MY ONE BLOGby Manishdai
Cybersecurity

What is Business Email Compromise?

Quick answer

A scam in which criminals impersonate or take over a business email account to trick staff into sending money or sensitive data.

Business Email Compromise, explained

Business email compromise, or BEC, typically involves an email that appears to come from an executive, supplier, lawyer, or colleague. Sometimes the attacker uses a lookalike domain. In other cases, they have actually broken into a real mailbox and can read past conversations, making requests very convincing. BEC is consistently listed by the FBI as one of the costliest forms of cybercrime reported to it.

A typical case is a fake invoice email announcing that a supplier has changed bank accounts, sent just before a large payment is due. The money goes to the criminal and is often hard to recover. Protective steps include multi-factor authentication on email, alerts for suspicious forwarding rules, verifying any payment change by calling a known number, and requiring two people to approve large transfers.

Related terms

Multi-Factor Authentication

A login method that requires two or more different types of proof of identity, such as a password plus a code from your phone.

Phishing

A social engineering attack that uses fake emails, messages, or websites to trick people into revealing information or installing malware.

Security Awareness Training

Education that teaches employees to recognize and avoid cyber threats such as phishing, scams, and unsafe handling of data.

Spear Phishing

A targeted phishing attack aimed at a specific person or organization, using personal details to make the message more convincing.

Guides that mention Business Email Compromise