BEC affects organizations of every size and sector. Government agencies, law firms, healthcare systems, and small businesses have all taken significant hits. The attack surface isn't a network vulnerability—it's human judgment under pressure.
This guide covers the full picture: how BEC works, the warning signs that precede an attack, a layered prevention framework you can implement now, and a response playbook for when one gets through.
TL;DR
- BEC is a targeted scam where attackers impersonate executives, vendors, or attorneys via email to steal funds or data—using social engineering alone, with no malware or malicious links involved
- The FBI IC3 reports $55.5 billion in cumulative BEC losses from October 2013 through December 2023
- 40% of BEC emails are now AI-generated, eliminating poor grammar as a reliable red flag
- Prevention requires layered controls: DMARC enforcement, MFA on critical accounts, role-specific training, and out-of-band payment verification
- Speed matters after a BEC attack: the FBI's Recovery Asset Team achieved a 71% fund recovery rate in 2023 when organizations contacted their bank immediately
What Is Business Email Compromise and How Does It Work?
BEC is a socially engineered attack where a threat actor impersonates a trusted party—an executive, vendor, attorney, or colleague—to manipulate an employee into wiring funds or surrendering sensitive data. No malware. No links. Just a convincing email and a well-timed request.
The Attack Lifecycle
BEC attacks follow a consistent four-phase pattern:
- Reconnaissance — Attackers profile targets using LinkedIn, company websites, SEC filings, and dark web data to identify decision-makers, reporting structures, and active vendor relationships
- Preparation — They register lookalike domains, compromise legitimate accounts, or craft spoofed addresses that closely mimic real ones
- Execution — A carefully worded email arrives with urgency, authority, and just enough context to feel authentic
- Money Movement — Stolen funds move rapidly through layered accounts, cryptocurrency exchanges, and third-party processors to complicate recovery
The Five Most Common BEC Variants
| Attack Type | How It Works |
|---|---|
| CEO Fraud | Attacker impersonates a senior executive, pressuring finance staff to wire funds urgently—often instructing them to skip approval channels |
| Email Account Compromise (EAC) | Attacker hijacks a legitimate employee account, monitors traffic silently for days or weeks, then strikes mid-transaction |
| False Invoice / VEC | Attacker poses as a known supplier requesting payment to a new bank account; Vendor Email Compromise (VEC) attacks surged 137% in financial services in 2023 |
| Attorney Impersonation | Exploits urgency around legal matters, M&A closings, or litigation to demand immediate fund transfers or confidential document sharing |
| Data Theft BEC | Targets HR for employee W-2s, SSNs, and payroll data—often a precursor to follow-on fraud or tax identity theft |
Why BEC Is So Hard to Detect
Standard email security filters scan for malicious links, attachments, and known malware signatures. BEC emails contain none of those things. They're plain text, written to mimic the sender's actual communication style, often referencing real projects or relationships.
Three factors consistently defeat standard defenses:
- Low volume — Most BEC campaigns involve one or two emails, never triggering traffic anomaly thresholds
- Legitimate-looking domains — Attackers register near-identical domains (y0urcompany.com vs. yourcompany.com) that pass casual inspection
- AI-generated content — VIPRE's Q2 2024 Email Threat Trends Report found that 40% of BEC emails are now AI-generated, up 20% year-over-year. Grammatical errors and awkward phrasing—once reliable red flags—are disappearing.
EAC attacks are the hardest to catch. When an attacker sends a fraudulent payment request from an employee's actual compromised inbox, every technical indicator looks legitimate.
The email originates from a real account, passes all authentication checks, and uses the person's real signature. There's nothing for a filter to flag.
What Happens When BEC Goes Unaddressed
The financial exposure is substantial. The FBI IC3's September 2024 PSA documented $55.5 billion in cumulative BEC losses across 305,033 incidents from October 2013 through December 2023—with annual losses consistently running between $2.7 billion and $2.9 billion in recent years.
But the wire transfer amount is rarely the full cost. IBM's Cost of a Data Breach research places the average BEC breach cost at $4.89 million per incident after adding investigation costs, legal fees, regulatory fines, and lost business. For small and mid-sized organizations, that total can be existential.
