What is business e-mail compromise (BEC)?
Business e-mail compromise is fraud in which criminals use e-mail to trick a company into paying them or handing over sensitive data. They either break into a real mailbox, often after a phishing login, or imitate one with a lookalike address. Typical variants: the fake CEO asking for an urgent confidential transfer, the supplier whose bank details suddenly change, the request to redirect an employee's salary to a new account, and the lawyer handling a secret deal. BEC often uses no malware and no link, only a convincing message at the right moment, which is why technical filters miss so much of it. It is one of the costliest forms of cybercrime: the FBI's Internet Crime Complaint Center reported about 2.8 billion US dollars of BEC losses for 2024. The strongest defence is a payment process that requires verification by phone, on a known number, before any change of bank details or unusual transfer.
Read next
Related questions
- Can network monitoring stop CEO fraud?
- Can a phishing e-mail come from a colleague's real account?
- A supplier asks us to change their bank details. How do we check it is genuine?
- We paid a fraudulent invoice. What should we do now?
- A supplier's e-mail account was hacked and they wrote to us. What should we do?
← All 29 questions on Phishing and e-mail aftermathAll topics