FBI's five scenarios describe who is being impersonated rather than different techniques, and a real incident often blends two of them. Vendor email compromise, at the foot of the table, is not one of the five: it is the industry's name for the version run from inside the supplier's own mailbox.
| Type | Who the attacker pretends to be | What they ask for |
|---|---|---|
| False invoice scheme | A supplier the company already pays | Payment of a genuine invoice to a new account |
| CEO fraud | An executive, usually while traveling | An urgent, confidential transfer |
| Account compromise | Nobody: they are inside a real mailbox | Whatever that mailbox has authority to ask for |
| Attorney impersonation | Counsel on a deal or a closing | A time-critical payment, secrecy included |
| Data theft | An executive, writing to HR or payroll | Employee records, W-2s, a payroll file |
| Vendor email compromise | The supplier's finance team, from the supplier's own domain | Redirected payment across the supplier's whole customer list |
Two variations are worth naming because they change what the tells look like. Conversation hijacking means the attacker replies inside an existing thread rather than starting a new one, so the message carries the whole legitimate history beneath it. And data theft BEC is the setup rather than the payoff: a stolen payroll file is the raw material for tax fraud and for the next round of targeting, which is why an emailed request for employee records deserves the same callback as a request for money.
What Is the First Stage of a BEC Attack?
Target selection and research, before a single email is sent to the victim. The attacker needs three things that are not secret: which companies pay which suppliers, who inside those companies has payment authority, and what a normal message between them looks like. The first two come from public sources and from breached contact data. The third comes from the mailbox, once they have one.
That is why a data breach somewhere else is often the quiet first stage of a fraud against you. A list of names, job titles, employers and direct phone numbers is not, by itself, dangerous. It is a targeting file.
How to Spot a Business Email Compromise Email
The cosmetic tells mostly do not apply, because a message sent from a real account inside a real thread has correct branding, correct spelling and a correct sender address. What survives is structural: what the message asks for, and how it discourages you from checking.
Three more that hold up. A request to move the conversation to text, WhatsApp or a personal address, which takes it out of the system where anyone else could see it. A reply-to address that differs from the from address, which is visible in the message headers and invisible in the message. And a payment request that is slightly unusual in one dimension only: the same vendor, the same amount, a different account, or the same account and an unusual amount.
The IC3's own guidance on BEC puts the operational advice plainly: verify a change of account information by a second channel or with two-factor authentication, and examine the sender's full email address carefully, particularly on a phone, where mail apps display the friendly name and hide the address behind it. Turning on full email extensions so staff see the complete address is one of the few configuration changes that helps against this specific attack.
Also worth knowing: the tells that give a phishing email away are still useful, because phishing is how the attacker got the mailbox in the first place. They just will not be present in the fraudulent payment request itself.
How to Prevent Business Email Compromise
The controls that work against BEC are split between the mailbox and the money, and the second half is where most companies are weakest.
What to Do If You Are a Victim of Business Email Compromise
Speed is the whole of it. The money leaves the receiving account within hours, and the mechanism that recovers it works on a timescale of the same day, not the same week.
Who Is Liable for Business Email Compromise?
Usually the party that sent the money, which is the answer people least expect and the reason the controls above are worth the friction. A payment authorized by an employee with genuine authority, from a genuine account, to an account the employee chose to use, is not obviously the bank's error, and it is not obviously the supplier's either. The invoice was real. The debt was real. Only the account number was wrong.
In practice liability is argued between three parties: the payer, the supplier whose mailbox was compromised, and the banks at either end. Outcomes turn on the contract, on which side's systems were breached, on whether either side ignored its own verification procedure, and on the jurisdiction. Courts in the United States have divided on similar facts, so nobody should read a general answer as a prediction about a specific loss. That is a conversation with counsel, and quickly.
Insurance is the same story in miniature. Many cyber and crime policies exclude losses where an employee voluntarily transferred funds, and cover them only through a specific social engineering fraud endorsement, often at a lower limit than the rest of the policy. Anyone relying on insurance for this risk should read that endorsement before they need it, rather than after.
Key takeaways
- Business email compromise redirects a payment using a real or convincing business email account. There is usually no link, no attachment and nothing for a filter to find.
