CEO fraud and BEC: which exposed data fields make it convincing

How attackers make a BEC request convincing

Business email compromise works when a payment request looks routine. Attackers make it look routine with two kinds of information about the executive they impersonate:

1. Context: name, title, who approves payments, who the assistant is, when the executive travels. Most of this is public.
2. Access: a password that still works, a personal email account, a phone number that can be taken over. This is what breach data supplies.

Context makes a spoofed email believable. Access lets the attacker send the request from the real account. The second layer is the one a security team can find in breach data and close.

What the FBI numbers show

The FBI's Internet Crime Complaint Center (IC3) received 24,768 BEC complaints in 2025, with reported losses of $3,046,598,558, according to its 2025 annual report. That is up from $2,770,151,146 in 2024. Among cyber-enabled fraud types, only investment fraud ($8,648,617,756) caused larger reported losses. In the report's chart of transaction types, wire transfer or ACH accounts for 86% of what BEC complainants reported.

The report defines BEC as a scam targeting businesses or individuals who regularly make wire transfer payments, carried out "by compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques".

The report's section on AI covers BEC as well. It says chat generators "can quickly create official-sounding emails mimicking a company's CEO or other officials", that voice cloning can be used to request wire payments, and that businesses reported losses of over $30 million to BEC scams involving AI in 2025. It also notes that not all BEC tactics are AI-enabled. Voice and video fakes start from the same exposed data; our guide on what deepfake fraudsters collect first lists it. We tested the idea in a red team exercise: a two-stage phishing campaign written with an AI model trained on an executive's public writing, after which several senior officers and directors opened the file, security staff among them.

Over a longer window, an IC3 public service announcement from September 2024 puts domestic and international exposed losses from BEC at $55,499,915,582 between October 2013 and December 2023.

How attackers research executives before BEC

The FBI described the research phase in a 2016 public service announcement. It said it is largely unknown how victims are selected, but that the subjects "monitor and study their selected victims using social engineering techniques prior to initiating the BEC scam", and can accurately identify the people and procedures needed to perform wire transfers in a given business.

The same announcement lists what it saw in complaints:

• Fraudulent emails "coincided with business travel dates for executives whose e-mails were spoofed."
• Requests were "well-worded, specific to the business being victimized", and asked for amounts close to normal transactions.
• "Hacked e-mails often occur with a personal e-mail account."
• Victims sometimes first received phishing emails asking for details such as names and travel dates.

It names the executive variant directly: in its second scenario, the email accounts of high-level executives are spoofed or hacked and a wire request goes to the employee who normally processes it. That scenario "has also been referred to as 'CEO Fraud'". The glossary entries on CEO fraud, business email compromise and whaling separate the terms.

Field by field: what each exposed field gives an attacker

The table maps the data fields that commonly appear about executives to what they do in a BEC attempt and the control that answers each one. The first five are fields that appear in breach records. The last two come from public sources and are included because the FBI names them. The controls come from the FBI announcements cited below, except in the username row, which is common practice.

Two fields deserve a closer look.

The password. A spoofed email has to get past a skeptical reader. A request sent from the real mailbox, in the middle of a real thread, does not. That is why a reused password is the field to close first. The September 2024 PSA lists unique passwords for every online service among its prevention tips, and our guide on what to do when an executive's password is in a breach covers the reset order.

The phone number. The FBI's 2022 PSA on SIM swapping explains that once a number is moved to a SIM card the criminal holds, calls and texts go to the criminal's device, and SMS-based one-time codes can be used to reset passwords and take over accounts. Its advice includes using "strong multi-factor authentication methods such as biometrics, physical security tokens, or standalone authentication applications". See SIM swap.

Other fields found in breach records, such as social security numbers or payment card numbers, serve identity fraud more than BEC. They still matter: the 2016 PSA describes a BEC variant in which a compromised executive account is used to request employees' W-2 forms or lists of personal data from HR or bookkeeping.

Which fields to close first

A practical order for a security team, using only controls the FBI recommends:

1. Reset exposed passwords that are still in use, starting with email and anything that can approve or change a payment. Enforce MFA on those accounts.
2. Move business approvals off personal accounts. If an executive's personal address appears in breach data, assume it is a target and secure it.
3. Protect the phone number. Replace SMS codes with an authenticator app or hardware key where the service allows it.
4. Verify payment changes out of band. The 2016 PSA advises confirming transfer requests by phone using "previously known numbers, not the numbers provided in the e-mail request", and adding a secondary sign-off for changes to vendor payment details.
5. Treat secrecy and urgency as warning signs. The same PSA advises suspicion of "requests for secrecy or pressure to take action quickly".
6. Trim the public context. The FBI advises care with what is posted to social media and company websites, "especially job duties/descriptions, hierarchal information, and out of office details."

Steps 1 to 3 depend on knowing which fields are exposed. Steps 4 to 6 work even after the data is out, which matters because breach data cannot be deleted from the copies that already circulate.

How CEM finds the exposed fields

CEM discovers a company's executives from the company name and checks each one against breach corpora and leak databases. It shows which fields are exposed for each person, such as email addresses, phone numbers, passwords and usernames, and ranks the findings by what to fix first. The methodology lists the factors, including likely password reuse. A password, payment card or social security number is typically rated critical, and an email address, phone number or username high.

CEM ranks the exposed fields an attacker can use, so the team knows what to reset first. For fake profiles that impersonate an executive, our specialists file the takedown requests and verify each removal (information removal). Payment call-backs, mail filtering and staff training stop a BEC request in flight; resetting the exposed fields in the order above protects the accounts behind it. For the personal side of the same exposure, see executive personal accounts and what breach data shows.