Threats 9 min read

Business Email Compromise: The $2.7 Billion Scam That Targets Your Inbox

The FBI calls BEC the most financially damaging cybercrime. Attackers impersonate your CEO, vendors, and clients — tricking your team into wiring money to fraudulent accounts. No malware, no hacking, just social engineering. Here is how to stop it.

BEC by the Numbers

$2.7B

total BEC losses reported to FBI (2024)

$137K

median loss per BEC incident for small business

71%

of BEC attacks target companies with fewer than 100 employees

What Business Email Compromise Actually Looks Like

Unlike phishing (which casts a wide net), BEC attacks are targeted and sophisticated. The attacker researches your company — who the CEO is, who handles payments, which vendors you work with, when people are on vacation. Then they craft an email that looks exactly like it came from the CEO, a vendor, or a client. The email is urgent, it references real projects and real people, and it asks for a wire transfer or sensitive information.

The four most common BEC scenarios:

👔 CEO Fraud: An email "from the CEO" to the finance person: "I need you to process an urgent wire transfer to close a deal. I am in meetings all day and cannot take a call. Here are the bank details." The email address is spoofed or slightly altered (ceo@yourcompnay.com — note the missing 'a').
🏢 Vendor Impersonation: An email "from a vendor you regularly work with": "We have changed banks. Please update our payment details and send the next invoice payment to this new account." The attacker has been monitoring email threads and knows exactly which vendors to impersonate.
👤 Account Compromise: A real employee's email account is hacked. The attacker reads through email threads, learns the company's payment processes, and sends targeted requests to clients and vendors from a legitimate email address. This is the hardest to detect because the email really does come from the employee's account.
📋 Payroll Diversion: An email "from an employee" to HR: "I have changed banks. Please update my direct deposit information." The employee's salary now goes to the attacker's account. This is particularly common during onboarding when HR expects new bank details.

Why BEC Works — and Why Your Business Is Vulnerable

BEC works because it bypasses every technical security control you have. There is no malware for your antivirus to detect. No malicious link for your spam filter to block. No attachment to sandbox. Just words in an email that look exactly like the words your CEO would write — because the attacker copied them from your CEO's LinkedIn posts and public interviews.

Small businesses are specifically targeted because:

  • Decision-makers are accessible — there is no security team screening emails to the CEO
  • Payment processes are informal — "just send the wire" does not require three levels of approval
  • Employees want to be helpful — especially to the boss, especially when something is "urgent"

⚡ The One Policy That Stops 90% of BEC Attacks

Any financial request received by email must be verified through a SECOND, independent channel before action is taken. Wire transfer request? Call the CEO on a known number (not the number in the email). Vendor bank change? Call your vendor contact at their known phone number. Payroll direct deposit change? Confirm in person or via video call with the employee.

This policy must come from the top and be non-negotiable. The CEO must say: "Even if it looks like it came from me, even if I actually did send it — you verify by phone before sending money." This removes the social pressure that BEC exploits.

BEC Prevention Checklist

  1. Implement the verification policy above. Write it down. Have everyone sign it. Enforce it. No exceptions for "really urgent" requests.
  2. Set up DMARC with p=reject. This prevents attackers from spoofing your domain in email headers. See our DMARC/SPF/DKIM guide for setup instructions.
  3. Enable MFA on all email accounts. The account compromise scenario depends on the attacker being able to log into a real email account. MFA stops this — a stolen password is useless without the second factor.
  4. Add an external banner to all incoming email. Both Google Workspace and Microsoft 365 can prepend a warning like "[EXTERNAL]" to every email that comes from outside your organization. This is not foolproof, but it makes spoofed internal emails slightly harder to miss.
  5. Train your finance and HR teams specifically. These are the two departments that handle money and sensitive data changes. They need targeted BEC training, not just general phishing awareness. Show them real examples of BEC emails.
  6. Flag emails where the display name matches an executive but the email address is external. Advanced email security gateways (Avanan, Proofpoint) do this automatically. For small budgets, create a mail flow rule that prepends a warning.
  7. Review and limit who can approve payments. Reduce the number of people with authority to send wires. Require dual authorization for amounts over a threshold. The fewer people who can say "send money," the fewer targets for BEC attackers.

What to Do If You Have Already Sent the Money

  1. Contact your bank immediately. Ask for the wire transfer to be recalled. This must happen within hours — ideally within minutes. After 24-48 hours, recovery rates drop sharply.
  2. File a report with the FBI's IC3 at ic3.gov. Include the wire transfer details, the attacker's bank account information, and all email headers from the BEC message.
  3. Contact your local FBI field office. The FBI has a Financial Fraud Kill Chain process specifically for BEC. In some cases, they can freeze the recipient account before the money is moved again.
  4. Notify your cyber insurance provider. BEC losses may be covered, but notification timing is critical — many policies require immediate notification.

The Bottom Line

BEC is not a technology problem — it is a process problem. The fix is not a better spam filter. The fix is a policy that says: no financial action happens based on an email alone. Ever. For any amount. No matter how urgent the email sounds or who it appears to come from. Implement that policy today, train your team, and you have eliminated the single most expensive threat to your business.

Related Guides