Warning Signs You're Facing a BEC Attempt
Train your team to pause on any email that exhibits these patterns:
- Subject lines screaming "Urgent," "Final Notice," or "Confidential—Time Sensitive" are designed to compress decision-making and bypass critical thinking
- Instructions to skip standard approval workflows, especially when the request appears to come from someone senior
- A vendor or executive asking for payment to a new account, framed as a one-time exception or tied to a confidential project
- Any request to communicate only via email and avoid calling anyone else — this isolates the target and blocks verification
- Reply-to addresses with subtle differences from the real domain: a swapped letter, an added hyphen, or a different TLD (for example, company.com vs. company-corp.com)
Knowing these signs is only half the picture. Attackers time their attempts deliberately, targeting moments of organizational change — new hires, executive transitions, M&A activity, or end-of-quarter financial pressure — when unusual requests feel more plausible and scrutiny drops.
How to Prevent Business Email Compromise
No single control stops BEC. The attacks are too varied and too adaptive. What works is a layered approach where technical protocols, procedural controls, and human awareness reinforce each other.
Implement Email Authentication Protocols
Deploy and enforce SPF, DKIM, and DMARC across all organizational email domains. The critical word is enforce—DMARC only blocks spoofing attacks when configured at "quarantine" or "reject" policy, not left in monitoring mode.
The gap here is significant: despite growing adoption, only 42% of DMARC-publishing domains have implemented enforcement-level policies. That means the majority of organizations publishing DMARC records are still leaving their domains spoofable. Three actions close that gap:
- Set DMARC policy to "reject" (not monitoring mode)
- Audit subdomain coverage to ensure no gaps exist
- Verify that third-party senders (marketing platforms, HR systems) are authenticated under your SPF record
Enforce Multi-Factor Authentication on Critical Accounts
MFA is the most direct defense against Email Account Compromise. Even when an attacker obtains valid credentials through phishing or a dark web breach, MFA blocks account access and cuts off the EAC pathway that enables the most convincing BEC variants.
Priority accounts for MFA enforcement:
- Executive and C-suite email
- Finance and accounts payable systems
- HR platforms with access to employee PII
- IT administrator accounts
- Any system through which payment instructions can be issued
A January 2025 NCUA/CISA joint advisory recommends disabling legacy email protocols like POP, IMAP, and SMTP that can bypass MFA entirely—a gap that attackers actively exploit in cloud email environments.
Train Employees to Recognize and Report BEC
Technical controls reduce your attack surface, but human behavior remains the primary entry point for BEC. KnowBe4's 2025 Phishing by Industry Benchmarking Report, analyzing 67.7 million simulations across 14.5 million users, found that consistent security awareness training reduced phishing susceptibility from 33.1% to 4.1%—an 86% drop over 12 months.
Effective BEC training looks different from general security awareness:
- Role-specific scenarios — Finance staff need wire transfer fraud simulations; HR needs W-2 data theft scenarios; executives need vendor impersonation drills
- Behavioral focus — Training must address why people comply under urgency and authority pressure, not just teach employees to spot technical indicators
- Regular cadence — Onboarding training plus quarterly refreshers minimum; periodic unannounced simulations to identify at-risk individuals
Prudential Associates offers social engineering and phishing penetration testing that simulates real BEC scenarios—spear-phishing, pretexting, and baiting—against finance, HR, and executive staff, then delivers targeted follow-up training based on who clicked.
Establish Out-of-Band Verification for Financial Requests
This is the control that directly stops BEC at the moment of execution. Before processing any wire transfer, change in banking details, or payment above a defined threshold:
- Call back using a pre-verified number — Not a number provided in the email, not a number from the email signature—a number from your verified contact directory
- Require dual authorization — No single employee should be able to approve a large or unusual transfer without a second sign-off
- Apply verification to vendor change requests — Any request to update banking details for an existing vendor should require direct voice confirmation through your established contact
This is also the control attackers cannot social-engineer around. Once an employee reaches the actual CFO—or the actual vendor contact—on a verified number, the fraud ends regardless of how convincing the email appeared.
How to Respond When a BEC Attack Hits
Speed determines how much of the loss is recoverable. The FBI's Recovery Asset Team achieved a 71% success rate freezing BEC funds in 2023—but that success depends entirely on how quickly the organization acts after discovery.
Immediate Response Sequence
- Freeze the transaction: Contact your bank immediately to request a wire recall or reversal. Minutes matter; funds move to secondary accounts fast.
