Business Email Compromise (BEC) Prevention

Business email compromise (BEC) is one of the costliest forms of cybercrime reported to the FBI. The FBI Internet Crime Complaint Center’s 2025 Internet Crime Report recorded 24,768 BEC complaints and $3.05 billion in losses in 2025, up from $2.77 billion in 2024. Among the crime types IC3 tracks, only investment fraud ($8.65 billion) cost victims more. An earlier IC3 public service announcement put domestic and international “exposed” BEC losses between October 2013 and December 2023 at $55.5 billion.

Industry data points the same way. In APWG’s Phishing Activity Trends Report for Q2 2026, email security firm Fortra reported that the number of wire-transfer BEC attacks it observed rose 88% over the previous quarter, and the average amount requested climbed 45% to $61,732. The Association for Financial Professionals’ 2026 Payments Fraud and Control Survey, which polled 465 treasury practitioners, found that 74% of their organizations were affected by BEC in 2025.

BEC manipulates business processes rather than software. The FBI describes it as a scam in which fraudsters compromise email accounts and other channels, such as phone numbers and virtual meeting applications, through social engineering or computer intrusion in order to make unauthorized transfers of funds. Attackers impersonate executives, vendors, attorneys, or business partners to redirect payments or obtain sensitive data.

Five Common BEC Patterns

1. CEO Fraud

The attacker impersonates the CEO or another executive and emails the CFO, controller, or accounting staff requesting an urgent wire transfer. These requests stress confidentiality (“Don’t discuss this with anyone yet”) and urgency (“Must be completed today”). The IC3 report notes that voice cloning can also be used to request a wire payment, and businesses reported more than $30 million in 2025 losses to BEC scams involving AI. See our whaling guide for executive impersonation defense.

2. Invoice Manipulation

Attackers compromise or impersonate a vendor’s email account and send modified invoices with new payment routing. The invoice looks legitimate because it references real purchase orders, contract numbers, and amounts; only the bank details have changed. A variant bills for services that were never ordered. Fortra attributes much of the recent rise in wire-transfer BEC to a group known as Scripted Sparrow, which sends accounts payable teams fake executive-coaching invoices along with a spoofed email thread designed to make the expense look approved by a company executive.

3. Account Compromise

An employee’s mailbox is taken over, usually through phishing or a reused password, and the attacker uses it to send payment requests to the company’s vendors or customers. Because the message comes from a real account and passes email authentication checks, the request itself is often the only warning sign.

4. Attorney Impersonation

Attackers pose as lawyers or legal representatives involved in confidential matters such as acquisitions, settlements, or property closings, using the confidential nature of legal work to justify secrecy and speed. The IC3 report describes an August 2025 case in which homebuyers received an email impersonating their attorneys and wired more than $449,000. After they filed an IC3 complaint, the recipient bank confirmed the full amount was still in the account and placed it on hold.

5. Data Theft

Not every BEC attempt asks for money. The FBI notes variants in which attackers use compromised business accounts to request employees’ personal information. HR and payroll staff are typical targets, because W-2 forms and tax records enable identity theft and tax fraud. Schools and healthcare organizations, which hold payroll and personal data for large workforces, face the same risk; see our education and healthcare guides.

How a BEC Attack Unfolds

Reconnaissance: The attacker researches the target’s payment processes, vendors, and key staff.
Access or disguise: They phish a mailbox password, reuse leaked credentials, register a lookalike domain, or spoof a domain that does not enforce DMARC.
Monitoring: With mailbox access, they watch email threads, payment schedules, and writing styles, sometimes for weeks.
Execution: They send the fraudulent request at a moment that discourages checking, such as quarter-end or while an executive is traveling.
Money movement: Funds are moved on quickly. The FBI has reported growth in BEC payments sent to custodial accounts at third-party payment processors, to peer-to-peer payment services, and to cryptocurrency exchanges, with banks in the United Kingdom and Hong Kong often used as intermediary stops for international transfers.

