What Is Business Email Compromise? BEC Scams Explained

Business email compromise, or BEC, is a targeted scam in which criminals impersonate an executive, vendor, attorney or business partner over email to trick an employee into wiring money, redirecting a payroll deposit or handing over sensitive data. Unlike mass phishing blasts that hit thousands of inboxes with a generic lure, BEC attacks are researched, patient and personal: the attacker studies a company's org chart, vendor relationships or an upcoming deal, then sends a convincing, often malware-free email timed to a real event. The FBI's Internet Crime Complaint Center (IC3) says the scam cost reported victims more than $3 billion in 2025 alone, according to its 2025 Internet Crime Report, making BEC one of the single costliest categories of cybercrime the Bureau tracks.

What is business email compromise?

IC3 defines BEC as a scheme in which criminals compromise a legitimate business or personal email account, or convincingly spoof one, to deceive someone who regularly handles fund transfers or sensitive records into carrying out a fraudulent instruction. Crucially, no malware has to be installed and no network has to be breached for BEC to work. The "hack," when there is one, is usually against a person's judgment under time pressure rather than against a server.

Two mechanisms show up again and again. In account takeover, the attacker gains real control of a mailbox, typically through a reused or stolen password, then watches ongoing threads before hijacking one at the right moment — a form of social engineering aimed at people rather than software. In spoofing or domain impersonation, the attacker never touches the real account; instead they register a lookalike domain (swapping an "m" for "rn," adding a hyphen, or using a different top-level domain) and send messages that appear, at a glance, to come from the real person. Both techniques rely on the same thing: a target who trusts the name in the "From" field without checking the actual address behind it.

How BEC differs from ordinary phishing

Standard phishing emails usually cast a wide net, push a fake login page, and rely on volume: send enough messages and a small percentage of recipients will click. BEC is closer to a confidence scheme than a numbers game. There's frequently no attachment and no link at all, which lets BEC slide past security filters tuned to catch malicious payloads. The email just makes a request that sounds entirely ordinary, from a sender the recipient already trusts, at a moment chosen because a fast, quiet answer feels reasonable: before a deal closes, during a vendor's "new" bank-detail update, or while an executive is traveling and hard to reach by phone.

How a BEC attack typically unfolds

Most BEC campaigns follow a recognizable arc, built around research, access and a payment request:

1. Reconnaissance. The attacker identifies a target company, maps who approves payments, and studies public sources like LinkedIn, press releases and the company website to learn names, titles and writing style.
2. Access or impersonation. The attacker either compromises a real mailbox — often using credentials harvested through a separate breach or a credential-stuffing attack against a webmail portal — or registers a spoofed, lookalike domain that mimics the real one.
3. The pretext. The attacker sends a message that looks routine: an invoice is "updated," a wire needs to go out before a deadline, payroll direct-deposit details have "changed," or an executive needs gift cards purchased quietly for a client gift.
4. Urgency and isolation. The message pushes secrecy or speed — "handle this before the call," "don't loop in the usual approver, I'm traveling" — specifically to discourage the one step that would unravel the scam: picking up the phone and confirming with the real person through a separate channel.
5. The payout. Funds are wired, ACH-transferred, or sent as gift-card codes to an account or mule the attacker controls, then rapidly moved again — often through cryptocurrency exchanges or a chain of bank accounts in multiple countries — before the victim notices.

Common types of BEC scams

IC3 and industry researchers generally group BEC incidents into a handful of recurring playbooks. They share the same mechanics — impersonation plus urgency — but target different parts of a business.

Why BEC causes such large financial losses

BEC consistently ranks among IC3's costliest crime categories, year after year, for a few structural reasons. First, the dollar amounts involved are simply larger: a scam that targets a company's accounts-payable process is aimed at business-sized wire transfers, not a consumer's single credit-card number, so a successful attempt can net hundreds of thousands of dollars in one transaction. Second, because BEC relies on social engineering rather than malware, it routinely evades antivirus tools, spam filters and even employees who've been trained to spot a suspicious attachment — there's nothing technically malicious in the email to catch. Third, once a wire transfer clears, funds typically move fast: through a chain of mule accounts, across borders, and often into cryptocurrency, which makes recovery a race against the clock rather than a routine bank reversal.