- Preserve all evidence: Do not delete, forward, or modify any emails, logs, or account data associated with the incident. Preservation comes before investigation — always.
- Isolate the compromised account: Revoke active sessions, reset credentials, and audit email forwarding rules and inbox filters for attacker-created persistence mechanisms.
- Notify leadership and legal counsel: Internal escalation and legal advice should happen in parallel, not sequentially.
- File with the FBI IC3: Report at ic3.gov regardless of loss amount; this activates the Financial Fraud Kill Chain process for potential fund recovery.
- Contact your local FBI field office: Prioritize this step for losses above the threshold where federal investigation is practical.
Forensic Investigation
Beyond stopping the immediate loss, forensic investigation determines how the breach occurred, what data was accessed or exfiltrated, and whether the attacker still has presence in your environment.
That investigation also has to hold up in court. Chain-of-custody handling, forensically sound acquisition, and documented methodology are prerequisites for prosecution or civil recovery. Prudential Associates investigates BEC incidents across Maryland, Virginia, and DC using certified digital forensic examiners (GCIH, GCFA, CISSP, CFE) with direct law enforcement coordination experience — producing evidence suitable for courtroom presentation from day one.
Post-Incident Review
Before the incident fades from organizational memory:
- Document exactly how the attack entered, what controls failed, and what process gaps allowed it to succeed
- Update your incident response plan to close those gaps before the next attempt
- Brief affected departments on what happened and what changed—transparency here builds the internal vigilance that technical controls can't provide
Building Long-Term BEC Resilience
Prevention and response are not one-time projects. BEC tactics evolve continuously, and the organizations that stay protected are those that treat email security as an ongoing operational discipline.
Key practices that sustain resilience:
- Continuous monitoring — Flag unusual login locations, off-hours email activity, and sudden changes in forwarding rules; these are reliable indicators of account compromise in progress
- Scheduled red team exercises — Conduct simulated BEC attacks against high-risk roles at least annually; audit DMARC configurations, MFA enrollment rates, and vendor communication protocols on the same cadence
- Vendor and supply chain hygiene — Implement a formal verification process for any change to vendor banking details; communicate your verification protocols to key vendors so they understand why out-of-band checks are required
- Threat intelligence feeds — Subscribe to FBI IC3 alerts, CISA cybersecurity advisories, and sector-specific sources; as AI-generated BEC content grows harder to detect, staying current on attacker techniques keeps your defenses calibrated
Prudential Associates' dark web monitoring service adds a proactive layer to this framework. The service continuously scans dark web marketplaces, forums, and paste sites for compromised employee credentials and organizational data that could be exploited in a future BEC campaign, delivering real-time alerts and remediation guidance when a threat surfaces.
Frequently Asked Questions
What is a business email compromise in simple words?
BEC is a scam where a cybercriminal impersonates someone you trust—a CEO, vendor, or attorney—via email to trick an employee into sending money or sharing sensitive information. Unlike typical phishing, there are no malicious links or attachments, just a convincing message.
What are examples of business email compromise?
Common examples include:
- A CFO impersonation demanding an urgent wire transfer before a deal closes
- A vendor email requesting payment be redirected to a new bank account
- An HR request seeking employee W-2 or payroll data
Each relies on urgency and authority rather than technical exploits.
What are the three types of BEC attacks?
The three most prevalent types are CEO/executive fraud, email account compromise (EAC), and vendor/supplier invoice fraud. The FBI formally identifies five variants in total, adding attorney impersonation and data theft as distinct categories.
What is a red flag for business email compromise?
Watch for these warning signs:
- Artificial urgency paired with pressure to skip normal approval channels
- Instructions not to verify the request by phone or with colleagues
- Slight discrepancies in the sender's email address or reply-to field that only appear on close inspection
What is the difference between BEC and phishing?
Phishing is broad and volume-based—it targets many recipients with malicious links or attachments designed to steal credentials. BEC is highly targeted and uses only persuasive text to impersonate a trusted insider, making it harder to detect technically and typically far more financially damaging per incident.
Who is usually targeted in a BEC attack?
Several roles draw consistent attention from BEC attackers:
- Finance and accounts payable staff — primary targets due to payment authority
- Senior executives — impersonated to add authority to fraudulent requests
- HR personnel — targeted for employee PII and payroll data
- New employees — less likely to question requests appearing to come from leadership
