AsGuardian Shield
Search
Cybersecurity,  Identity Protection

Business Email Compromise: How These Scams Work

Author

Vineeth Vijayan Nair

Published

Updated

Reading time

4 min

Hooded attacker guiding an executive to approve a fraudulent payment from a spoofed email — illustrating business email compromise
In this articleShow
  1. How BEC attacks work
  2. The most common BEC variants
  3. Red flags to train people on
  4. Controls that actually stop BEC
  5. What to do if you've been hit
  6. Frequently asked questions
Hooded attacker guiding an executive to approve a fraudulent payment from a spoofed email — illustrating business email compromise

Short answer: Business email compromise (BEC) is a scam where criminals impersonate an executive, employee or supplier by email to trick someone into sending money or sensitive data. It usually involves no malware at all — just a convincing message and pressure to act quickly — which is why email security tools often miss it. According to the FBI's 2025 Internet Crime Report, BEC caused about $3.05 billion in reported losses from roughly 24,800 complaints, making it one of the costliest forms of cybercrime. The single best defense is a rule that every payment change is verified by phone using a number you already have.

How BEC attacks work

  1. Research. Attackers study the company website, LinkedIn, press releases and social media to learn who approves payments, who the suppliers are and how people write.
  2. Access or impersonation. They either spoof an address (a lookalike domain such as `examp1e.com`, or a display name that says "CEO"), or compromise a real mailbox through phishing or credential stuffing so they can send from the genuine account and read real threads.
  3. The request. A message arrives at the right moment — an invoice with "updated bank details," an urgent wire before a deal closes, a request for employee W-2 data, or gift cards for a "client thank-you."
  4. Pressure and secrecy. "I'm in a meeting, just get it done." "Keep this confidential until the announcement."
  5. Cash-out. Funds go to accounts controlled by money mules and are moved quickly, often abroad.

The most common BEC variants

Variant

What it looks like

CEO fraud

An "executive" asks finance to send an urgent wire

Fake invoice / vendor change

A "supplier" sends new bank details for upcoming payments

Account compromise

A real employee's mailbox is used to request payments from customers

Attorney impersonation

Someone claiming to be a lawyer pressures staff over a confidential deal

Data theft

HR or payroll is asked for employee tax or personal data

Payroll diversion

An "employee" asks HR to change their direct-deposit account

Red flags to train people on

  • Any change to payment details, especially by email only.
  • Urgency, secrecy or a request to bypass normal approval.
  • A sender address that is almost right, or a reply-to address that differs from the sender.
  • Requests for gift cards.
  • Unusual timing (late Friday, holidays, while the executive is traveling).

Controls that actually stop BEC

1. Out-of-band verification (the most important control)

Any request to change bank details or send an unusual payment must be confirmed by calling a phone number already on file — never one from the email. Make this a written policy so staff feel empowered to delay a "CEO" request.

2. Dual approval for payments

Require two people to approve new payees and payments above a threshold.

3. Email authentication: SPF, DKIM and DMARC

These standards let receiving servers check that email claiming to be from your domain really is. Publishing a DMARC policy of `quarantine` or `reject` makes it much harder to spoof your exact domain. Check your setup with our free Domain Security Report, and inspect suspicious messages with the Email Header Analyzer.

4. Protect mailboxes from takeover

Turn on MFA for every email account (phishing-resistant methods like passkeys or security keys for finance and executives), and alert on suspicious inbox rules — attackers often create rules that hide replies from the real owner.

5. Flag external and lookalike senders

Configure your email system to tag external mail and warn about lookalike domains of your own and your key suppliers'.

What to do if you've been hit

  1. Call your bank immediately and ask it to recall the transfer. Speed matters most in the first 24–72 hours.
  2. File a complaint with the FBI's IC3 at ic3.gov (in the US); the FBI's Recovery Asset Team works with banks to freeze funds.
  3. Secure the compromised mailbox: reset passwords, revoke sessions, remove malicious forwarding rules and enable MFA.
  4. Warn suppliers and customers if your mailbox was used to send fraudulent requests.
  5. Review what else the attacker could see in the mailbox.

Frequently asked questions

How is BEC different from phishing?

Phishing usually tries to steal credentials or install malware through links and attachments. BEC usually contains no link or attachment — it persuades someone to send money or data directly.

Can email security software stop BEC?

It helps, especially with DMARC enforcement and lookalike-domain detection, but because BEC messages are often plain text with nothing malicious to scan, process controls such as callback verification remain essential.

Are small businesses targeted?

Yes. Small businesses often have fewer approval steps, which makes them attractive targets.

Sources

Keep reading