What Is Business Email Compromise (BEC)? Attacks, Examples, and Prevention

Most people picture cybercrime as malware — a virus that locks your files, a hacker breaking through a firewall. Business email compromise is quieter and, dollar for dollar, far more expensive. There is no broken lock and no infected attachment. There is just an email that looks exactly like it came from someone you trust, asking you to do something you do every day: pay an invoice, update a bank account, send a wire, forward a file.

That ordinariness is the whole trick. Business email compromise, usually shortened to BEC, is consistently one of the costliest categories of internet crime tracked by the U.S. Federal Bureau of Investigation. Its Internet Crime Complaint Center (IC3) has linked BEC to tens of billions of dollars in exposed losses, and the figure climbs almost every year — even as the number of complaints stays roughly flat, because each successful attack drains so much money. In its 2024 Internet Crime Report, the FBI ranked BEC second among all crime types by dollars lost, despite it being only the seventh most reported.

This guide explains what business email compromise actually is, the five forms it usually takes, how a single attack unfolds from first contact to vanished funds, why it works so reliably even on careful people, what the losses really look like, the real cases that made headlines, and the specific controls that stop it. We will also be honest about where an email client like AI Emaily fits: it can flag the suspicious message and slow you down before a mistake, but the strongest defense against BEC is a process — verifying money and account changes through a second, out-of-band channel — and no software replaces that.

Two quick orientations before we begin. First, BEC is a close cousin of phishing, and the detection instincts overlap heavily; the companion guide on how to spot a phishing email covers the broader category, while this one focuses on the high-value, targeted version aimed at organizations and their money. Second, the mindset that runs through everything here is the same one that protects you from any email attack: treat email as untrusted input. A message in your inbox is a claim — about who sent it and what they want — not a fact. Verifying that claim before you move money is the entire game.

What is business email compromise?

Business email compromise is a form of targeted email fraud in which an attacker impersonates a trusted party to manipulate an employee into transferring money or handing over sensitive information. The trusted party is almost always someone the victim has a reason to obey or to help quickly: a chief executive, a chief financial officer, a long-standing supplier, an outside attorney, or the company's own HR or payroll team.

Unlike mass phishing, which sprays millions of generic lures hoping a few people click, BEC is deliberate and research-driven. The attacker studies the target organization — often using nothing more than the company website, LinkedIn, press releases, and earlier leaked emails — to learn who approves payments, who reports to whom, which vendors send invoices, and how internal requests are usually phrased. The result is a message that fits the rhythm of the victim's normal workday so well that it never triggers suspicion.

Two features set BEC apart from almost every other cyberattack. First, it usually carries no malware. There is no virus to detect, no malicious link a scanner can necessarily catch, often no attachment at all — frequently just plain text. That means traditional antivirus and many email filters have nothing technical to flag. Second, it relies entirely on social engineering: the attack lives in the words, the names, the tone, and the timing, not in the code. BEC weaponizes trust and routine, which is exactly why it slips past defenses built to catch software.

The FBI also uses a closely related term, email account compromise (EAC), for cases where the attacker has actually broken into a real mailbox rather than merely spoofing one. EAC and BEC overlap heavily in practice: a compromised account is often the launchpad for a BEC scam, because an email sent from the genuine address is far more convincing than a look-alike. Throughout this guide we treat them together, the way the FBI's own reporting does.

What are the main types of business email compromise?

Investigators and security teams generally group BEC into five recurring patterns. They share the same DNA — impersonate a trusted party, manufacture urgency, redirect money or data — but each targets a different role and exploits a different routine. Knowing the shape of each one makes the next suspicious email far easier to recognize. The table below is the quick reference; the sections after it explain each in turn.

1. CEO fraud (executive impersonation)

CEO fraud is the classic, headline-grabbing form of BEC and one of the most financially damaging. The attacker poses as a senior executive — the chief executive, the chief financial officer, a founder, a managing director — and emails an employee with the authority to move money, or that person's assistant. The message asks for an urgent wire transfer, usually tied to a confidential reason the recipient cannot easily verify: a secret acquisition, a sensitive vendor settlement, a deal that closes today.

The power of this attack is the authority gradient. When an email that appears to come from the boss says it is urgent and confidential and asks you not to discuss it, most employees feel real pressure to comply quickly and quietly — which is exactly the behavior the attacker needs. The request is plausible because executives genuinely do send urgent, sensitive instructions. The fraud hides inside a normal-looking exception.

CEO fraud is often executed through a spoofed or look-alike address rather than a hacked one. The display name reads correctly, but the underlying address is subtly wrong, or replies are quietly redirected to an address the attacker controls. We will see exactly how that mechanism works later in this guide, and the companion piece on email spoofing breaks the technical side down in detail.

2. Vendor and invoice fraud

Vendor fraud — sometimes called vendor email compromise, or VEC — has in recent years overtaken CEO fraud as the most common and lucrative form of BEC. Here the attacker impersonates a supplier the company already pays, then targets the accounts-payable team. The message announces a change of banking details — "we have switched banks, please update our payment information" — and redirects the next legitimate invoice payment into the attacker's account.

What makes vendor fraud so dangerous is that the underlying invoice is often completely real. The company genuinely owes the money; the goods or services were genuinely delivered. The only thing the attacker changes is the destination account. Because the payment itself is expected, nothing about it looks out of place — and the fraud may not surface for weeks, until the real supplier calls to ask where its money is.

These attacks frequently begin with a compromised mailbox somewhere in the supply chain. If the attacker has broken into the real vendor's email, the request can arrive from the genuine address, in the middle of a genuine thread, referencing a genuine invoice number. That is account takeover feeding vendor fraud, and it is one of the hardest BEC variants to catch by eye.

3. Payroll diversion

Payroll diversion is a quieter, smaller-dollar form of BEC that targets a different routine entirely. The attacker poses as an employee — or sometimes as HR or the finance department — and emails payroll asking to update direct-deposit details. "I've changed banks; please send my next paycheck to this new account." The next payroll run deposits that employee's salary straight into the fraudster's account.

Individually these thefts are small compared with a six-figure wire, which is part of why they succeed: a single redirected paycheck rarely sets off the alarms a large transfer would. But attackers run them at scale across many employees and many organizations, and the victim — the employee whose pay vanished — often does not notice until payday. Because the request looks like a mundane HR housekeeping task, it sails through unless payroll has a hard rule to verify every banking change directly with the employee, through a channel other than the email that asked for it.

4. Attorney impersonation

Attorney impersonation exploits the special weight people give to anything that sounds legal. The attacker poses as a lawyer or a member of a law firm and contacts an employee — often deliberately choosing someone junior, newly hired, or otherwise unlikely to push back on a senior outside professional. The message references a confidential legal matter, insists on secrecy, and applies time pressure: a deadline today, a court matter, a deal that will collapse without immediate funds.

Legal language carries built-in intimidation. Phrases like "privileged and confidential," "per the executed agreement," or "the partners have authorized this" discourage the recipient from asking the obvious questions or looping in a colleague. Attorney-impersonation BEC is often timed to coincide with periods when scrutiny is naturally lower — late on a Friday, around a holiday, or during a real transaction such as an acquisition, when sensitive, lawyer-driven payment requests would not seem unusual.

5. Account takeover and data theft

The fifth type is the most insidious because no impersonation is required at all. In account takeover, the attacker has actually gained control of a legitimate email account — through phishing, a reused password exposed in a breach, or a session token stolen by a proxy that defeats some forms of multi-factor authentication. From inside the real mailbox, the attacker can read past conversations, learn the company's payment habits, set quiet inbox rules to hide their tracks, and then send fraudulent requests from the genuine address.

Because the email originates from the authentic account, it passes every authentication check — SPF, DKIM, DMARC — and lands in the middle of a real, ongoing thread. There is no spoofing to detect and no look-alike domain to spot. This is also the form most often used for data theft rather than direct money movement: the attacker uses a trusted internal account to request tax forms, employee records, customer lists, or other sensitive data, which is then sold or used to fuel the next fraud.

Account takeover ties the other four types together. A hijacked executive account makes CEO fraud nearly undetectable; a hijacked vendor account makes invoice fraud devastating. This is why protecting accounts from being compromised in the first place — with strong authentication and phishing-resistant logins — is as central to stopping BEC as spotting a forged sender.

How does a business email compromise attack unfold?

A successful BEC scam is rarely a single email out of nowhere. It is a sequence — patient reconnaissance, careful setup, a precisely timed strike, and a fast cash-out before anyone notices. Understanding the timeline shows you where the attack can be interrupted, because there is a window at almost every step.

1. 1

   Reconnaissance

   The attacker researches the target organization using public sources — the company website, LinkedIn, news, social media — and any previously leaked emails. They map who approves payments, the reporting chain, which vendors invoice the company, and how internal requests are usually worded.

2. 2

   Foothold or impersonation setup

   The attacker either compromises a real mailbox (via phishing or a stolen password) or sets up the impersonation: a look-alike domain, a spoofed display name, or a reply-to address they control. If inside a real account, they may add hidden inbox rules to quietly auto-delete or divert replies.