- It cost $3,046,598,558 across 24,768 complaints reported to the FBI in 2025, second only to investment fraud, and $55.5 billion globally between 2013 and 2023.
- The loss happens when a person with legitimate authority approves a legitimate-looking payment, so the fix lives in the payment process, not the email gateway.
- Phishing is the volume problem and BEC is the cost problem. Phishing is also how the attacker gets the mailbox, so stopping it is a prerequisite rather than a substitute.
- Urgency plus secrecy in the same message is close to diagnostic, and a change of bank details arriving by email is false until a phone call says otherwise.
- Mailbox rules the owner did not create are the quiet signature of an active compromise.
- If money has gone, call the bank and file at ic3.gov the same day. The FBI's kill chain froze 58 percent of what it was asked to freeze in 2025, and speed is what decides it.
Common questions
What is business email compromise in simple terms?
A scam where somebody uses a business email account, often a real one they have broken into, to tell you to send money to the wrong place. The invoice is genuine, the sender looks genuine, and only the bank details are false. That is why it gets past software and why the defense is a phone call.
What is an example of a business email compromise?
A supplier's finance mailbox is compromised. The attacker watches for weeks, then replies inside a real invoice thread saying the company has changed banks and attaching an invoice for the correct amount. Accounts payable recognizes the vendor, the thread and the figure, and pays the attacker's account.
What is the difference between BEC and phishing?
Phishing is sent in volume and carries a link or an attachment for a scanner to catch. BEC is sent to a few named people, usually carries neither, and often comes from a genuine account. Phishing costs a password; BEC costs a payment. In 2025 phishing complaints outnumbered BEC complaints roughly eight to one, while BEC losses were about fourteen times larger.
What is the first stage of a BEC attack?
Research and target selection, before any message reaches the victim. The attacker works out which suppliers a company pays, who approves payments, and what a normal message between them looks like. Only then do they try to get into a mailbox, and only after reading it do they send the fraudulent instruction.
Who is liable for business email compromise?
Most often the party that authorized the transfer, because the payment was made by a real employee with real authority. Beyond that it depends on the contract, on whose systems were compromised, on whether verification procedures were followed, and on the jurisdiction, and it is a question for a lawyer rather than a general rule.
Does insurance cover business email compromise?
Sometimes, and less often than people assume. Many cyber and crime policies treat a transfer made voluntarily by an employee differently from theft, and cover it only under a social engineering fraud endorsement with its own sublimit. Read that endorsement before you need it.
How common is business email compromise?
The FBI recorded 24,768 BEC complaints in 2025. That is far fewer than the 191,561 phishing and spoofing complaints filed in the same year, but each one is much more expensive, and the scheme has been reported in all fifty states and 186 countries.
Can multi-factor authentication stop BEC?
It stops the most common way attackers get into the mailbox, so it prevents a large share of these attacks from starting. It does not stop the fraud once an attacker is inside, and it does nothing about a look-alike domain sent from outside. Pair it with a verification step on the payment itself.
Can you get your money back after a BEC?
Often, if you move the same day. Call your bank for a recall and a reversal, then file at ic3.gov with the full transaction details so the FBI's Recovery Asset Team can ask the receiving bank to freeze the funds. That process froze $679 million of $1.16 billion in attempted theft in 2025.
What is vendor email compromise?
BEC where the compromised mailbox belongs to a supplier rather than to you. It is the hardest version to catch, because the fraudulent invoice arrives from the supplier's genuine domain, inside a genuine conversation, and everything except the account number is correct. Only an out-of-band callback catches it.
Is business email compromise a form of social engineering?
Yes. Nothing is technically broken at the moment the money is lost. The attacker persuades a person to do something they were already authorized to do, and the persuasion works precisely because every detail around the request is true.
On this page
- What Is Business Email Compromise?
- How a Business Email Compromise Attack Works
- What Is an Example of a Business Email Compromise?
- What Is the Difference Between BEC and Phishing?
- Types of Business Email Compromise
- What Is the First Stage of a BEC Attack?
- How to Spot a Business Email Compromise Email
- How to Prevent Business Email Compromise
- What to Do If You Are a Victim of Business Email Compromise
- Who Is Liable for Business Email Compromise?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.