Detection Red Flags

Train finance, accounting, HR, and procurement staff to recognize these indicators:

Payment instruction changes sent by email, especially for established vendors
Unusual urgency on wire transfers, particularly from executives
Confidentiality requests (“Handle this personally, don’t involve others”)
Slight sender discrepancies, such as a domain off by one character or a reply-to address that differs from the sender
Requests for gift cards: in Fortra’s Q2 2026 data, gift cards were the payment type requested in more than half of BEC scams, ahead of wire transfers at 17%
A new destination account, even a domestic one: Fortra reports that Scripted Sparrow’s mule accounts are mostly held at US banks, so a US account is no sign of legitimacy
Requests that bypass normal approval processes

Apply the social engineering red flags framework to any unexpected financial request.

Prevention Controls

Process Controls (Highest Impact)

Control	Implementation
Dual authorization	Require two approvers for wire transfers above a set threshold
Callback verification	Verify payment changes by phone using a number already on file, never one supplied in the request
Payment change hold	Hold new or changed payment instructions (for example, 24 to 48 hours) until they are verified
Vendor master file controls	Keep verified payment details; any change requires out-of-band confirmation
Invoice matching	Match purchase order, receipt, and invoice before payment, which catches bills for services never ordered

Technical Controls

DMARC at p=reject on all organizational domains, including ones that never send mail. It asks receiving servers to reject mail that uses your exact domain in the From address but fails SPF and DKIM alignment. It does not stop lookalike domains, display-name tricks, or mail sent from a genuinely compromised account, so it complements process controls rather than replacing them.
Advanced email filtering with BEC-specific detection, such as anomalous sender behavior and payment-language analysis, plus a visible tag on mail from outside the organization
Full sender addresses: configure mail clients to display the sender’s full email address rather than only a display name, as the FBI recommends
Phishing-resistant MFA to stop the account takeovers that enable many BEC campaigns
Mailbox rule monitoring: alert on new forwarding and inbox rules, which attackers create to hide replies and keep receiving copies of a thread even after a password reset
Zero trust architecture that limits what a compromised account can reach

Training Controls

Phishing simulations using BEC-specific scenarios for finance staff
Regular briefings on current tactics, such as fake invoices and voice-cloned calls
A clear, blame-free escalation path for suspicious financial requests
Role-based training for executives, finance, HR, and procurement

When BEC Succeeds: Response

Speed is the critical variable in BEC recovery. IC3’s Recovery Asset Team (RAT) runs the Financial Fraud Kill Chain (FFKC), which works with banks to freeze stolen funds. In 2025 the RAT initiated 3,900 FFKC incidents involving $1.16 billion in attempted theft and froze $679 million, a 58% success rate. BEC historically made up the majority of these cases, although tech-support and account-takeover cases rose in 2025. In one example from the report, an Oregon city government office lost more than $6 million to BEC in April 2025; because the receiving account had already been flagged and frozen in an earlier case, the recipient bank alerted the city’s bank, which recalled the $6 million wire.

Immediate actions (within hours):

Contact your bank, request a recall of the funds, and ask what indemnification documents it needs
File a complaint at ic3.gov regardless of the amount, with full transaction details
If the transfer was international, ask your bank to contact the intermediary and receiving institutions
Preserve all email evidence: headers, attachments, and the full message chain

Follow-up actions: 5. Engage your incident response team 6. Determine how the attack worked (mailbox takeover, lookalike domain, or spoofing) 7. Check for credential compromise and malicious mailbox rules across the organization 8. Notify affected business partners, your cyber insurer, and local law enforcement as required

See our IC3/FTC reporting guide for detailed reporting procedures.

Key Takeaways

BEC caused $3.05 billion in reported losses in 2025, second only to investment fraud in IC3 data, and $55.5 billion in exposed losses from October 2013 to December 2023
The five common patterns (CEO fraud, invoice manipulation, account compromise, attorney impersonation, data theft) each call for specific countermeasures
Dual authorization, callback verification to known numbers, and holds on payment changes are the core defenses because they work even when an email looks genuine
Report to your bank and IC3 within hours, not days; in 2025 the FFKC froze $679 million of $1.16 billion in attempted theft
DMARC at p=reject stops exact-domain spoofing, but not lookalike domains or compromised accounts

For the complete phishing defense framework, see our phishing recognition and reporting guide.