3. 3

   The pretext

   The fraudulent message arrives, crafted to fit the victim's routine — an urgent executive wire, a vendor's updated bank details, a payroll change, a lawyer's confidential request. It carries plausible authority and a reason the recipient cannot easily verify in the moment.

4. 4

   Pressure and the request

   The attacker manufactures urgency and discourages verification: the deadline is today, the matter is confidential, the boss is in a meeting and cannot take a call. The goal is to push the victim to act fast and alone, before they think to confirm through another channel.

5. 5

   The transfer

   The victim sends the wire, updates the vendor's banking details, or redirects the deposit. The money lands in an account the attacker controls — often overseas, sometimes in cryptocurrency, and frequently moved again within hours.

6. 6

   The laundering and the disappearance

   Funds are rapidly layered through mule accounts and converted, making recovery hard once the trail goes cold. The fraud is often discovered days or weeks later — when a real vendor asks where its payment is, or finance reconciles the books — by which point the money is usually gone.

The critical insight from this timeline is that the decisive moment is the fourth step, the request itself. Before the money moves, a single phone call to a known number — not one supplied in the email — collapses the entire scheme. That is why every prevention framework in the world keeps returning to the same humble control: verify out of band before you pay. Everything else exists to make that verification more likely to happen.

Why does business email compromise work so well?

BEC succeeds against intelligent, careful people for reasons that have far more to do with psychology and process than with technology. Five factors do the heavy lifting.

• No malware to detect. With no virus, often no attachment, and sometimes no link, there is frequently nothing technical for antivirus or basic filters to catch. The attack is plain text that says the wrong thing, and software built to find malicious code has nothing to find.
• It exploits authority and trust. A request that appears to come from the CEO, a partner law firm, or a long-standing vendor carries social weight. People are wired to comply with authority and to help trusted contacts quickly — and BEC aims that instinct straight at the company bank account.
• It manufactures urgency. "Today," "before the deal closes," "the partners are waiting." Time pressure is engineered to short-circuit the deliberate, skeptical thinking that would otherwise catch the fraud. A rushed brain skips verification.
• It hijacks normal routines. Paying invoices, updating vendor details, processing payroll changes, sending wires — these are ordinary tasks. The fraudulent request hides inside work the victim does all the time, so nothing feels out of place.
• It abuses how email trust is displayed. Most people judge a sender by the display name, which is trivially forgeable. Spoofing, look-alike domains, and reply-to redirection all exploit the gap between what an email appears to be and what it actually is.

The role of spoofing deserves emphasis. Email was designed in an era of mutual trust, and the "From" line a recipient sees is essentially a label the sender chooses. Authentication standards — SPF, DKIM, and DMARC — were added later to let domains prove their mail is genuine, and when fully enforced they block a large share of outright domain spoofing. But attackers route around them: they register look-alike domains that pass their own authentication, they hijack real accounts that pass every check, or they simply forge a display name while using a throwaway address the recipient never inspects. The companion guide on email spoofing walks through exactly how forged senders work and how the authentication records are supposed to stop them.

The newest accelerant is artificial intelligence. Generative tools let attackers write flawless, on-brand messages in any language, instantly, with none of the clumsy grammar that used to give scams away. They can also be tuned to mimic a specific executive's writing style scraped from public posts. Most alarmingly, attackers have begun pairing email pretexts with deepfaked voice and video. In one widely reported 2024 case, a finance employee at the engineering firm Arup was lured onto a video call populated entirely by AI-generated deepfakes of the company's CFO and colleagues, and authorized transfers totaling roughly $25 million. The lesson is sobering: in the AI era, looking and sounding right is no longer proof of anything. Only an independent, out-of-band check is.

How much money does business email compromise cost?

The numbers are the reason BEC sits near the top of every security team's agenda. The most authoritative figures come from the FBI's Internet Crime Complaint Center (IC3), which publishes an annual report and periodic public-service alerts on BEC specifically. Two things stand out in that data: the totals are enormous, and the per-incident losses are far larger than for most other cybercrimes.

In its 2024 Internet Crime Report, the IC3 attributed about $2.77 billion in losses to BEC across roughly 21,400 complaints — second only to investment fraud in total dollars lost, even though six other crime types generated more complaints. That pattern holds year over year: BEC consistently ranks among the very costliest categories despite a relatively modest complaint count, because each successful scam steals so much. The same report put total losses across all internet crime in 2024 at a record $16.6 billion, up about a third on the prior year.