Microsoft's own threat-intelligence team, which tracks BEC activity across Microsoft 365 and Outlook, reported detecting roughly 35 million BEC attempts a year — about 156,000 a day — between April 2022 and April 2023, and found that cybercrime-as-a-service platforms selling ready-made BEC phishing kits and hosting grew 38% from 2019 to 2022. That professionalization is part of why losses keep climbing: attackers no longer need deep technical skill to run a convincing campaign, just access to a rented toolkit, a list of targets and a plausible story.

Warning signs of a BEC attack

Most BEC emails give away at least one of these tells if you slow down enough to look:

• A mismatched reply-to or sender address — the display name reads correctly, but the actual email address is slightly off, routed through a free webmail service, or on a domain that looks almost, but not quite, right.
• Unusual urgency or secrecy — pressure to act "before end of day," skip the normal approver, or avoid discussing the request out loud.
• A sudden change to payment details — a vendor's bank account, a payroll deposit account, or wiring instructions that differ from what's on file, especially right before a payment is due.
• Requests that avoid a phone call — insistence on email- or text-only communication, or claims the requester is "unreachable by phone right now."
• Off hours or odd phrasing — a message sent late at night, from an unusual time zone, or written in a tone or vocabulary that doesn't quite match how that person usually writes.
• A request for gift cards or cryptocurrency — both are fast, largely irreversible ways to move value, which is exactly why scammers favor them.

How to prevent business email compromise

No single control stops every BEC attempt, but combining a few layered defenses closes off most of the openings attackers rely on.

• Verify out of band. Before acting on any payment change or urgent wire request, call the requester back using a phone number you already had on file — never a number provided in the suspicious email itself.
• Authenticate your email domain. Publishing SPF and DKIM records, and setting a DMARC policy to reject rather than just monitor, blocks a large share of outright domain-spoofing attempts before they reach an inbox. Google's Workspace security team has said anomaly detection and authentication checks like these catch the overwhelming majority of BEC attempts targeting its customers before a user ever sees them, as described in Google's own security announcements.
• Require multi-factor authentication on every email and financial account, so a leaked or reused password alone isn't enough to take over a mailbox. Setting up an authenticator app for two-factor authentication closes one of the most common doors attackers use to gain real account access.
• Put dual approval on payments. Require a second person's sign-off, through a separate system, for any wire transfer, vendor-bank-detail change or payroll update above a set threshold.
• Flag external senders. Configure email systems to visibly tag messages from outside the organization, especially ones that use a display name matching an internal employee or executive.
• Train staff on the pattern, not just the tech. Because BEC often has no malicious link or attachment, awareness training should focus on recognizing urgency, secrecy and last-minute changes — not just "don't click suspicious links."
• Register close lookalike domains defensively where practical, and monitor for new domain registrations that closely resemble your own.

What to do if you've been targeted or victimized

If you suspect you've received a BEC attempt, don't reply to it — contact the supposed sender directly through a known, separate channel to confirm. If a fraudulent transfer has already gone out, IC3 advises contacting your bank or financial institution immediately to request a recall of the funds, since acting within the first hours gives the best chance of a reversal through the Financial Fraud Kill Chain process banks can initiate. Then file a complaint at ic3.gov as soon as possible, regardless of the dollar amount — IC3's Recovery Asset Team has helped freeze and return funds in cases reported quickly enough.

What's next for BEC

IC3's own reporting shows BEC losses climbing nearly every year this decade, and Microsoft's data points to the same trend driver: rented, AI-assisted phishing kits that let lower-skilled criminals run a convincing campaign without writing a line of code themselves. Expect attackers to keep leaning on the same core trick — a trusted name, a plausible deadline, a request that avoids a phone call — while using better-written, more personalized messages to get past both spam filters and skeptical employees. The defenses that work haven't changed much: authenticate your domain, verify payment changes out of band, and treat "urgent, confidential, don't call" as the biggest red flag in the message, not a reason to skip the usual checks.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage