business email compromise
,

It is 4:45 on a Friday afternoon. Your accounts payable manager gets an email from a long-time supplier: their bank details have changed, and the overdue invoice needs to go out today. The logo is right. The tone sounds familiar. The thread even includes last month’s real correspondence. The wire goes out.

On Monday, the real supplier calls asking where their payment is.

That is business email compromise, and it is one of the most expensive crimes facing organizations today. According to the FBI’s 2025 Internet Crime Report, released in April 2026, the FBI’s Internet Crime Complaint Center (IC3) received 24,768 business email compromise complaints in 2025, with reported losses of more than $3 billion. Overall, victims reported almost $21 billion in internet crime losses, a record. And in the Association for Financial Professionals’ 2025 Payments Fraud and Control Survey, 79% of organizations reported attempted or actual payments fraud, with 63% experiencing business email compromise.

What Is Business Email Compromise?

Business email compromise (BEC) is a scam in which criminals impersonate a trusted person, such as an executive, vendor, attorney, or employee, to trick an organization into sending money or sensitive data. Unlike mass phishing, BEC is targeted, patient, and often contains no malware at all, which helps it slip past security filters.

Once the money moves, the crime typically becomes wire fraud. Under 18 U.S.C. § 1343, using wire communications to carry out a scheme to defraud carries up to 20 years in federal prison, or up to 30 years when it affects a financial institution.

The Most Common BEC Schemes

Business email compromise comes in several forms. The most common include:

  • Vendor email compromise: Fraudsters hijack or spoof a real supplier’s email and redirect invoice payments to a new account.
  • CEO or executive fraud: An urgent request from a “senior leader” asks finance to wire funds for a confidential deal.
  • Attorney impersonation: A fake lawyer pressures staff to move money quickly for a time-sensitive legal matter.
  • Payroll diversion: An “employee” asks HR to switch their direct deposit to a new account.
  • Real estate and closing fraud: Buyers receive fake wiring instructions just before closing.

The fake vendor angle overlaps heavily with other billing schemes. Our guide to fake vendor and fictitious supplier fraud explains how investigators separate outside impersonation from inside jobs.

Why BEC Hits Companies So Hard

Business email compromise succeeds because it exploits people and process, not just technology. Several factors make it so damaging:

  1. It looks legitimate. Attackers often study real email threads for weeks before striking.
  2. It weaponizes urgency. Deadlines, secrecy, and authority discourage employees from double-checking.
  3. Wires move fast. Once funds leave, they are quickly split across accounts, money mules, or crypto platforms.
  4. AI makes it more convincing. Generative AI now helps criminals write flawless emails, clone voices, and even fake video calls.

A well-known real-world example shows the scale. A Lithuanian man used fake invoices and spoofed emails posing as a hardware supplier to steal more than $100 million from Google and Facebook. He pleaded guilty to wire fraud and was sentenced to five years in federal prison in 2019, according to the U.S. Department of Justice. If two of the world’s most sophisticated technology companies can be fooled, any organization can.

AI-driven impersonation is now raising the stakes further, as we cover in our article on deepfake invoice fraud in accounts payable.

Red Flags Every Finance Team Should Know

Train your staff to pause when they see any of these warning signs:

  • A request to change bank details, especially by email alone
  • Unusual urgency, secrecy, or pressure to bypass normal approvals
  • Slight changes in an email address or domain, such as one swapped letter
  • Requests from executives who are traveling or “unreachable”
  • New payment destinations in a different country or at a different bank
  • Replies that go to a different address than the one shown

Many of these red flags also appear in internal schemes. See our breakdown of 7 signs of corporate fraud most companies ignore.

How to Prevent Business Email Compromise

No single tool stops business email compromise. Strong defenses layer people, process, and technology:

  • Call-back verification: Confirm every bank detail change by phone, using a number already on file, never one from the email.
  • Dual authorization: Require two people to approve new payees and large wires. Our guide to dual control policies shows how to design them.
  • Email authentication: Implement SPF, DKIM, and DMARC to make domain spoofing harder.
  • Multi-factor authentication: Protect email accounts so stolen passwords alone are not enough.
  • External email banners: Flag messages that come from outside the organization.
  • Payment holds: Delay first-time or changed-account payments by 24 to 48 hours for review.
  • Regular training: Run realistic simulations for finance, HR, and executive assistants.

These controls work best as part of a broader framework. Learn which safeguards hold up in practice in the internal controls that actually stop theft.

What to Do in the First Hours After a BEC Attack

Speed is everything. The FBI’s Recovery Asset Team initiated about 3,900 Financial Fraud Kill Chain actions in 2025 and froze more than $679 million, a 58% success rate, but only when victims reported quickly. If you suspect business email compromise:

  1. Call your bank immediately and request a wire recall. Ask them to contact the receiving bank.
  2. File a complaint at ic3.gov with full transaction details.
  3. Contact local law enforcement and your FBI field office.
  4. Secure your email environment. Reset passwords, review mailbox forwarding rules, and check login logs.
  5. Preserve evidence. Do not delete suspicious emails. Headers, logs, and metadata are critical to any investigation.
  6. Notify your insurer and review cyber or crime coverage.

For a step-by-step response plan, see our checklist for the first 48 hours after discovering fraud.

Conclusion: Verification Beats Speed

Business email compromise thrives on trust, urgency, and one moment of inattention. The good news is that simple, consistent controls like call-back verification, dual approval, and fast reporting stop the majority of attacks or limit the damage when they happen.

If your organization has been hit, or you want to test whether your payment controls would hold up, FraudOrder can help. Our forensic accountants and investigators trace diverted funds, determine how attackers got in, document findings for insurers and courts, and strengthen your defenses with integrity and accuracy. Contact FraudOrder for a confidential consultation today.

Frequently Asked Questions

1. What is the difference between business email compromise and wire fraud?

Business email compromise is the method: impersonating a trusted party by email to trick an organization. Wire fraud is the federal crime that often results when money is moved electronically as part of the scheme. Many BEC cases are prosecuted under the federal wire fraud statute.

2. Can money lost to business email compromise be recovered?

Sometimes, especially if you act within hours. Contact your bank right away and file a complaint at ic3.gov so the FBI can try to freeze funds. Recovery chances drop sharply as time passes and funds are moved.

3. Does insurance cover business email compromise losses?

It depends on your policy. Some crime or cyber policies cover social engineering fraud, often with lower sublimits, while others exclude it. Review your coverage with your broker before an incident occurs.

4. Is our company liable if an employee sends money to a scammer?

Liability depends on contracts, bank agreements, and the controls in place. Courts and insurers often look at whether reasonable verification steps were followed. Consult legal counsel about your specific situation.

5. How can a forensic investigator help after a BEC attack? Investigators trace where funds went, review email logs and headers to determine how attackers gained access, and document findings for banks, insurers, law enforcement, and litigation. FraudOrder also identifies control gaps to prevent repeat attacks.

6. Should small businesses worry about business email compromise?

Yes. Small businesses are frequent targets because they often lack formal verification procedures and dual approvals. Simple controls like call-back verification can prevent most losses.

References

Disclaimer

This article is for informational purposes only and does not constitute legal, financial, or professional advice. Reading it does not create a client relationship with FraudOrder. Consult qualified legal and forensic professionals about your specific situation. For questions about FraudOrder services, visit https://fraudorder.co/