Zoom out and the cumulative scale becomes clear. The FBI's dedicated BEC alerts, which combine domestic and international complaint data, have tracked exposed losses climbing through the years — from "the $26 billion scam" to "the $43 billion scam" and, by the FBI's 2024 alert, a more than $55 billion problem globally over roughly a decade of reporting. The table below shows the recent U.S. trend reported to the IC3.

A few caveats make these figures more meaningful, not less. First, they reflect only what was reported to the FBI; the true cost is certainly higher, because embarrassment, fear of reputational damage, and uncertainty about who to call keep many victims silent. Second, "losses" here means exposed dollar loss — the amount put at risk — and rapid reporting genuinely helps: the FBI's Recovery Asset Team has frozen and returned substantial sums when victims act within the first 24 to 72 hours. Third, BEC is not a big-company problem. Small and mid-sized businesses, school districts, local governments, nonprofits, and individuals making large payments — most painfully, home buyers wiring closing funds in real-estate transactions — are all squarely in the crosshairs.

What are some real examples of business email compromise?

BEC is not a hypothetical risk discussed only in security briefings. Some of the largest, best-documented frauds on record were ordinary-looking emails that redirected very real money. A handful of cases show the range — from look-alike vendors to deepfaked executives.

• Facebook and Google — about $120 million. Between roughly 2013 and 2015, a Lithuanian man, Evaldas Rimasauskas, impersonated a real hardware manufacturer the two tech giants did business with, sending convincing fake invoices that routed payments to accounts he controlled. He was later sentenced to five years in U.S. federal prison. It remains one of the starkest proofs that even the most sophisticated companies are vulnerable to invoice fraud.
• Ubiquiti Networks — about $46.7 million. In 2015, attackers impersonated executives and outside entities to send wire instructions to the networking company's finance staff, who transferred tens of millions to overseas accounts before the fraud was caught. The company recovered only part of the funds.
• Toyota Boshoku — about $37 million. In 2019, a European subsidiary of the Toyota auto-parts supplier was deceived by a BEC scam in which an attacker posing as a business partner persuaded finance staff to send a payment to a fraudulent account.
• Arup — about $25 million. In 2024, an employee at the global engineering firm's Hong Kong office was tricked into authorizing 15 transfers after joining a video call on which the CFO and other colleagues were AI-generated deepfakes. It is one of the first headline cases pairing a BEC pretext with deepfaked video, and a preview of where the threat is heading.

Those headlines matter, but the everyday version of BEC is far more mundane — and that is exactly why it works so often against ordinary businesses. The example below is the kind of message a small accounts-payable team sees, and it is the one that quietly drains the most money in aggregate.

How do you prevent business email compromise?

Because BEC blends a technical channel with a human decision, the only durable defense blends technical and human controls. No single product stops it. The good news is that a short, disciplined set of measures stops the overwhelming majority of attacks — and the most important one costs nothing but a phone call. Layer the controls below; the table after them maps each one to the attack types it disrupts.

Verify payment and account changes out of band

This is the single most effective control against BEC, and it belongs first for a reason. For any request to send a wire, change banking details, or alter a payment destination, confirm it through a separate, trusted channel before acting — a phone call to a number you already have on file, not one provided in the email; or an in-person conversation. The principle is simple: never let the same channel that requested the money also be the one that verifies it. If the email is fraudulent, the verification call goes to the real person and the scheme collapses on the spot.

Make this a non-negotiable written policy, not a judgment call, and explicitly cover the urgency excuse. Attackers will always claim there is no time to verify. The policy must state that there is always time to verify, that secrecy and time pressure are themselves red flags, and that no employee will ever be blamed for slowing a payment to confirm it.

Require dual approval for payments

Above a sensible dollar threshold, require two people to approve any payment or any change to payment details. Dual control means a single deceived employee cannot, by themselves, send money out the door — a second set of eyes has to agree, and that second person may well be the one who pauses to ask, "Did anyone actually confirm this?" Pair the threshold with extra scrutiny for first-time payees and for any change to existing banking instructions, which is the highest-risk event of all.

Turn on multi-factor authentication everywhere

Multi-factor authentication (MFA) directly attacks the account-takeover variant of BEC, which is the engine behind the most convincing attacks. If an attacker cannot get into the real mailbox, they cannot send fraud from a genuine address or lurk inside real threads. MFA is widely credited with blocking the large majority of automated account-compromise attempts, and it is now treated as a baseline requirement across major security frameworks. Prefer phishing-resistant methods — passkeys or hardware security keys — over SMS codes, which determined attackers can intercept or socially engineer around. The companion guide on two-factor authentication for email walks through the setup.

