What Is Business Email Compromise (BEC) and How to Prevent It

An email lands from a supplier you’ve paid for years. Same name, same signature, same tone. They’ve “switched banks” and need this month’s invoice sent to a new account. Your bookkeeper updates the details, pays the invoice, and 3 weeks later the real supplier calls asking where their money is.

That is business email compromise, and it is one of the most expensive crimes reported to the FBI. In its 2025 Internet Crime Report, the FBI’s Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints with more than $3 billion in reported losses, second only to investment fraud. Those are only the cases people reported.

The good news: BEC rarely needs advanced hacking to work, and it rarely needs advanced technology to stop. A clear verification process beats almost every version of the scam.

What business email compromise actually is

The IC3 defines BEC as a scam that targets businesses or individuals who work with suppliers or regularly make wire transfers. Criminals compromise email accounts, and increasingly phone numbers and video meeting apps, through social engineering or computer intrusion, then use that access to push unauthorized transfers of funds.

BEC comes in 2 broad flavors:

• Impersonation. The attacker never gets inside your systems. They register a lookalike domain (rnyvendor.com instead of myvendor.com), spoof a display name, or use a free email account with your CEO’s name on it.
• Account takeover. The attacker steals a real password, usually through phishing, and logs into a genuine mailbox. Now the email really does come from your vendor or your controller. They often read old threads for weeks, learn who approves payments, and set up mail rules that hide replies from the real owner.

The second version is the dangerous one, because technical checks on the sender all pass. That is why the defense has to be a process, not just a filter.

The 5 most common BEC scenarios

Most BEC losses trace back to a handful of repeatable scripts. If your team knows these by name, they’ll recognize them faster.

The IC3 tracks real estate fraud separately from BEC, but the mechanics are the same: a compromised or spoofed email changes where the money goes at the last moment.

Key takeaway: BEC almost never asks for anything unusual in form. It asks for something normal, a payment or a detail change, with a twist in the destination. Train people to watch the destination, not just the sender.

Why BEC is getting harder to spot

Older BEC emails were often easy to catch: clumsy grammar, odd formatting, wrong names. That safety net is gone.

The FBI’s 2025 report notes that AI chat tools can quickly generate official-sounding emails that mimic a CEO, and that voice cloning can be used to request wire payments. Businesses reported more than $30 million in losses to BEC scams with an AI connection in 2025. The FBI is also clear that many BEC tactics are not AI-driven at all, so don’t treat “AI detection” as the fix.

What changes for you: you can’t rely on spotting bad writing or an unfamiliar voice. A phone call from your “CEO” that sounds exactly right is no longer proof. For a deeper look at these techniques, see our guide on how hackers use AI and how to spot a deepfake.

The verification process that stops wire fraud

Here is the core of BEC prevention. The FBI’s guidance is consistent: confirm payment requests and changes using contact details you already have, never the phone number or email address in the request itself. Build that into a written process your whole finance team follows.

Step 1: Define what triggers verification

Write down exactly which requests require a callback. At a minimum:

• Any new payee or vendor
• Any change to bank account, routing number or payment method for an existing payee
• Any wire or ACH above a set dollar amount
• Any payment request marked urgent or confidential
• Any direct deposit change for an employee

Step 2: Call back on a number you already trust

Call the person or company using a number from your vendor master file, a signed contract or the company’s official website. Never use a number from the email, the invoice attached to it or the signature block. If the attacker controls the email, they control those numbers too.

Set this up early. The FBI recommends establishing your verification protocol at the start of a business relationship and outside of email, so a hacked inbox can’t reveal how to get around it.

Step 3: Require a second approver

For payee changes and large transfers, require a second person to approve before money moves. The second approver checks that the callback happened and was logged. This turns a single tricked employee into a stopped attempt.

Step 4: Add a cooling-off period for changes

Consider holding the first payment to a changed account for a day or two, or sending a small test deposit and confirming receipt by phone. Attackers rely on urgency. A built-in delay removes their main tool.

Step 5: Log every verification

Record who called, which number they used, who they spoke to and when. A simple shared log works. It creates accountability and helps your bank and law enforcement if something slips through.

