Business email compromise: How it works and how to stop it

Business email compromise (BEC) is a scam where a criminal poses as someone you trust, such as a vendor, your owner, a client or an employee, and asks for something that sounds routine. Pay this invoice to a new account. Change my direct deposit. Send me the W-2s.

It is one of the costliest crimes the FBI tracks. Its Internet Crime Complaint Center (IC3) counted 24,768 BEC complaints and about $3.05 billion in losses in 2025, second only to investment fraud. Most of those cases involved no malware at all, so there was nothing for antivirus to catch.

What a mailbox takeover looks like from our side

We have responded to BEC at client offices, and the version we worry about most is a real mailbox in an attacker’s hands. The attacker signs in with a stolen password, reads the conversations and waits. When an invoice comes due, they reply in the real thread from the real account. They usually add an inbox rule that moves or deletes replies, so the person who owns the account never sees what is happening.

When we respond, the steps are the same every time:

1. Contain the account: reset the password, sign out every session and confirm MFA is on.
2. Remove the inbox rules and forwarding the attacker created.
3. Warn the contacts who may have received fraudulent messages from the account.
4. Review what the attacker could read or send, so the client can decide whether notification rules apply.

Most attempts never get that far. Our email sign-in monitoring watches a mix of signals, such as sign-ins from unexpected locations, and it has caught real takeover attempts at our clients. When it flags one, we contain the account within the hour.

BEC vs. phishing: what’s the difference?

Phishing is the broad category: any message that tries to trick someone into clicking a link, opening a file or handing over a password. Business email compromise is a specific scam aimed at money or sensitive records.

The difference shows up in what your defenses can see. A phishing email usually carries something a filter can inspect, such as a link to a fake login page or a malicious attachment. A BEC message often carries nothing but a request, sent from a lookalike domain or from a real mailbox an attacker already controls. That leaves email filters less to catch, and it’s why the payment rules below matter more against BEC than any filter does.

The two often work together. A phishing email steals a password, and that mailbox becomes the one the attacker uses for the BEC scam.

The common forms of BEC

Most BEC falls into a handful of patterns:

• A vendor’s new bank account for upcoming payments.
• An urgent, confidential request from the owner to wire money or buy gift cards.
• An employee asking HR to change their direct deposit.
• New wiring instructions sent right before a real estate or legal closing.
• Requests for W-2s or client records, which feed later fraud.

These schemes now use phone calls, texts and video meetings too. In 2025 the FBI warned that criminals increasingly use AI-generated voices to impersonate people their targets know. A voicemail that sounds like your owner proves nothing on its own.

Payment rules that stop it

Every BEC scam needs someone to move money based on a message. A written payment process breaks that link.

• Call back to verify any change to bank details, using a number from your vendor file or contract.
• Require two people for wires and new payees: one sets up the payment and the other approves it.
• Treat urgency or secrecy as a reason to verify. Tell staff that no one, including the owner, will mind a callback.
• Have employees change direct deposit themselves in the payroll system, or confirm the change at a known phone number.
• Ask your bank about positive pay, payee verification and limits on new wire recipients.

Accounting firms, law offices and nonprofits that pay out grant funds are frequent targets. If that describes you, write the rule down and train on it.

Email settings we put in place for every client

These are part of our managed IT services, and they make a takeover harder and a fake easier to spot:

• MFA on every mailbox. Admin accounts use phishing-resistant sign-in such as security keys or passkeys, and everyone else approves sign-ins in an app with number matching.
• DMARC at p=reject on every client domain, backed by SPF and DKIM, so no one else can send as your exact domain.
• A tag on mail from outside the organization, so a fake internal message stands out.
• Alerts on new inbox rules, and a block on automatic forwarding to outside addresses.
• Filtering that looks for impersonation and lookalike domains.

DMARC protects your own domain. A lookalike domain, or a vendor whose mailbox was taken over, gets past it, which is why the payment rules above still matter.

Training that matches how BEC actually reads

BEC emails rarely have typos or strange links, so training should focus on the request itself. Staff should stop and verify when a message asks to change bank, payroll or wiring details, pushes urgency or secrecy, replies to a different address than it came from, asks for gift cards or tax forms, or arrives by text or voicemail from someone who usually emails.

Our clients get phishing simulations year-round as part of our cybersecurity services. When someone clicks, they get a short lesson right away, and the client sees the results.

If money already went out

1. Call your bank’s fraud line and ask them to recall the transfer and contact the receiving bank.
2. File at ic3.gov with the transaction details. In 2025 the IC3 Recovery Asset Team froze about $679 million of roughly $1.16 billion in attempted theft it worked on.
3. Secure the mailbox: reset the password, revoke sessions, and check rules and forwarding.
4. Warn whoever was impersonated, and call your cyber insurance carrier.
5. If client or patient data may have been exposed, check your notification duties.

One more warning. In July 2026 the FBI said criminals are posing as IC3 staff and offering to recover lost money. The IC3 will never contact you first, so go to ic3.gov yourself.

Make the callback rule the first thing you change. It costs nothing and stops most of these scams. For a second look at your mailbox settings and sign-in alerts, book a 15-minute call.

Related reading: How to prevent a data breach: 10 steps for small businesses, What is password spraying? How it works and how to stop it and What is malvertising? Why clicking search ads can lead to malware.

Frequently asked questions

How do you prevent business email compromise?

Write a payment rule and enforce it: verify any new or changed bank details by calling a number you already have, and require two people for wires and new payees. On the email side, put MFA on every mailbox, set DMARC to p=reject, tag outside mail and alert on new inbox rules. Train staff to stop and verify any request that pushes urgency or secrecy.

How does business email compromise work?

The attacker either fakes an address that looks like someone you know or signs in to a real mailbox with a stolen password. In a takeover, they read the conversations, wait for an invoice to come due, reply in the real thread with new bank details and add an inbox rule that hides the replies. Most cases involve no malware, so antivirus has nothing to catch.

What is business email compromise?

Business email compromise (BEC) is a scam where a criminal poses as someone you trust, such as a vendor, your owner, a client or an employee, and asks for something that sounds routine: pay an invoice to a new account, change a direct deposit, send the W-2s. The FBI’s IC3 counted 24,768 BEC complaints and about $3.05 billion in losses in 2025.