Business email compromise (BEC)

How it works

The FBI's Internet Crime Complaint Center (IC3) describes BEC as a scam targeting businesses or individuals working with suppliers and businesses that regularly perform wire transfers. Fraudsters compromise email accounts and other forms of communication, such as phone numbers and virtual meeting applications, through social engineering or computer intrusion, to conduct unauthorized transfers of funds.

A 2019 IC3 advisory uses the label BEC/EAC, for email account compromise, and notes that the scam is not always about a transfer. One variation uses a compromised business mailbox to request employees' personally identifiable information or W-2 tax forms. Another is payroll diversion: HR or payroll staff receive spoofed emails, apparently from employees, asking to change direct deposit details.

Scale

IC3's 2025 annual report records 24,768 BEC complaints with reported losses of $3,046,598,558, up from $2,770,151,146 in 2024. Only investment fraud had higher reported losses. These are reported complaints, so the true total is not known.

How exposed data feeds it

BEC succeeds when a message matches what the recipient expects: familiar names, the real reporting line, a plausible amount and believable timing. Attackers gather that detail from public sources and from earlier breaches. Credentials found in breach data can also give direct access to a mailbox, which lets the fraudster write from the real account and read existing threads. CEO fraud and BEC goes through which exposed fields make a request convincing.

Executive data matters twice. It supplies the identity to imitate, and it supplies the email account to take over.

Reducing the risk

IC3's advice for staff includes using secondary channels or two-factor authentication to verify requests to change account information, checking that the sender's address and any links match who the message claims to be from, and never supplying login credentials or personal data in response to an email. Victims should contact their bank at once to request a recall of funds and file a complaint with IC3. Organizations can add a callback rule for any change to payment details, require two approvers above a set amount, reset credentials that appear in breach data, and use multi-factor authentication on mailboxes.

How it differs from related terms

CEO fraud is the BEC variant that impersonates a senior executive. Whaling targets senior people as the victims, while BEC usually targets the people who move the money. Account takeover is one way a BEC attacker gets a real mailbox, but a BEC attack can also run entirely from a lookalike domain without taking over any account.