Learn Dark Web

Cybersecurity

What Is BEC Fraud? Business Email Scams

Business email compromise, or BEC, is a scam aimed at organisations rather than individuals. A criminal impersonates a senior executive, a supplier or a colleague and persuades an employee to transfer money, change payment details, or share sensitive information. It is one of the most expensive forms of online fraud — and it usually needs no malware at all, just a convincing email.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Note. BEC rarely involves a hacked system. It works because the email looks like a normal request from a real person, and because busy staff want to be helpful. The defence is a process rule, not a product: no payment or bank-detail change without a second, separate check.

What business email compromise is

BEC is fraud by impersonation inside a business. The attacker pretends to be someone the victim trusts — the chief executive, a director, a supplier, a lawyer, or a colleague in finance — and sends a request that looks like ordinary business: please pay this invoice urgently, please update our bank details, please send the payroll file. The victim acts in good faith, and the money goes to the criminal.

The FBI Internet Crime Complaint Center has consistently reported business email compromise among the costliest forms of internet crime in the United States, with reported losses far exceeding those of most other fraud types. The reason is simple: a single successful BEC attack can move a large payment, and the victim often does not realise until the real supplier asks where their money is.

BEC differs from ordinary phishing in its target and its patience. Ordinary phishing is sent in bulk and hopes someone clicks. BEC is usually aimed at a specific company, often after the attacker has studied its staff, suppliers and payment routines from public sources — company websites, social media, press releases and job adverts all help.

The most common BEC variants

The classic form is the fake invoice: an email that appears to come from a genuine supplier, with an invoice attached and a request to pay — except the bank details have been changed to the attacker's account. Sometimes the attacker has already compromised the supplier's real email account, so the message comes from a genuine address and the invoice is a genuine document with altered details.

The chief executive fraud, sometimes called CEO fraud, is an email that appears to come from a senior leader asking finance staff to make an urgent, confidential payment, often for a secret acquisition or an urgent deal. The message stresses secrecy and urgency so the victim does not check with anyone. A related variant is the payroll diversion: a message that appears to come from an employee asking HR to change the bank account their salary is paid into.

Other variants target data rather than money: a message that appears to come from a senior manager asking for employee tax details, payroll files or customer data. And the gift-card variant, common in smaller organisations, asks an employee to buy gift cards urgently for a client or a team event and send the codes — the digital equivalent of handing over cash.

  • Fake invoice with changed bank details.
  • Executive fraud: an urgent, secret payment request.
  • Payroll diversion: change my salary bank account.
  • Data theft: send the payroll or customer file.
  • Gift cards: buy them now and send the codes.

How attackers prepare a BEC attack

Most BEC attacks begin with research, not hacking. The attacker studies the target company: who works in finance, who approves payments, who the suppliers are, how invoices normally look. Company websites, professional networking profiles, press releases and even job adverts reveal names, roles and reporting lines. A photo of the team, a job advert for an accounts assistant, or a press release naming a supplier can all feed an attack.

Sometimes the attacker goes further and compromises a real mailbox — the supplier's, a colleague's, or an executive's — often through a phishing email that captures a password. Once inside, they can read genuine email threads, learn the tone and timing of real requests, and then send their fraudulent message from the real account, inside a real conversation. That is why even a message from a familiar address deserves a second check when money is involved.

The attack itself is usually timed for a busy moment: end of month, a holiday period, or a time when the usual approver is away. Urgency and authority are the twin levers — the message comes from someone senior, and it needs to be done now, quietly.

Red flags to watch for

The strongest red flag is any change to established routines: a supplier's bank details changing by email alone, a request to pay a new account, an urgent payment outside the normal approval process, or a senior person asking for something they never normally ask for. Process changes should always trigger a verification step, whatever the message says.

Other signs include a sender address that is a close lookalike of the real one, a free email service used for a message that claims to come from a company, a reply-to address that differs from the sender, and language that is slightly off — unusually formal or unusually casual for that person. Secrecy is another signal: a message that says do not tell anyone, keep this between us, or handle it discreetly is trying to remove the very checks that would stop it.

The absence of red flags does not prove a message is genuine. A well-researched BEC message can be flawless, which is why the defence is a process that does not depend on spotting the fake.

Controls that stop BEC

The single most effective control is a verification rule: any new payee, any change of bank details, and any payment above a set amount must be verified through a separate, trusted channel — a phone call to a number already on file, not a number in the email. The rule should apply to everyone, including the chief executive, and no exception should exist for urgency.

Second, require two-person approval for payments and bank-detail changes, so no single person can move money on the strength of one email. Third, train finance and admin staff on the specific variants, using realistic examples from their own work, and make reporting easy and blame-free — the person who spots an attempt should be praised, not embarrassed.

Technical controls help too: turn on multi-factor authentication on every work email account, especially senior staff and finance; use email authentication standards on your own domain; and set up alerts for changes to payment details or new forwarding rules in mailboxes. But technology alone is not enough — BEC is defeated by a process that assumes any email could be fake and checks anyway.

  • Verify every change of bank details by phone, using a number already on file.
  • Require two-person approval for payments and payee changes.
  • Multi-factor authentication on every work email account.
  • Make reporting easy, quick, and free of blame.

If your organisation has been hit

Act immediately. Contact your bank and ask them to try to recall the payment — speed matters, because once the money moves on it is far harder to recover. Report the fraud to the police and, in the United States, to the FBI Internet Crime Complaint Center at ic3.gov. In the United Kingdom, report it to Action Fraud and forward the phishing emails to report@phishing.gov.uk.

Preserve the evidence: do not delete the emails, and keep the headers, which show where the message really came from — your IT team can extract them. Check whether any account was compromised: look for new email forwarding rules, changes to recovery details, and unfamiliar logins in the affected mailboxes, and reset passwords and turn on multi-factor authentication where needed.

Tell the real supplier or person who was impersonated, and tell any other staff who may have received similar messages. Review what happened honestly — not to blame anyone, but to find the gap the attacker used — and close it with a process change. Most organisations that suffer a BEC attack can prevent the next one with a single rule: no bank-detail change without a phone call.

Sources

Last checked: 14 November 2026.

Frequently asked questions

What does BEC stand for?

BEC stands for business email compromise. It is a fraud in which a criminal impersonates a senior executive, a supplier or a colleague and persuades an employee to transfer money, change payment details, or share sensitive information.

Why is BEC so expensive?

Because it targets organisations and payments. One successful BEC attack can move a large invoice payment or salary run, and the loss is often discovered only when the real supplier asks where the money is. The FBI Internet Crime Complaint Center reports BEC among the costliest internet crimes in the US.

Can BEC happen without any hacking?

Yes — most BEC needs no malware at all. The attacker only needs a convincing email, often built from public information about the company. In some cases the attacker does compromise a real mailbox first, which makes the fake message even harder to spot.

What is CEO fraud?

CEO fraud is a BEC variant in which the message appears to come from the chief executive or another senior leader, asking finance staff to make an urgent, confidential payment. The urgency and the authority of the sender are designed to bypass normal checks.

How do I verify a supplier's new bank details?

Do not use a phone number or link in the email that announced the change. Call the supplier on a number you already have on file, from an earlier invoice or their official website, and confirm the change with a named contact before paying anything.