Deploy and enforce DMARC, SPF, and DKIM

Email authentication makes your own domain far harder to spoof, which protects your customers, vendors, and staff from impersonation of your brand. SPF declares which servers may send mail for your domain, DKIM cryptographically signs your messages, and DMARC ties them together and tells receiving servers what to do with mail that fails — ideally to reject or quarantine it. Major mailbox providers have moved DMARC from a nice-to-have toward a practical requirement for bulk senders, and a policy of "reject" closes the door on the crudest spoofing of your domain. It will not stop look-alike domains or hijacked accounts, which is why it is one layer among several — but it is a foundational one.

Train people on the specific patterns

Since BEC targets human judgment, human judgment has to be trained. Effective programs go beyond generic "don't click links" advice and teach the concrete BEC patterns: requests to change banking details, unexpected urgency from an executive, secrecy demands, pressure to bypass normal process, and small mismatches in sender addresses. Crucially, modern training must update people on AI: scams no longer have telltale typos, and voices and faces on a call can be faked. The goal is a culture where pausing to verify a payment is celebrated, not seen as slow, and where any employee feels safe challenging an unusual request — even one that appears to come from the top.

How does AI Emaily help defend against BEC and phishing?

We will be straight about this, because honesty is the only useful posture in security: AI Emaily does not, by itself, stop business email compromise. Nothing does. The controls above — out-of-band verification, dual approval, MFA, DMARC, and training — are the real defense, and they live in your processes and your people, not in an inbox. What an email client can do is tilt the odds: surface the warning at the moment of risk, treat every message as untrusted, and refuse to let the AI act on your behalf without your explicit say-so. That is the role AI Emaily is built to play.

AI Emaily is an AI-native email client that works across every provider — Gmail, Outlook, and any standard mailbox — and it is built privately, so your mail is never used to train models. Three design choices make it a genuine ally against BEC and phishing specifically.

• It flags phishing, BEC, and scam patterns with its own detection. AI Emaily runs its own algorithm to spot the hallmarks of these attacks — payment-change requests, manufactured urgency, suspicious sender behavior, and the social-engineering patterns described throughout this guide — and surfaces a clear warning before you act, when a moment's pause matters most.
• It shows spoofing and suspicious-sender warnings. When a message comes from a look-alike domain, fails authentication, or otherwise does not add up, AI Emaily calls it out plainly instead of letting a forged display name pass unquestioned — directly countering the trust-display weakness that BEC exploits.
• It treats all email as untrusted input. AI Emaily is engineered on the assumption that the contents of any message could be hostile, including attempts to manipulate the AI itself through hidden instructions (prompt injection). It will not blindly follow commands buried in an email, which keeps an attacker from turning your own assistant against you.

The most important guardrail is the simplest. AI Emaily keeps a human in the loop: it requires your explicit approval before anything is ever sent. The AI can read, sort, summarize, and draft, but it does not send a reply, forward a file, or act on a request on its own. So even if a cleverly crafted BEC email tries to coax an automated response, there is always a person — you — between the message and the action. That design choice mirrors the very control that defeats BEC in the first place: a human pause before money or data moves.

Put plainly: use AI Emaily for the detection, the spoofing warnings, the untrusted-by-default handling, and the human-approval gate — and keep your out-of-band verification and dual-approval processes for the money itself. Together, the software and the process cover far more ground than either does alone.

The bottom line

Business email compromise is the quiet giant of cybercrime: no malware, no broken locks, just a trusted-looking email that moves real money. It costs billions every year by the FBI's own count, it strikes companies of every size, and it works precisely because it hides inside the ordinary work of paying invoices and trusting colleagues. Generative AI has only sharpened it, erasing the spelling mistakes that used to give scams away and adding deepfaked voices and faces to the toolkit.

But BEC is also one of the most preventable cybercrimes, because its decisive moment is so clear. Before money moves, verify the request through a second, trusted channel. Require two approvers for payments. Lock down accounts with strong, phishing-resistant authentication. Enforce DMARC so your domain cannot be easily spoofed. And train your people on the real, modern patterns. Layer those, and you close the window the attacker depends on.

An email client cannot replace that process, and AI Emaily does not pretend to. What it can do is stand at the point of risk — flagging the phishing and BEC patterns, warning you about spoofed senders, treating every message as untrusted, and never sending anything without your approval. Pair a vigilant inbox with a disciplined process, and the costliest email scam in the world becomes a scam you are ready for.