Business Email Compromise (BEC): How the Scams Work and How to Stop Them

The request looks routine. A supplier has a new bank account. The CEO needs a transfer done today and asks you to keep it quiet. A colleague in HR has changed banks. Each email is plausible on its own, and that is the point. BEC does not break into systems. It slips into normal business processes and relies on someone doing their job.

This guide covers how the main variants work, what they cost, the red flags for each, the controls that actually stop them and what to do if a payment has already gone out.

What is business email compromise?

Business email compromise is a social engineering attack on a company's payment and approval processes. The attacker takes on a trusted identity and then asks for something that person would plausibly ask for: a wire transfer, a change of bank details, a list of employees, or gift cards for a "client event".

The identity comes from one of three places:

• A lookalike domain that the attacker registered, such as examp1e-group.com instead of example-group.com. These domains can pass every email authentication check because the attacker controls them.
• A spoofed sender, where the email claims to come from your real domain. This only works if the domain has no enforced DMARC policy. Our guide to email spoofing explains how to close that gap.
• A real mailbox that has been taken over, usually through stolen credentials. The FBI calls this email account compromise (EAC). It is the hardest variant to spot because the sender, the signature and the email thread are all genuine. See account takeover.

What separates BEC from ordinary phishing is the payload. Phishing wants a click on a link or an attachment. BEC wants a person to carry out a normal business action for the wrong recipient. That is why spam filters, antivirus software and link scanners offer little protection against it.

How much does BEC cost? The 2025 figures

The most complete public data comes from the FBI's Internet Crime Complaint Center (IC3), which collects complaints from US victims.

• In its 2025 Internet Crime Report, the FBI lists BEC losses of $3,046,598,558 from 24,768 complaints. Only investment fraud caused higher losses. Across all categories, the IC3 received 1,008,597 complaints and $20.9 billion in reported losses.
• The same report counts more than $30 million in 2025 BEC losses where businesses reported the use of AI, for example cloned voices requesting a wire payment.
• A 2024 FBI public service announcement, "Business Email Compromise: The $55 Billion Scam", puts exposed losses at $55.5 billion across 305,033 incidents worldwide between October 2013 and December 2023.
• Verizon's 2025 Data Breach Investigations Report puts the median amount taken in a BEC case at around $50,000. Most cases are not the eight figure headlines.
• In Europe, the ENISA Threat Landscape 2026 lists business email compromise and payment diversion among the fraud schemes that remained widespread in 2025. Phishing made up 77.8% of the social engineering techniques ENISA observed.

These are reported cases. Many companies never file a complaint, so the real figures are higher.

Two cases that show the range

In August 2016 the German automotive supplier Leoni disclosed that fraudsters had used forged documents, fake identities and electronic communication to move around €40 million to accounts abroad. The company cut its operating profit forecast for the year from €105 million to €65 million.

In January 2024 an employee of the engineering firm Arup in Hong Kong transferred about HK$200 million (around $25 million) after a video call in which the CFO and several colleagues were deepfakes. Arup confirmed the case to CNN in May 2024 and said none of its internal systems had been compromised. The attack needed no hacking at all, only a believable request and a convincing face on screen.

How does a BEC attack work, step by step?

Most BEC cases follow the same four stages, whether the attacker poses as the CEO or as a supplier.

1. Research. Attackers map who approves payments, who the main suppliers are and how people write. Websites, LinkedIn, press releases and job ads supply most of it. Our article on LinkedIn impersonation shows how much an executive profile gives away.
2. Setting up the identity. They register a lookalike domain, set up a free mail account with the right display name, or take over a real mailbox through credential phishing. In a campaign Microsoft described in September 2026, the attackers registered a lookalike of a well known software vendor's domain on 31 July and sent more than a million fake executive emails with invoices for nearly $50,000 between 3 and 5 August.
3. The request. The email is short, uses the right names and adds pressure: a deadline, a confidential deal, an auditor waiting. Microsoft's Q1 2026 email threat report counted about 10.7 million BEC attacks in that quarter. More than 80% of first messages were generic outreach, and only about one in ten asked directly for money or documents. The payment request comes once someone has replied.
4. Cash out. The money goes to a mule account and is moved on within hours, often abroad or into cryptocurrency. Every hour of delay makes recovery less likely.

Which types of BEC are there, and how do you spot them?

The table lists the five variants finance and HR teams meet most often, the signs that give each away and the control that stops it.

