Business email compromise (BEC)
Also known as: BEC, CEO fraud, wire fraud, invoice fraud, email account compromise
Business email compromise (BEC) is a targeted email fraud where criminals pose as a trusted person (a boss, supplier, or colleague) to redirect payments or steal sensitive information.
It relies on deception rather than malware, which makes it hard for antivirus to catch and expensive when it succeeds.
Business email compromise (BEC), explained at three levels
At home
Think of a forged letter on real company letterhead, signed with your boss's name, asking you to quietly move some money. Business email compromise is the email version. The scammer either fakes the sender or takes over a real mailbox, then asks for a payment, a bank-detail change, or gift cards. There is no virus to detect, just a convincing request built to make you act before you check.
At work
Business email compromise is fraud where criminals pose as an executive, employee, or supplier by email to redirect money or steal data. The usual target is accounts payable: an invoice with new bank details, or an urgent wire request from the 'CEO'. Because the message contains no malware, filters often miss it, and a single transfer can cost a small business tens of thousands of dollars.
At home
BEC comes in a few forms. Display-name spoofing shows your manager's name over a stranger's address. A look-alike domain swaps or adds characters, such as yourcompany-inc.com or rnicrosoft.com. The most dangerous form is account takeover, where the scammer has the real password and sends from the genuine mailbox. Each step up is harder to spot by looking at the address, which is why a phone call to a known number is the reliable check.
At work
In an account-takeover BEC, the attacker phishes one mailbox password, often at a supplier, then quietly reads past invoices and threads. They learn payment schedules, signatures, and who approves what. When a real invoice is due, they reply inside the genuine conversation with new banking details. Common variants include CEO fraud, vendor invoice fraud, payroll diversion, and gift-card requests. MFA blocks most takeovers, and callback verification stops the payment even when the email itself is real.
At home
Once inside a mailbox, attackers create hidden inbox rules that move any reply mentioning 'invoice' or 'payment' to an obscure folder, so the real owner never sees the vendor's confused response. They may watch for weeks to copy tone and timing before striking. While BEC sounds sophisticated, it depends on one weak process. In my view, a call-back rule for any banking change does more than any software product.
At work
Defence spans email, identity, and finance. DMARC at reject blocks exact domain spoofing, and look-alike domain detection catches near misses. In Microsoft 365, audit logging and alerts on new inbox rules or external forwarding expose takeovers, while conditional access blocks logins from unexpected countries. Finance controls add dual approval and callback verification above a set amount. If money leaves, call the bank and police immediately, because recall requests work best within the first day or two.
Real-world examples
At home
Fatima, an office manager, got an email from the 'owner' asking her to quietly arrange a $5,000 transfer for a confidential deal, stressing not to call because he was in meetings. The secrecy and urgency were red flags. She called anyway, and learned the owner had sent nothing.
At work
Carlos's construction firm nearly paid a supplier invoice to a 'new' bank account announced by email. Their MSP had set a rule that any banking change triggers a callback to the vendor's known number. The vendor confirmed no change was made: the email came from a look-alike domain.
Common confusions
- Antivirus or spam filters will stop BEC — BEC usually contains no malware or malicious link (just text) so technical filters often let it through. People and process controls are the primary defence.
- A real reply in an existing email thread must be legitimate — If an account is compromised, the attacker replies from inside the genuine thread. Always verify money or banking changes by phone, even mid-conversation.
- Only large companies get hit — Small businesses are frequent BEC victims because they rarely have dual-approval payment controls, and a single fraudulent transfer can be devastating.
For analysts
Put a written payment-verification policy in place: no new payee or bank-detail change is actioned without a call-back to a previously known number. This one process control prevents the majority of BEC losses at almost no cost.
History & origin
BEC grew out of spear phishing in the mid-2010s as attackers realized that impersonating executives was more profitable than distributing malware. The FBI began tracking it as a distinct category and reported losses in the billions of dollars, consistently ranking BEC among the costliest cybercrimes. Techniques evolved from simple spoofed 'from' addresses to full account takeovers, where attackers log into a real mailbox and reply within genuine email threads.