Step 6: Make “no” safe

Tell staff in writing that they will never be punished for delaying a payment to verify it, even if the request really is from the CEO. Then have the CEO say it too. BEC works by making people afraid to slow down.

Technical controls that back up the process

Process is the main defense, but these controls cut the number of attempts that reach your team and make account takeover harder.

• Multi-factor authentication on every mailbox. Stolen passwords are the main route into real accounts. Turn on MFA for email, accounting and banking, and prefer phishing-resistant options like passkeys or security keys. Our guide on how to set up two-factor authentication walks through it.
• SPF, DKIM and DMARC on your domain. These email authentication standards make it harder for criminals to spoof your exact domain. Google has required SPF or DKIM for everyone sending to Gmail since February 1, 2024, and DMARC as well for senders of more than 5,000 messages a day. Start DMARC with a monitoring policy, then move toward quarantine or reject.
• External sender tags. Most email platforms can label messages from outside your organization. It’s a simple nudge when an “internal” request comes from outside.
• Alerts on new forwarding rules. Attackers who take over a mailbox often create rules that forward or hide messages. Turn on alerts for new inbox rules and review them.
• Lookalike domain monitoring. Some email security tools and domain registrars can flag newly registered domains that resemble yours.
• Bank-side controls. Ask your bank about positive pay, payee approval workflows and dual authorization for wires.

These fit into a broader approach where no request is trusted by default, the idea behind zero trust security.

What to do if you’ve been hit

Speed matters more than anything. The FBI’s IC3 Recovery Asset Team works with banks through its Financial Fraud Kill Chain process to freeze fraudulent transfers. In 2025 it handled 3,900 incidents and froze about $679 million, a 58% success rate on the amounts involved. Those results depend on fast reporting.

1. Call your bank immediately. Ask for a recall of the wire or ACH and for the bank’s fraud team. Ask what indemnification paperwork they need.
2. File a complaint at ic3.gov. The FBI asks victims to report regardless of the amount and to include full transaction details, such as amounts, dates, and sending and receiving bank account information.
3. Lock down the compromised account. Reset passwords, end active sessions, review mail forwarding rules and turn on MFA if it was off.
4. Warn your contacts. If your mailbox was compromised, tell customers and vendors not to act on recent payment emails from you without calling.
5. Call your cyber insurer. Many policies have notification deadlines and preferred response firms. Check whether your policy covers “social engineering” or “funds transfer fraud”, which is often a separate coverage line.
6. Preserve evidence. Keep the emails with full headers, invoices and bank records. Don’t delete the compromised mailbox.

Where to start this week

You don’t need a big budget to cut your BEC risk sharply. Do these in order:

1. Write a one-page payment verification policy using the 6 steps above.
2. Turn on MFA for every email account, starting with finance, executives and anyone who can approve payments.
3. Build a vendor contact file with verified phone numbers, confirmed in person or from signed contracts.
4. Enable dual approval for wires and payee changes in your online banking.
5. Run a 20-minute training session using the 5 scenarios table, then repeat it every quarter.
6. Check your domain’s SPF, DKIM and DMARC records, or ask your IT provider to.

If you outsource IT, our guide on choosing a managed IT service provider covers what to ask about email security.

Conclusion

Business email compromise succeeds because it looks like ordinary work. The fix is equally ordinary: a habit of picking up the phone, a second approver and a written rule that makes it safe to slow down. Put those in place, back them with MFA and email authentication, and you take away most of what BEC scammers rely on. For other common threats, browse our cybersecurity glossary and ransomware protection guide.

Sources

• FBI IC3: 2025 IC3 Annual Report — BEC definition, 2025 complaint and loss figures, AI-related BEC losses, Recovery Asset Team results and reporting guidance
• FBI: Business Email Compromise — prevention tips, verifying requests with independently found contact details
• FBI: Business Email Compromise brochure (PDF) — establishing verification protocols early and outside email, secondary sign-off on payment changes
• Google Workspace Admin Help: Email sender guidelines — SPF, DKIM and DMARC requirements effective February 1, 2024