Related terms in our glossary: CEO fraud, whaling, executive impersonation and vishing, the phone call that often follows the email.

Red flags that apply to every variant

• The display name is right, but the address behind it is not. Look at the full domain, character by character. rn looks like m, and Cyrillic letters can look identical to Latin ones (homoglyph domains).
• Replies would go to a different address than the sender (a changed Reply-To).
• The request asks you to skip a step: no purchase order, no second signature, no call.
• Secrecy and urgency come together. Real executives rarely need both at once.
• The conversation moves to WhatsApp, a private number or a video call that someone else set up.

How can you protect your company from BEC?

BEC exploits process, so most of the defence is process. Technology helps at the edges. This checklist is ordered by how much each step reduces risk for the effort it takes.

1. Callback rule for bank details. Every change of supplier, customer or employee bank details is confirmed by phone, using a number from your own records and never one from the email. Write it down as policy so nobody has to feel awkward about calling the CEO.
2. Two people for every payment above a threshold. Separate the person who can change vendor master data from the person who releases payments.
3. A cooling-off period for new accounts. The first payment to a newly changed account waits 24 hours and is checked again.
4. Take payee name checks seriously. Since 9 October 2025, banks in the euro area check the payee name against the IBAN on euro transfers (EU Regulation 2024/886). A "no match" on a supplier's new bank details is a reason to stop. Ask your bank whether the check also covers bulk payment files sent from your accounting software.
5. Phishing-resistant MFA on all mailboxes. Passkeys or hardware keys make credential phishing much harder. Alert on new forwarding and inbox rules, a classic sign of a compromised account.
6. SPF, DKIM and DMARC at p=reject. This closes exact-domain spoofing of your own domain. Our email spoofing guide walks through the rollout.
7. External sender warnings. Tag mail from outside the organization, and flag external messages that use an internal display name.
8. Watch for lookalike domains. Track new registrations that resemble your domain and, ideally, your most important suppliers' domains. A lookalike that gets mail records set up is a strong warning sign. Domain monitoring does this continuously.
9. Train the people who move money. Finance, accounts payable, HR and executive assistants need real examples, including voice and video deepfakes, and explicit permission to delay any "urgent" request until it is verified.
10. Have a plan for the first hour. Decide in advance who calls the bank, who reports the case and where the bank's fraud hotline number is kept.

What should you do if you already paid?

Speed matters more than anything else. In 2025 the FBI's Recovery Asset Team handled 3,900 cases through its Financial Fraud Kill Chain and froze $679 million of $1.16 billion in attempted theft, according to the IC3 report. Those results depend on the bank and law enforcement hearing about the transfer while the money is still in the first account.

1. Call your bank immediately. Ask for a recall of the transfer and for the receiving bank to freeze the funds. Have the date, amount, account numbers and transaction reference ready. The FBI's BEC guidance recommends this as the first step.
2. Report it the same day. In the US, file a complaint at ic3.gov and contact your local FBI field office. In the UK, report to Report Fraud, which replaced Action Fraud in December 2025. In Germany, companies can reach the police's dedicated cybercrime contact points for businesses, the ZAC. Elsewhere, report to your national police.
3. Keep the evidence. Do not delete the emails. Save them with full headers, plus invoices, call logs and chat messages.
4. Check your own mailboxes. Reset passwords, end active sessions and look for forwarding or inbox rules the attacker may have created. If a mailbox was compromised, assume other contacts received fake invoices too.
5. Warn the people being impersonated. Tell the real supplier, and if customers received fake invoices in your name, tell them which bank details are valid.
6. Get the lookalike domain taken down. If the attack came from a domain imitating yours, a takedown stops the next wave. Our hosting lookup shows the registrar and host, and a website scan keeps a record of any page on it.
7. Notify your insurer and check reporting duties. Cyber and crime policies often have short notice periods. If personal data was exposed, data protection law may require you to report it, under the GDPR within 72 hours. Companies covered by the EU's NIS2 rules must send an early warning about significant incidents within 24 hours; in Germany that has applied since 6 December 2025.

Where nebty helps

nebty does not sit in your inbox or your payment workflow. We cover the domain side of BEC. Our system checks new domain registrations against your brand and domain names, usually flags a suspicious lookalike within hours of registration and scores it by risk. When a domain is being used against you, we handle the takedown with the registrar and host, and you pay only for takedowns that succeed.

For executive impersonation that runs across email, social media and fake websites at the same time, see our brand impersonation protection.

Frequently asked questions about BEC